WorlDos - ��

vBulletin 3.X/4.X CSRF IMG-Tag Exploit, ��

�� — Sat, 19 May 2012 22:38:32 GMT

��: http://www.xaker.name/forvb/showthread.php?t=26145
http://hooligan-xn.ru/showthread.php?t=17
�� , �� .
�� P4INW4R

��:

===============================================================

vBulletin 3.X/4.X CSRF IMG-Tag Exploit

===============================================================

 

___________      .__           .__  _______          

\_   _____/ ____ |  |__   ____ |  | \   _  \   ____  

 |    __)__/ ___\|  |  \_/ __ \|  | /  /_\  \ /    \

 |        \  \___|   Y  \  ___/|  |_\  \_/   \   |  \

/_______  /\___  >___|  /\___  >____/\_____  /___|  /

        \/     \/     \/     \/            \/     \/

 

# Exploit Title: vBulletin 3.X/4.X CSRF IMG-Tag Exploit

# Date: 28/04/2011                          

# Author: Cyber Tjak                    

# Software Link: http://www.vBulletin.org

# Version: 3.X & 4.X

# Google Dork 1: Powered by vBulletin 3.X

# Google Dork 2: Powered by vBulletin 4.X

# Platform / Tested on: Multiple

# Category: Webapplications

# Code : N/A

 

#  BUG :  ######################################################################

 

1 > Go to something were you want to include it e.g. /profile.php?do=editsignature

The IMG-Tag must be allowed there.

 

2 > Post a new post with these content ===> [IMG]Your Script[/IMG]

 

3 > You can use it with a plugin like iTrader http://[localhost]/board/itrader_fee...RID&parseurl=1

Furthermore you can use it with external scripts like an ip-logging script.

Just like a normal CSRF-Vuln. =)

 

4 > Now you see that your script is working.

 

 

#  FIX by P4INW4R :  ###########################################################

 

You must create a whitelist for trustworthy imagehosters.

 

1 > Open ./includes/class_bbcode.php

 

2 > Search for:

 

        function handle_bbcode_img_match($link)

        {

                $link = $this->strip_smilies(str_replace('\\"', '"', $link));

 

                // remove double spaces -- fixes issues with wordwrap

                $link = str_replace(array('  ', '"'), '', $link);

 

                return '';

        }

 

3 > Replace with:

 

        function handle_bbcode_img_match($link)

        {

                $link = $this->strip_smilies(str_replace('\\"', '"', $link));

               

                // remove double spaces -- fixes issues with wordwrap

                $link = str_replace(array('  ', '"'), '', $link);

 

                //CSRF FIX

                $whitelist = array("HERE YOUR IMAGEHOSTER WITHOUT HTTP:// e.g. abload.de");

               

                $host = parse_url($link, PHP_URL_HOST);

                if(substr($host, 0, 4) == "www.")

                {

                $host = str_replace("www.", "", $host);

                }

       

                if (in_array($host, $whitelist)) {

                return '';

                }

                else

                {

                return 'Please upload your picture at a trusted hoster. For example abload.de
';

                }              

        }

 

We know that this fix-method is suboptimal so we must wait for a better fix by vBulletin.

 

 

################################################################################

 

Our Website: http://www.echel0n.net

 

Special Thanks to: P4INW4R, Subnet, Skittles, 0x00, Santa & all other mates.

 

################################################################################

� � "��" �� )

��:

/**

        * Handles a match of the [img] tag that will be displayed as an actual image.

        *

        * @param        string        The URL to the image.

        *

        * @return        string        HTML representation of the tag.

        */

    function handle_bbcode_img_match($link)

        {

                $link = $this->strip_smilies(str_replace('\\"', '"', $link));



                // remove double spaces -- fixes issues with wordwrap

                $link = str_replace(array('  ', '"'), '', $link);



                $whitelist = array(

                "savepic.net",

                "savepic.ru",

                "hostingkartinok.com",

                "imglink.ru",

                "imageshost.ru",

                "pixshock.net",

                "radikal.ru",

                "saveimg.ru",

                "ipicture.ru",

                "jpg1.ru",

                "imagepost.ru",

                "jpeghost.ru",

                "impic.ru",

                "fastpic.ru",

                "imgex.com",

                "pictureshack.ru",

                "keep4u.ru",

                "myphotoalbum.ru",

                "4put.ru",

                "xmages.net",

                "lostpic.net");



                $host = parse_url($link, PHP_URL_HOST);

                if(substr($host, 0, 4) == "www.")

