Hey guys, today I'm gonna be showing you how to get your shell uploaded on vBulletin forums. Once you have admin access (not sure about Founder), log into your admin panel.

Usually it's something like this..

If it's not, try /admin.


Once you're logged in, you should be presented with the oh so mighty vBulletin Admin Control Panel..

Spoiler (Click to Hide)

Now on the left, click plugins and products, and click on Add New Plugin.

Spoiler (Click to Hide)

It should take you to something that looks like this.

Spoiler (Click to Hide)

Product:vBulletin.
Hook Location: We're going to be executing remote code through the ajax plugin, so under Hook Location, click ajax_complete.
Title: .....whatever you want to name it.
Plugin PHP Code: This is where your code is going. First we want to check the disabled functions on the server. Let's see if we can get this PHP Info to show up...
Plugin is active: No

It should all look like this once you're done..

Now it should redirect you back to the plugins manager. If there's any plugins active under the ajax plugin, uncheck them and make sure yours is active. Scroll down and click "Save Active Status".

Should look something like this...

Now save it, and go to your ajax page.

Local File Inlcusion
allow_url_fopen = On
That means we can create a Local File Inclusion vulnerability.

Now you can poison logs, dig up juicy files, or use another method of LFI to get your shell up.


Remote File Inclusion

allow_url_include = Off
That means we can't create an RFI vulnerability until we get our shell up..

If we could, it would be almost the same thing as LFI.

Remote Code Execution
Now, if any of these are disabled, you're going to have some trouble. If not, we can get our shell up using unix commands.

That's a unix commands to list files, now see if it worked..

You should see all the files in the current directory.

Woot, site pwnt. Now you can use wget to get your shell uploaded..

Game, there you go. Now you can activate the default plugin and delete your evidence.
Shoutout to the rest of Team Intra and my boys in Zer0Lulz for making this possible.