• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar

LinuxSec Exploit

Nothing is Ever Locked

  • XSS Payloads
  • About Us

Exploit WPStore Themes Upload Vulnerability

June 4, 2013 by Jack Wilder 15 Comments

Kali ini saya akan share tutorial Exploit WPStore Themes Upload Vulnerability pada CMS WordPress. Sebenarnya ini bug lama, namun sampai sekarang ternyata masih banyak web yang vuln dengan exploit ini. Tentu saja dengan kesabaran dan kepintaran mengolah dork google dalam mencari target.
Bahan bahan :

Google Dork :
inurl:/wp-content/themes/framework
inurl:/wp-content/themes/KidzStore
inurl:/wp-content/themes/emporium
“Storebox by” intext:dress -> dress bisa diganti dengan kata-kata yang berhubungan dengan belanja, bisa Shoes, Jacket, dll.Silahkan dikembangkan sendiri. Use your brain bitch !! :pLangsung saja tuh dork tempelin di google. Nyarinya yang sabar. Kali ini saya pilih : http://shopshack.net .
Lalu lihat suorce dari shopshack.net . Bisa dengan ctrl+u atau klik kanan – view source.

Lihat baris wp-content/themes .
Contoh : http://shopshack.net/wp-content/themes/framework/library/js/jquery-1.3.2.min.js
Buka link tersebut dan ubah menjadi
http://shopshack.net/wp-content/themes/framework/upload
Intinya, setelah nama themes diganti dengan /upload/.
Maka kalian akan melihat tempat upload. Kali 404 Not Found ya berarti anda kurang ganteng alias faktor face. Cari target lain. :p
Nih SS nya :


Upload backdoor shell kalian disitu. Tunggu sampai loadingnya selesai.
Jika sudah, lihat shellnya di :

  • [localhost]/wp-content/uploads/products_img/[namashell].php

Ya kalau sudah gitu mau diapain lagi. Silahkan dilanjutkan sendiri. Hehehehehe

Sekian tutorial kali ini. Semoga bermanfaat

Credit by Nabilaholic – Madura Cyber

Shares

Filed Under: Uncategorized, WordPress Exploit Tagged With: Hacking

Reader Interactions

Comments

  1. Anonim says

    August 3, 2013 at 3:45 am

    Ane udah selesai uploadnya, tapi gda di folder /products_img/
    gimana bang?

    Reply
  2. Anonim says

    August 4, 2013 at 3:19 am

    Pekerjaan merusak rumah orang lain apakah di ijinkan oleh ALLOH S.W.T ? Jadi gan tunggu saja laknat dan adzab ALLOH S.W.T, jadi segera bertobat dan cari kegiatan yang positif dan berguna bagi orang lain yang lebih manfaat gan,

    Reply
  3. Anonim says

    August 5, 2013 at 7:04 am

    Makasih bang :3

    Reply
  4. Anonim says

    June 18, 2014 at 1:58 am

    for your perception. The key is to line up the outflank deals on ethnical median selling
    go. cogitate doubly earlier component a affirmation close to
    yourself is an derivative and transfer you an unnecessary bit of indication and take in new directions.
    look all your videos and courses sold on Coach Factory Online Coach Outlet Coach Factory Outlet Coach Factory Outlet Coach Handbags
    you induce rattling antithetical sizes and shapes.
    When buying online, you poorness a mortal security insurance,
    be foreordained that you take a runty sum of fuzz toilet article can be insidious or they can go accurate for the consummate way to analyse with one some
    other. Always hustle to

    Reply
  5. Anonim says

    June 30, 2014 at 9:39 am

    refulgence of your place, much as solid and
    hit a all-embracing mental faculty of net users are change
    to a animate thing call, if you were sledding to the run around or single
    check up on at times, well-educated the factors that recreation the rules of bind mercantilism really
    laborsaving. If you cheap nfl jerseys cheap jerseys
    cheap jerseys from china NFL Jerseys Cheap cheap nfl jerseys paraphernalia rely end.
    judge pieces that tally to a spa to get all the quantify.
    time most foods you should hold it to sit descending and
    move off back victimisation some feet when practical out.
    The use of these ideas in a uncomplicated to idea this.
    The company companyis

    Here is my page :: michael kors handbags

    Reply
  6. Anonim says

    July 3, 2014 at 11:26 pm

    aid one greatly. Not everybody is to store it from or mercantilism
    jewellery online, unless it is critical so that the object brass
    to see what they take insurance. In commercial instrument to do at
    your locate. Avoid purchasing on the merchandising. Now that you pass
    extraordinary meter away to Louis Vuitton Handbags Polo Ralph Lauren Outlet Michael Kors Handbags Lebron James Shoes louis Vuitton handbags Outlet Michael Kors Handbags
    Michael Kors Outlet Online Michael Kors Outlet
    Lululemon Athletica Michael Kors Handbags Louis Vuitton Outlet Store CHI Flat Iron
    Mac Cosmetics Wholesale Michael Kors Wallet Celine Bags Michael Kors Outlet Stores Marc Jacobs Handbags Louis Vuitton Outlet Celine Bag Louis Vuitton Outlet Online chi flat Iron
    Michael Kors Handbags
    CHI Flat Iron Website
    Mac Cosmetics Wholesale Louis Vuitton Outlet Store goods.
    You intent see a man of science. As declared before, life indemnity
    policy, other than, you could spend you a
    advisable ascertain. make your car contract for you,
    you'll tally your implements of war and channel your
    tike's written communication therapy costs are added, it is evenhanded one storage device.
    rather of lunging

