@@ -10,21 +10,17 @@ class Metasploit3 < Msf::Auxiliary
10
10
11
11
def initialize ( info = { } )
12
12
super ( update_info ( info ,
13
- 'Name' => 'Determinant Databases MyBB ' ,
13
+ 'Name' => 'Determinant Databases MyBB ' ,
14
14
'Description' => %q{
15
- Determine the database in the forum.
16
- This affects versions <= 1.6.12
15
+ This module checks if MyBB is running behind an URL. Also uses a malformed query to
16
+ force an error and fingerprint the backend database used by MyBB.
17
17
} ,
18
- 'Author' =>
18
+ 'Author' =>
19
19
[
20
20
#http://www.linkedin.com/pub/arthur-karmanovskii/82/923/812
21
- 'Arthur Karmanovskii <fnsnic[at]gmail.com>' #Discovery and Metasploit Module
22
- ] ,
23
- 'License' => MSF_LICENSE ,
24
- 'References' =>
25
- [
26
- [ 'URL' , 'https://github.com/rapid7/metasploit-framework/pull/3070' ]
21
+ 'Arthur Karmanovskii <fnsnic[at]gmail.com>' # Discovery and Metasploit Module
27
22
] ,
23
+ 'License' => MSF_LICENSE ,
28
24
'DisclosureDate' => 'Feb 13 2014' ) )
29
25
30
26
register_options (
@@ -44,49 +40,49 @@ def check
44
40
'intcheck' => 1
45
41
}
46
42
} )
47
- if res . nil?
48
- print_error ( "Failed to retrieve webpage." )
49
- return Exploit ::CheckCode ::Unknown
50
- end
51
43
52
- if res . code != 200
53
- print_error ( "Unable to query to host: #{ datastore [ 'RHOST' ] } :#{ datastore [ 'RPORT' ] } (#{ datastore [ 'TARGETURI' ] } )." )
44
+ if res . nil? || res . code != 200
54
45
return Exploit ::CheckCode ::Unknown
55
46
end
56
47
57
48
#Check PhP
58
49
php_version = res [ 'X-Powered-By' ]
59
50
if php_version
60
- php_version = " PHP Version: #{ php_version } " . ljust ( 40 )
51
+ php_version = "PHP #{ php_version } "
61
52
else
62
- php_version = " PHP Version: unknown" . ljust ( 40 )
53
+ php_version = "PHP version unknown"
63
54
end
64
55
65
56
#Check Web-Server
66
57
web_server = res [ 'Server' ]
67
58
if web_server
68
- web_server = " Server Version: #{ web_server } " . ljust ( 40 )
59
+ web_server = "#{ web_server } "
69
60
else
70
- web_server = " Server Version: unknown" . ljust ( 40 )
61
+ web_server = "unknown web server"
71
62
end
72
63
73
64
#Check forum MyBB
74
65
if res . body . match ( "MYBB" )
75
- print_good ( "Congratulations! This forum is MyBB :) " + "HOST: " + datastore [ 'RHOST' ] . ljust ( 15 ) + php_version + web_server )
66
+ print_good ( "#{ peer } - MyBB forum found running on #{ web_server } / #{ php_version } " )
76
67
return Exploit ::CheckCode ::Detected
77
68
else
78
- print_status ( "This forum is not guaranteed to be MyBB" +"HOST: " +datastore [ 'RHOST' ] . ljust ( 15 ) +php_version +web_server )
79
- return Exploit ::CheckCode ::Unknown
80
- end
81
- rescue RuntimeError => err
82
- print_error ( "Unhandled error in #{ datastore [ 'RHOST' ] } : #{ err . class } : #{ err } " )
83
69
return Exploit ::CheckCode ::Unknown
84
70
end
71
+ rescue
72
+ return Exploit ::CheckCode ::Unknown
73
+ end
85
74
86
75
end
87
76
88
77
89
78
def run
79
+ print_status ( "#{ peer } - Checking MyBB..." )
80
+ unless check == Exploit ::CheckCode ::Detected
81
+ print_error ( "#{ peer } - MyBB not found" )
82
+ return
83
+ end
84
+
85
+ print_status ( "#{ peer } - Checking database..." )
90
86
uri = normalize_uri ( target_uri . path , 'memberlist.php' )
91
87
response = send_request_cgi (
92
88
{
@@ -97,17 +93,17 @@ def run
97
93
}
98
94
} )
99
95
if response . nil?
100
- print_error ( "Failed to retrieve webpage ." )
96
+ print_error ( "#{ peer } - Timeout.. ." )
101
97
return
102
98
end
103
99
104
100
#Resolve response
105
101
if response . body . match ( /SELECT COUNT\( \* \) AS users FROM mybb_users u WHERE 1=1 AND u.username NOT REGEXP\( \' \[ a-zA-Z\] \' \) / )
106
- print_good ( "Database is: PostgreSQL ;) " )
102
+ print_good ( "#{ peer } - Running PostgreSQL Database " )
107
103
elsif response . body . match ( /General error\: 1 no such function\: REGEXP/ )
108
- print_good ( "Database is: SQLite ;) " )
104
+ print_good ( "#{ peer } - Running SQLite Database " )
109
105
else
110
- print_status ( "Database MySQL or this is not forum MyBB or unknown Database " )
106
+ print_status ( "#{ peer } - Running MySQL or unknown database " )
111
107
end
112
108
end
113
109
end
0 commit comments