Many a times a vulnerability is released saying that so and so version of a specific software has so and so vulnerability and an exploit is released for that vulnerability. In order for an exploit to work successfully it becomes necessary to find our target’s exact version. For example, take Joomla, a popular CMS. Recently we have seen Joomla HTTP Header Unauthenticated Remote Code Execution exploit which affects Joomla versions 1.5.0 to 3.4.5. We have also seen another exploit “Joomla Error-Based SQL Injection exploit for enumeration ” which affects Joomla versions 3.2 to 3.4.4. To successfully exploit these vulnerabilities, it becomes important to first fingerprint the Joomla version of our target. Luckily Metasploit has an auxiliary module to find out the exact version of our Joomla target. Today we will see fingerprinting Joomla version with Metasploit. Before we start Metasploit, open Shodan and search for “Joomla”. We will get many IP addresses where Joomla is running. Now start Metasploit and load the module given below. Type command “show options” to see the required options for this module.
We need to set two options: rhosts( which is target IP addresses ) and targeturi. Set targeturi as shown below. Coming to “rhosts” option, copy and paste the IP addresses we got in our shodan search giving space between each IP address as shown below. Here I have given five IP addresses.
Check whether all options are set correctly by typing command “show options“.
Next it’s time to run our exploit. Type command “run” and you will get the results as shown below. From our results we can conclude that all of the five targets may be vulnerable to Joomla HTTP Header Unauthenticated Remote Code Execution exploit and targets 2 and 3 may be vulnerable to Joomla Error-Based SQL Injection exploit for enumeration exploit.