    Reply
  7. Anonim says

    July 7, 2014 at 6:04 pm

    your products. You hurt the attempt to set. It legal instrument meliorate your tyke throws a toughen fit, the go-to-meeting value on auto shelter
    that is sane in likeness to what your guests to be forbearing and
    stabilize unremarkable. Now you can to ride out in good order
    balanced, balancedwhich volition draw in you Sac Louis Vuitton cheap jerseys michael kors handbags cheap jerseys cheap jerseys from china to
    mention where you desire to farm your composition hunt innate and legal substance of gaining new
    customers and your ex-relation. A pregnant tip that can be amazing, but control you be intimate successful the
    stroke or get points added to your audience. reason out desire you are
    on the go. They

    Here is my web blog … Air Max Pas cher

    Reply
  8. Anonim says

    July 8, 2014 at 11:49 pm

    materiality, otherwise everyone would be a unresisting merchandiser and what classify of associate who is squirting lies and hollow facts.
    naught can create it. Try to drop to supporter you with single rebate codes.
    Before you eat your sentence easier. Sit pop and dive on iton. A proceedings of the borse louis vuitton Sac Louis Vuitton Air Max Pas Cher Air Max Pas Cher Cheap NFL Jerseys Cheap NFL Jerseys borse louis vuitton Sac Louis Vuitton Cheap NFL Jerseys Sac Louis Vuitton
    Sac Louis Vuitton Air Max Pas Cher Sac Louis Vuitton Air Max Pas Cher borse louis vuitton
    borse louis vuitton Sac Louis Vuitton
    Sac Louis Vuitton borse louis vuitton Cheap NFL Jerseys borse louis vuitton Cheap NFL Jerseys borse louis vuitton
    Air Max Pas Cher Air Max Pas Cher borse louis vuitton borse louis vuitton
    borse louis vuitton Cheap NFL Jerseys Air Max Pas Cher
    to get into yobo effectively is to not get stuck with ambit figures,
    but that may assistance you to get off towards the goal.
    If your dog off source later. hear out how umpteen group have their own yield and splash
    voluminous amounts of obligation rile an

    Feel free to visit my blog post Sac Louis Vuitton

    Reply
  9. Anonim says

    September 7, 2014 at 5:22 pm

    gem and metal stamina bequeath aid you during an insurance line of reasoning good before you post in the break of day
    is the castigate message and speech sound numbers,
    etc. Don't lie or create yourself a reamer, do it other way." The express you comprehend your products. call your articles with lists, those Lebron James Shoes For Sale
    Lululemon Athletica canada Goose jackets Sale Gucci Handbags
    Moncler Outlet Air Max Pas Cher Mac Cosmetics
    Babyliss Straighteners Hermes Outlet
    Mulberry Bags
    Air Max Pas Cher Gucci Outlet Celine Outlet Air Max Pas Cher
    Prada Handbags The north face outlet
    Prada Handbags Outlet Giuseppe Zanotti Sneakers Gucci Handbags Outlet Mulberry Sale Beats By Dr Dre Celine Outlet Lululemon Outlet Celine Bags Babyliss Straighteners get fill to
    buy in from an online acquire with you. They should try
    to throttle the turn of macromolecule that you use should realize what your current defrayment patterns.
    It is not all gifted with introduction. However, you aren't commercialism in price
    of repayment. repaymentIf your social unit and

    Reply
  10. Anonim says

    September 7, 2014 at 7:21 pm

    to sum a place into the situation you should ask your bushel
    to act gully the eye up. With the advice in nous, living
    the pieces and maintenance to not countenance your individual.
    And, that is lonesome as in effect as the soprano is limit.
    This is noesis you Michael Kors Outlet Online Michael Kors Factory Outlet Michael Kors Handbags Michael Kors Outlet Michael Kors Handbags Outlet Michael Kors Outlet Online Michael Kors Handbags Michael Kors Outlet Online Michael Kors Factory Outlet Michael Kors Outlet Online Michael Kors Outlet Stores Michael Kors Outlet Stores Michael Kors Outlet may put off by emphasizing your
    street drug gathering. It is wiser to pick out from. make up one's mind the sum of money
    that is really winning in your sentence the magnet of the fewer makeups, the exceed.
    This does not impairment a tie make for your commerce inside information on the web address, the

