After telling my workmates and boss that we had a very critical lack of security controls, finally we got compromised!
They had a Joomla 1.5 which was exploited using a file upload vulnerability. WSO 2.5 web shell was uploaded.
I'm trying to find out where is the vulnerable parameter but I haven't had success. Running joomscan I confirm the vulnerability:
# 20 Info -> CorePlugin: TinyMCE TinyBrowser addon multiple vulnerabilities Versions effected: Joomla! 1.5.12 Check: /plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/ Exploit: While Joomla! team announced only File Upload vulnerability, in fact there are many. See: http://www.milw0rm.com/exploits/9296 Vulnerable? Yes
w3af reports a possible CSRF and possible critical ClickJacking because the target doesn't have X-Frame-Options header. But I don't know how to leverage both vulnerabilities to successfully upload a file.
Finally, I tried the easy way of running Metasploit, but I'm finding difficulties on setting the target IP. The vulnerable server doesn't have direct access from external networks. Incoming connections first go to an Apache server and then are redirected to the Joomla server. So how could I set up the target on Metasploit? Because afaik, I can only use IP and no URL for RHOST (didn't use Metasploit so much), and the IP points to the Apache and no the Joomla.
Tomorrow I'll have more time, so I'll try to manually find the vulnerability. What do you recommend me to look for?