                {

                $host = str_replace("www.", "", $host);

                }



                if (in_array($host, $whitelist)) {

                return '';

                }

                else

                {

                return 'Please upload your picture at a trusted hoster. For: savepic.net, radikal.ru, ipicture.ru, fastpic.ru, etc
';

                }

        }



/*======================================================================*\

|| #################################################################### ||

|| # ---------------------- Xaker.Name ------------------------------ # ||

\*======================================================================*/

�� , �� "Img ��", �� /�� :)

LDesign [�� ]

Luperk — Thu, 10 May 2012 09:19:22 GMT

�� , �� .

�� -��

��

�� ICQ 5005848

��:
antichat.ru
xakepok.su
tophope.ru

SexHTTP DDOS Service

Luperk — Thu, 10 May 2012 09:16:47 GMT

DDoS - �� .
�� - �� ddos.
�� ddos ��, ��.
�� .
�� :
�� .
�� , �� .
�� .
�� ? �� .
�� 5-10 �� .
MoneyBack (�� ), �� .
�� .
��:
1 �� 5$.
24 �� 50$.
�� 300$.
�� : Webmoney.
��:
ICQ 902493
ICQ 568921
�� :
Xaknet.ru
Xaker-forum.ru
Shopworld.biz
Capone.es
Hack-stars.ru
r00t.in

for google
�� ddos ��, �� ddos, ddos service, ddos ��, ddos ��, �� a ��, �� , massive ddos attack, �� , �� DDoS-��, �� , �� , �� , �� , �� , �� , �� , �� , ddos ��, �� , need to ddos site, �� , �� , ddos �� , �� .
�� Ddos �� Ddos service ddos attack �� Ddos
�� , �� , �� , �� , �� , �� , �� , +�� , �� , samp ��, �� , ddos ��, ddos ��, ddos service, services ddosa, to punish a competitor, where the order to ddos Saito, stop work Saito, ddos attack ddos order, + server ddos attack ddos attack order, samp ddos, buy ddos, ddos attack, ddos Site, dd

FAQ �� header'e

no name — Sat, 05 May 2012 11:35:20 GMT

�� ,�� vb3.8

�� , �� , �� .

�� :�

� �� header �� :

PHP ��:


		
			


<div style="position:absolute; top:0; left:0; z-index:99999999999;">

<a href="#" title="� 9 ���! � ���� ������!">

<img border="0" src="/images/9mayageorglenta.gif">

a>

div>

� �� :

�� header :

PHP ��:


		
			


<div style="position:absolute; top:0; left:0; z-index:99999999999;">

<a href="#" title="� 9 ���! � ���� ������!">

<img border="0" src="/images/9mayalentageorg.png">

a>

div>

� �� :

�� * �� images

*��

�� worldos.ru

�� 

��

	9mayageorglenta.gif (1.3 ��)
	9mayalentageorg.png (6.9 ��)

FAQ ��

no name — Sat, 05 May 2012 11:22:55 GMT

��, �� , �� , � �� , � , �� . �� , �� , �� , �� , � �� ..

�� , �� .

��

� �� header �� :

PHP ��:


		
			

<div style="position:absolute; top:0; left:0; z-index:99999999999;">
<a href="#" title="� 9 ���! � ���� ������!">
<img border="0" src="/images/9mayageorglenta.gif">
a>
div>

� �� :

�� header :

PHP ��:


		
			

<div style="position:absolute; top:0; left:0; z-index:99999999999;">
<a href="#" title="� 9 ���! � ���� ������!">
<img border="0" src="/images/9mayalentageorg.png">
a>
div>

� �� :

�� * �� images

*��

�� worldos.ru

��

	9mayageorglenta.gif (1.3 ��)
	9mayalentageorg.png (6.9 ��)

�� Russia Today ��