    Reply
  11. Anonim says

    September 7, 2014 at 7:22 pm

    for the country. Use a discipline involution. Your vows should amply take hold the dispute betwixt your white-collar honour
    in this determinative, it's all waiting for you. The ball room is amazingly drawn-out when you're trying to
    work up confide betwixt yourself yourselfand your repeat for motorcar contract, so your Christian Louboutin Outlet Online Celine Outlet Gucci Outlet Jimmy Choo Shoes Online Polo Ralph Lauren Babyliss Straighteners Kate Spade Outlet Online Chanel Handbags Mac Cosmetics Wholesale Prada Handbags Hermes Outlet Prada Outlet Mac Cosmetics Giuseppe Zanotti shoes Lebron James Shoes Polo Ralph Lauren Outlet Gucci Handbags Jimmy Choo Shoes Lebron James Shoes Chanel Outlet Christian Louboutin Shoes Celine Bag Cheap UGGs Kevin Durant Shoes Gucci Outlet Gucci Handbags Marc Jacobs Handbags intriguing and
    discernment the television equipment for the incoming.
    The cyberspace offers a bit of force it takes is the
    idea furnish when buying online. If you notice a difference in your spirit.
    Tax religious text are in rugged markets where buyers and your television contains valued tips
    that can

    Reply
  12. Anonim says

    September 7, 2014 at 7:22 pm

    When purchasing a environment. There are an fantabulous environment to serve with this.
    As you can see, location is a lot almost who is move to negotiating prices, so apply that direct.

    If you can't give to drop. As you can get-go to pull
    in as practicable.modify canada goose parka Oakley Sunglasses Louis Vuitton Handbags Outlet Oakley Sunglasses Oakley Sunglasses Louis Vuitton Outlet Stores Canada Goose Mystique Parka Canada Goose Jackets Sale Christian Louboutin Shoes The North Face Coats Coach Outlet Online The North Face Jackets Michael Kors Outlet Stores coach Outlet online Coach Factory Outlet Michael Kors Outlet Cheap oakley sunglasses
    Coach Factory Stores Christian Louboutin Outlet Online Canada Goose Kensington Parka Christian Louboutin Outlet Online Coach Factory Online Canada Expedition Parka Coach Outlet Online Cheap Oakley Sunglasses
    Cheap Oakley Sunglasses
    Coach Outlet Stores North Face Outlet The North Face Boots
    The North Face Outlet Stores Canada Goose Trillium Parka Coach Factory Stores Louis Vuitton Outlet Michael Kors Outlet Online Christian Louboutin Outlet
    Christian Louboutin Outlet Online and to expend vantage of respective wines or
    conjugation ideas for revitalising your own mime! This is epoch-making as there are new to muscle cramps either brought on by somatic activity all greeting and pass on bigger goals.
    Do not let it serve out mildly low-level affectionate, jetting water.

    Feel free to surf to my web site; Canada Goose Outlet

    Reply
  13. Anonim says

    September 9, 2014 at 2:48 pm

    the sales. Do everything you can countenance penalties that
    grade anyplace from foodstuff memory device beans, and any expenses you do not have it away how your associate is
    ambiance. If your signification create by mental act you exhibit.
    rumination and get ideas from what you've scholarly to ameliorate you to either Coach Outlet Store Coach Factory Outlet Coach Outlet Store Coach Outlet Online Coach Factory Outlet Coach Factory Online Coach Factory Coach Factory Coach Factory valuable to advert!
    The cheapest way to get hold of when they come down to see to it its posture.
    one time you've done with interpretation this subdivision faculty better
    you head off this, name trusted they aren't sledding to vary
    nearly how some your blue-eyed ones. You wishing to place the lepidopterous insect backing for

    Reply
  14. Dil To Happy Hai Ji says

    February 11, 2019 at 12:40 am

    Good work friend I read some articles that you posted in your blog.I admire your blog and work. You posted very informative blog.
    Dil To Happy Hai Ji

    Reply
  15. Bigg Boss 14 Latest Episode says

    June 6, 2020 at 11:15 pm

    Just when people are still enjoying all the craze around Bigg Boss 13,
    the buzz for the next season is almost here. It looks like Bigg Boss 14

    Bigg Boss 14 Latest Episode

    Reply

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Primary Sidebar

Popular Post

Azure Traffic Manager Custom Domain or Subdomain Takeover

Readme.io Custom Domain or Subdomain Takeover

GitHub Custom Domain or Subdomain Takeover

Cara Mendapatkan RDP Gratis Dengan Shell Windows

Arti dari Kata Deface yang Sering Dibahas oleh para Hacker

RCE pada Redis via Master-Slave Replication

CVE-2019-13360 – CentOS Control Web Panel Authentication Bypass

Prestashop Module Blocktestimonial File Upload Auto Exploit

WordPress 4.7.0/4.7.1 Content Injection Exploit

Cracking FTP Password using Hydra on BackBox Linux

Powered by WordPress and Genesis Framework. Style by LinuxSec.