「Neuromancer」Hacking sites with Joomla (Universidade USP)

Websites running Joomla v.1.5 are vulnerable to remote admin password change, we can do this simply using a direct string that will take us to the "token confirmation page" (The true admin WOULD receive the token in his e-mail, but we're not the TRUE admin :). After do that, we just put the " ' " char in the token field to bypass the authentication and change REMOTELY the admin's passwd.
The problem is found in file : ../components/com_user/models/reset.php (lines 111 - 130)
The victim was "USP - Universidade de São Paulo - RPM Section"

Subscribe and watch more attack techniques from neuromancer: www.youtube.com/neurom4nc3r

Secunia Advisory: SA31457
CVE-2008-3681

Category:

Science & Technology

Tags:

• Hacking
• server
• flaw
• falha
• invasão
• invadindo
• joomla
• linux
• windows
• owned
• pwned
• owning
• 1.5
• joomla!
• token
• bug
• remote
• password
• admin
• network
• security
• segurança
• da
• informação
• reset
• reseting
• exploits
• exploit
• vulnerable
• vulnerability
• string
• USP
• Universidade
• de
• São
• Paulo
• hackers
• neurom4nc3r
• neuromancer
• networking
• redes
• computadores
• computação
• tutorial
• how-to
• attack

[ubudog32]

Nice music... what's it called?

[neurom4nc3r]

@ubudog32 Excuse the delay dude, the song is called "Synth Solo" (hidden track) from Children of Bodom

[rafvrab]

It doesn't work. You actually have to enter the token sent to the email address of the administrator, so you'd have to hack the admin's account first.

[neurom4nc3r]

@rafvrab you're wrong. See the vid again

[martinkolle95]

hehe, this does not work any more. Joomla have edited it in the files!! :D

[neurom4nc3r]

@martinkolle95 yeah, its very very rare in nowadays as all old vulnerabilities. Today we have new ones, and thats is good (or not). lol.

[stefanninjasaga]

Hmm it ask me to verify from E-mail from admin hmm

[racassel]

It doesnt matter, you were Pwoned and Punked! The Police will laugh at you if you saay 'waynnnnhh... My joomla site was pwoned"

[racassel]

It doesnt matter, you were Pwoned and Punked!

[djplayer93]

@barkerAU linux -.-

[barkerAU]

I know this mac ;p'

[martinkolle95]

@neurom4nc3r haha, maybe, for somone is it good!! :D