vBulletin Template Runtime Pre-Authentication PHP Code Execution

This repository is a small standalone Python exploit project for vBulletin remote code execution. It contains only two files: a short README with FOFA search dorks for identifying vBulletin targets and a single main script, poc.py, which implements the exploit workflow. The exploit is not just a detector. It actively crafts an obfuscated payload that appears intended to invoke PHP's system function through the vulnerable vBulletin AJAX route ajax/render/pagenav using POST parameters routestring and pagenav[pagenumber]. The script first performs a vulnerability check by sending an echo marker and confirming the marker appears in the response. It then supports arbitrary command execution, parsing command output between delimiter strings. Beyond basic RCE validation, the script includes post-exploitation helpers. It probes common Linux web-root paths such as /var/www/html and /usr/share/nginx/html by issuing touch/rm commands to determine whether the compromised web server user can write files there. If writable storage is found, the truncated code clearly indicates support for uploading a shell from base64-encoded content and then recording the resulting shell URL. This makes the exploit operational rather than a simple proof of concept. Repository structure is minimal and purpose-built: README.md provides targeting hints; poc.py handles banner/UI output, payload generation, vulnerability testing, command execution, writable-directory discovery, multithreaded scanning, result logging, and optional shell deployment. The script supports both single-target and mass-scan usage, maintains progress counters, and writes successful targets and uploaded shell locations to local files. Observed targeting strongly suggests vBulletin 6.x instances, especially 6.1 and 6.2 as referenced in the README dorks. The exploit assumes a Linux-like target environment because its post-exploitation commands use pwd, touch, and rm and its writable-directory candidates are standard Unix web paths.

Repository contains two Python tools: `exploit.py` (main offensive toolkit) and `safecheck.py` (verification-only scanner). The exploit targets CVE-2026-61511, described as a pre-auth PHP eval injection in vBulletin AJAX template rendering affecting vBulletin 5.0.0-5.7.5 and 6.0.0-6.2.1. The code is not part of a known exploit framework. `exploit.py` is the primary entry point and implements a weaponized web/network exploit. It defines a pool of 18 candidate AJAX/API paths and uses an obfuscated PHP expression encoder (`CHR_FUN`, `encode_str`, `build_payload`) to generate PHPFuck-style payloads intended to evade filtering. Visible payload generators include arbitrary command execution through `system()`, a base64-decoded bash reverse shell callback to operator-supplied `--lhost/--lport`, and a web shell dropper that writes `/shell.php` containing `<?php @eval($_POST["c"]); ?>` into the target document root. The CLI and README indicate additional post-exploitation modules such as persistence installation, database dumping, credential dumping, log cleaning, interactive control, and mass scanning with threads. `safecheck.py` mirrors the same vulnerable path list and payload-building logic but is positioned as a non-intrusive verifier. It creates an HTTP session, fingerprints the target via headers/body/cookies, tests the exposed AJAX endpoints, records path accessibility and marker-based vulnerability results, and can emit JSON reports. This script is better characterized as a detection/verification utility rather than an exploit, but the repository overall clearly contains real exploitation code in `exploit.py`. Fingerprintable targets and artifacts include the 18 vBulletin AJAX endpoints, the dropped `/shell.php` web shell path, documented file targets `/etc/passwd` and `/etc/shadow`, optional proxy endpoint examples, and the reverse-shell TCP callback mechanism. Overall, this is an operational pre-auth RCE toolkit for vulnerable vBulletin deployments, with both offensive exploitation and safer validation workflows.

This repository contains a single Python script, cve-2026-61511_batch.py, implementing a batch pre-auth RCE scanner/exploit for alleged CVE-2026-61511 affecting vBulletin. The script is not just a detector: it sends an exploitation payload that attempts to invoke PHP system() on the target and execute a hardcoded shell command (whoami), then parses the HTTP response for a marker to confirm code execution. Structure and behavior: the script defines a PHPFuck-style encoder (CHR_FUN, NUMBERS, encode_ascii_digits, make_payload) to obfuscate the PHP function name and argument string. It builds a POST body with routestring=ajax/render/pagenav and pagenav[pagenumber]=<encoded payload>, suggesting the vulnerability is triggered through the ajax/render/pagenav route. A global requests.Session with connection pooling is lazily initialized, SSL verification is disabled, and optional HTTP/HTTPS proxy support is provided. The scanner loads URLs from a file or stdin, normalizes missing schemes to http://, strips trailing slashes, and scans targets concurrently with ThreadPoolExecutor. Exploit capability: for each target, scan_target() sends one POST request containing the encoded payload equivalent to system('whoami 2>/dev/null; echo __DONE__;'). If the response contains the __DONE__ marker, the script treats the target as vulnerable and extracts the preceding output as the remote user context (e.g., root, www-data). Results are printed live to stdout and appended to a timestamped local file. Error handling distinguishes timeout, refused connection, and generic URL/request failures, but non-vulnerable targets simply return no result. Operational assessment: this is a functional batch exploitation utility with basic hardcoded post-exploitation behavior rather than a generalized framework module. It is operational because it performs real command execution, but the payload is fixed to whoami and not user-customizable from the CLI. No persistence, shell staging, lateral movement, or secondary payload delivery is present.