Jump to content
Sign in to follow this  
KhiZaRix

WordPress Windows Desktop And iPhone Photo Uploader File Upload

Recommended Posts

##################################################################################################

#Exploit Title : Wordpress plugin Windows Desktop and iPhone Photo Uploader arbitrary file upload vulnerbility

#Author : Manish Kishan Tanwar AKA error1046

#Home Page : https://wordpress.org/plugins/i-dump-iphone-to-wordpress-photo-uploader/

#Download Link : https://downloads.wordpress.org/plugin/i-dump-iphone-to-wordpress-photo-uploader.1.8.zip

#Date : 9/04/2015

#Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Incredible,Kishan Singh and ritu rathi

#Discovered At : Indishell Lab

##################################################################################################

////////////////////////

/// Overview:

////////////////////////

file uploading code(uploader.php) in Windows Desktop and iPhone Photo Uploader plugin doesnt check for file extension before uploading it to server

and hence vulnerable to arbitrary file upload

////////////////

/// POC ////

///////////////

Uploading PHP shell

=================================

Just open uploader.php in plugin directory

Access Denied

browse your php shell and submit it.

after uploading, you will get your shell in uploads directory at following location

http://target.com/wp-content/uploads/i-dump-uploads/

demo:-

404 Not Found

and upload your shell

--==[[ Greetz To ]]==--

############################################################################################

#Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba,

#Silent poison India,Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad,

#Hackuin,Alicks,mike waals,Suriya Prakash, cyber gladiator,Cyber Ace,Golden boy INDIA,

#Ketan Singh,AR AR,saad abbasi,Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Dash

#############################################################################################

--==[[Love to]]==--

# My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi,

#Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Jagriti,Salty and Don(Deepika kaushik)

--==[[ Special Fuck goes to ]]==--

<3 suriya Cyber Tyson <3

Source: http://packetstorm.wowhacker.com/1504-exploits/wpwdippu-upload.txt

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this  

×
×
  • Create New...