+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [WordPress Plugins:]>_WP Job Manager_[/Arbitrary File Upload | Tutorial ] (/showthread.php?tid=5642449)
[WordPress Plugins:]>_WP Job Manager_[/Arbitrary File Upload | Tutorial ] - ｍＯｂｉＩｅ - Jun 8, 2017
![[Image: Bk771kA.png]](https://i.imgur.com/Bk771kA.png)
WordPress Plugins WP Job Manager - Arbitrary File Upload
![[Image: 2amQeTV.gif]](https://i.imgur.com/2amQeTV.gif)
Been seeing this exploit in the wild a lot lately so I'd thought I'd share it. 👍
Tutorial:
1.) Google Dork/s:
PHP Code
<?php
inurl:/wp-content/plugins/wp-job-manager/
inurl:/wp-content/uploads/wp-job-manager-uploads/
![[Image: zcIUjSr.jpg]](https://i.imgur.com/zcIUjSr.jpg)
2.) After you choose a site, go to an html online site.
http://htmledit.squarefree.com
Paste PoC:
Change target.com with your target's URL.
![[Image: dPfR5jl.jpg]](https://i.imgur.com/dPfR5jl.jpg)
3.) Choose an image and click upload.
Path to file:
PHP Code
<?php
https://www.target.com/wp-content/uploads/job-manager-uploads/files/YYYY/MM/your-files.jpg
![[Image: jp3ufdU.jpg]](https://i.imgur.com/jp3ufdU.jpg)
Example:
PHP Code
<?php
http://mydevices.com/wp-content/uploads/job-manager-uploads/files/2017/06/legends.gif
Video Demo:
Source:
https://cxsecurity.com/issue/WLB-2017060029
Now you can tell your friends you uploaded a photo that said "Hacked" to a website. 🤣
Enjoy. I guess. 🤝
* - ｋａ＄ｈ - Jun 8, 2017
Nice tutorial mObiIe, looks great.
* - ᏙictorҮ - Jun 8, 2017
Nice tutorial, reminded me of the challenge we did :')
RE: [WordPress Plugins:]>_WP Job Manager_[/Arbitrary File Upload | Tutorial ] - Skull-13 - Nov 20, 2017
Excellent material, keep it going!. This are true tutorials.
RE: [WordPress Plugins:]>_WP Job Manager_[/Arbitrary File Upload | Tutorial ] - Root-Cat - Nov 21, 2017
Thank you for this nice tutorial
RE: [WordPress Plugins:]>_WP Job Manager_[/Arbitrary File Upload | Tutorial ] - t3nd3r - Dec 19, 2017
can it upload shell aswell?