+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: ¸.•*☀[DORK: "Portail Dokeos" ]►Deface and Shell Upload Vulnerability]► [TUTORIAL] (/showthread.php?tid=2244116)
Pages: Pages
1
2
¸.•*☀[DORK: "Portail Dokeos" ]►Deface and Shell Upload Vulnerability]► [TUTORIAL] - ｍＯｂｉＩｅ - Feb 24, 2012
[img]http://img593.imageshack.us/img593/3751/bannernv.jpg[/img]
Portail Dokeos vulnerability is a Kind of FCK editor remote file upload vulnerability. In this vulnerability a hacker can upload a shell, deface page or any file on website without admin username and password. and still works 🎉
Tutorial:
Google Dork : "Portail Dokeos 1.8.5"
Exploit :
PHP Code
<?php
http://website/patch/main/inc/lib/fckeditor/editor/filemanager/upload/test.html
Goto :
PHP Code
<?php
http://website/patch/main/inc/lib/fckeditor/editor/filemanager/upload/test.html
Change asp into PHP like FCK editor and Upload you deface shell or file, You can upload, .html .php .jpg .txt formats
To view your uploaded file go here :
PHP Code
<?php
http://website/patch/main/upload/your file here
Here's my tutorial with screenshots on how i got this to work for me:
1.) Under the "Select the "File Uploader" to use" click PHP.
Spoiler (Click to View)
2.) Open "TamperData" https://addons.mozilla.org/en-US/firefox/addon/tamper-data/
Spoiler (Click to View)
3.) "Start TamperData" Click "Browse" and locate your php shell then click "Send it to the Server"
Spoiler (Click to View)
4.) A popup will come up in TamperData, when it does click the "Tamper" button.
Spoiler (Click to View)
5.) After you click "Tamper" button another popup will come up where you can edit the code. Scroll down until you locate your shell.
Spoiler (Click to View)
6.) Next change the "shell.php" to "shell.html" and click "OK".
Spoiler (Click to View)
7.) When your shell is finished uploading, you will be givin a URL to it.
Spoiler (Click to View)
8.) Goto the link to Access your Shell.
Spoiler (Click to View)
Thats it! It works on html also, so if you just want to add your deface w/out the shell you can. 🎉
The whole purpose of this thread is show and train you on how this vulnerability works.
PHP Code
<?php
http://www.dokeos.nrc-gauthey.fr/main/inc/lib/fckeditor/editor/filemanager/upload/test.html
NOTE:
I did not Find this vulnerability just simply explaining how it's done.
Thanks for reading my thread. 🤝
* - infekt3d_gh0st - Feb 24, 2012
Thanks for the tutorial. Definitely going to be using this exploit.
🤝
* - Kiev - Feb 24, 2012
Just a little advice for anyone going to use this - having gone through about 100~ sites, only 2 actually work with the shell.
* - Kiev - Feb 24, 2012
Oh trust me, I tried majority of those.
However, once my shell is uploaded, its displayed in either plain text... or as broken HTML. My PHP uploader also fails to work on any but 2.
* - Sw1x - Feb 24, 2012
Never leave us you have the best methods!
* - v11 - Feb 24, 2012
Moblie has the best tuts out there. Thanks for sharing.
* - infekt3d_gh0st - Feb 24, 2012
(Feb 24, 2012 06:28 PM)Kiev Wrote: Just a little advice for anyone going to use this - having gone through about 100~ sites, only 2 actually work with the shell.
Had the same problem, shell wasn't working. Im going to try some from that list
EDIT: Tried different sites with different shells, this is the best I got:
Spoiler (Click to View)
* - 03storic - Feb 25, 2012
I managed to get it working but using a slightly different method to above.
[img]http://i.minus.com/ibnfpZbYwnm2dR.PNG[/img]
* - infekt3d_gh0st - Feb 25, 2012
(Feb 25, 2012 01:28 AM)03storic Wrote: I managed to get it working but using a slightly different method to above.
[img]http://i.minus.com/ibnfpZbYwnm2dR.PNG[/img]
What was your method? If you don't mind sharing.
* - Natalie Portman - Feb 25, 2012
Just getting a white screen with my C100...
Any tips? 03storic please share your slightly altered method.
Thanks in advance!
- Envyy
* - 03storic - Feb 25, 2012
Ok guess there is no real harm in sharing.
Code
http://www.exploit-db.com/exploits/17644/* - infekt3d_gh0st - Feb 25, 2012
(Feb 25, 2012 01:53 AM)Envyy Wrote: Just getting a white screen with my C100...
Any tips? 03storic please share your slightly altered method.
Thanks in advance!
- Envyy
Yeh I had the same problem with different shells. C100 w/o password protection only showed a white screen, however, with C100 password protected I got what I posted before.
(Feb 25, 2012 02:04 AM)03storic Wrote: Ok guess there is no real harm in sharing.
Codehttp://www.exploit-db.com/exploits/17644/
Thanks for the share <3
Going to try this out now.
* - Natalie Portman - Feb 25, 2012
CONFIRMED: WSO shell works, so does an R57.
However, while using WSO shell, I get an error saying "Error: File cannot be read" I am then redirected back to the upload page.
EXAMPLE:http://www.formation-microkine.fr/main/upload/wso2.5.html
* - infekt3d_gh0st - Feb 25, 2012
(Feb 25, 2012 04:37 AM)Envyy Wrote: CONFIRMED: WSO shell works, so does an R57.
However, while using WSO shell, I get an error saying "Error: File cannot be read" I am then redirected back to the upload page.
EXAMPLE:http://www.formation-microkine.fr/main/upload/wso2.5.html
Did these shells work when uploading with mobiles method?
* - Th3D3v1L - Feb 25, 2012
Thank u ! its cool but its for all website ?