Free Image Hosting Script – Arbitrary File Upload

• Exploit Database
• 116 阅读

• 作者： ySecurity
  日期： 2011-12-26
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/18277/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48

  ============================================ Free Image Hosting Script Remote File Upload Vulnerability ============================================ # Exploit Title: Free Image Hosting Script [ALL VERSIONS] Remote File Upload Vulnerability # Date: 26/12/11 # Author: ySecurity # Vendor or Software Link: http://www.photohostingscript.com # Price: $29.99 # Version: All versions effected # Category:: Remote File Upload # Google dork: inurl:"show-image.php?id=" # Tested on: Windows 7 # Vendor HAS been notified. ########################################################################################   NOTE: You will ONLY be able to find your shell if the "/pictures" directory and if the directory is not forbidden.   This exploit allows hackers to upload a PHP backdoor into "/pictures/" directory via the use of Live HTTP Headers (Firefox Addon)   [Vulnerability]   Tools Needed: Live HTTP Headers, Backdoor Shell   Step 1: Locate upload form on index page. Step 2: Rename your shell to shell.php.jpg and start capturing data with Live HTTP Headers Step 3: Enter tags for the image (can be anything) Step 4: Replay data with Live HTTP Headers - Step 5: Change [Content-Disposition: form-data; name="image1"; filename="shell.php.jpg"\r\n] to [Content-Disposition: form-data; name="image1"; filename="shell.php"\r\n] Step 6: Locate pictures directory: www.site.tld/imagehostingscript/pictures/ (usually) Step 7: Find PHP file (random digits.php) = should look like (321879194bc8ff2843bf7b63a666f665.php) Step 8: Navigate to backdoor = www.site.tld/imagehostingscript/pictures/321879194bc8ff2843bf7b63a666f665.php     ########################################################################################   Greets to: Team Intra   Submitted ethically, after disclosure.