Vbulletin 4.2.3 shell upload

Is it possible to upload shell there.(Sadly I dont have admin access)

(Feb 17, 2017 12:17 AM)iLoveGaming Wrote:  Is it possible to upload shell there.(Sadly I dont have admin access)

Without Admin access, it'll be hard. You can however upload a shell as MOD if you make a 'announcement' containing a persistent XSS to a javascript which automatically hijacks admin sessions / user:pass & upload a shell as hook. ( Yes, this exists )

Edit: PM me the site, maybe I can help you with this.

Or download the source and audit it to find sensitive areas in code that may be vulnerable.
Test on a local installation. (The alternate way, if you can't find public exploit or own 0day).
Cheers, Gee.

(Feb 17, 2017 09:37 AM)Gee4rce Wrote:  Or download the source and audit it to find sensitive areas in code that may be vulnerable.
Test on a local installation. (The alternate way, if you can't find public exploit or own 0day).
Cheers, Gee.

You want him to find another 0-day in Vb 4.2.3, mkay.

(Feb 17, 2017 03:45 AM)Teferi Wrote:  Without Admin access, it'll be hard. You can however upload a shell as MOD if you make a 'announcement' containing a persistent XSS to a javascript which automatically hijacks admin sessions / user:pass & upload a shell as hook. ( Yes, this exists )

Edit: PM me the site, maybe I can help you with this.

you can do that without a mod account I have a chain xss that works from a normal user account, you simply link a mod to it and then bam, it's like a double chain exploit hits the mod then hits the admin.

(Feb 17, 2017 12:23 PM)Teferi Wrote:  You want him to find another 0-day in Vb 4.2.3, mkay.

Yes, why not?
This is surely no guaranteed way of success in the end, but basically this is what's hacking about.
Using public exploits is easy, real hacking takes place when looking for new vulnerabilities.

Let's say the targeted site is not prone to any public exploits, then this will be your last, but best option.

Cheers, Gee.

Thanks to all guys who helped me out here! <3