add. exploit module vbulletin 5.x unauth RCE

[mekhalleh]

Fixes #12360

https://seclists.org/fulldisclosure/2019/Sep/31

vBulletin 5.x 0day pre-auth RCE exploit
This should work on all versions from 5.0.0 till 5.5.4

Verification

List the steps needed to make sure this thing works

• Start msfconsole
• set exploit/multi/http/vbulletin_5x_unauth_rce
• set RHOSTS 192.168.1.11
• set LHOST 192.168.1.10
• run

TODO : docs, try to dropper binary elf/pe for better experience.

[mekhalleh]

Actually tested on Windows system host and vBulletin v5.4.5.

[mekhalleh]

Tested on Linux system host and vBulletin v5.5.1.

[h00die]

First look over, this is pretty good. Untested, some style things to change, will test once they get fixed up

[space-r7]

First look over, this is pretty good. Untested, some style things to change, will test once they get fixed up

Hi @h00die! Would you happen to have a test environment and if so, would you be willing to test this if you have the time? If not, I can verify with a pcap. Thanks!

[h00die]

@space-r7 I wanted to get around to this, but realistically I'm not going to be able to in a reasonable amount of time

[space-r7]

@space-r7 I wanted to get around to this, but realistically I'm not going to be able to in a reasonable amount of time

Alrighty, no worries! Thank you!

Hey @mekhalleh, when you have time, could you please send a pcap of exploiting Vbulletin with your module to msfdev[at]metasploit.com? Thanks!

[mekhalleh]

@space-r7 I wanted to get around to this, but realistically I'm not going to be able to in a reasonable amount of time

Alrighty, no worries! Thank you!

Hey @mekhalleh, when you have time, could you please send a pcap of exploiting Vbulletin with your module to msfdev[at]metasploit.com? Thanks!

it's sended.

[space-r7]

Verified the pcap, will go ahead and land.

[space-r7]

Release Notes

This adds an exploit module for vBulletin v5.0.0 through v5.5.4 that gains unauthenticated remote code execution by leveraging a flaw in the widget creation functionality. RCE can be leveraged by sending a POST request to ajax/render/widget_php with arbitrary data located in the widgetConfig[code] parameter.