# Exploit Title: VBulletin 4.* DownloadsII poison nullbyte

# Date: 2010-04-12

# Author: Un-Dead

# Team: ex.ploit ( http://ex.ploit.net )

# Software Link: http://www.vbulletin.org/forum/showthread.php?t=231427

# Version: VBulletin 4.* and VBulletin 3.8.* using DownloadsII module

# Tested on: Windows XP SP3

# Usage: poison nullbyte

# File upload bypass using nullbyte

# Code:

Upload a regular file that follows the guidelines of the uploader. Be it .rar, .pdf, etc.

Once you have uploaded your file you will have the ability to upload images.

Upload your file via nullbyte.

Ex: exploit.php%00.jpg

Once this is uploaded you will see the link to the direct file as:

http://www.target-site.com/PathToVB/...t.php_NULL.jpg

However in the downloads directory itself it will have dropped the .jpg extension. So just remove “_NULL.jpg” and your good to go.

Further edit: It’s noted this also works on the initial file upload, however something like exploit.php%00.rar will turn into randomnumbers-exploit.php making it hard to track down your file.