-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
add. exploit module vbulletin 5.x unauth RCE #12364
add. exploit module vbulletin 5.x unauth RCE #12364
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
First look over, this is pretty good. Untested, some style things to change, will test once they get fixed up
documentation/modules/exploit/multi/http/vbulletin_5x_unauth_rce.md
Outdated
Show resolved
Hide resolved
documentation/modules/exploit/multi/http/vbulletin_5x_unauth_rce.md
Outdated
Show resolved
Hide resolved
documentation/modules/exploit/multi/http/vbulletin_5x_unauth_rce.md
Outdated
Show resolved
Hide resolved
documentation/modules/exploit/multi/http/vbulletin_5x_unauth_rce.md
Outdated
Show resolved
Hide resolved
documentation/modules/exploit/multi/http/vbulletin_5x_unauth_rce.md
Outdated
Show resolved
Hide resolved
Hi @h00die! Would you happen to have a test environment and if so, would you be willing to test this if you have the time? If not, I can verify with a pcap. Thanks! |
@space-r7 I wanted to get around to this, but realistically I'm not going to be able to in a reasonable amount of time |
Alrighty, no worries! Thank you! Hey @mekhalleh, when you have time, could you please send a pcap of exploiting Vbulletin with your module to msfdev[at]metasploit.com? Thanks! |
it's sended. |
documentation/modules/exploit/multi/http/vbulletin_widgetconfig_rce.md
Outdated
Show resolved
Hide resolved
Verified the pcap, will go ahead and land. |
Release NotesThis adds an exploit module for vBulletin |
Fixes #12360
https://seclists.org/fulldisclosure/2019/Sep/31
vBulletin 5.x 0day pre-auth RCE exploit
This should work on all versions from 5.0.0 till 5.5.4
Verification
List the steps needed to make sure this thing works
msfconsole
set exploit/multi/http/vbulletin_5x_unauth_rce
set RHOSTS 192.168.1.11
set LHOST 192.168.1.10
run
TODO : docs, try to dropper binary elf/pe for better experience.