<style>/*<link href='https://www.blogger.com/dyn-css/authorization.css?targetBlogID=4645632544988684701&zx=389dad53-ad45-47a7-9acd-963a6bf69f6e' media='none' onload='if(media!='all')media='all'' rel='stylesheet'/><noscript><link href='https://www.blogger.com/dyn-css/authorization.css?targetBlogID=4645632544988684701&zx=389dad53-ad45-47a7-9acd-963a6bf69f6e' rel='stylesheet'/></noscript>
<meta name='google-adsense-platform-account' content='ca-host-pub-1556223355139109'/>
<meta name='google-adsense-platform-domain' content='blogspot.com'/>

<script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-3823271028074031&host=ca-host-pub-1556223355139109" crossorigin="anonymous"></script>

<!-- data-ad-client=ca-pub-3823271028074031 -->

</head><body>*/</style>

Deface POC Slims7 phpThumb Command Injection.

apiip

21 Jan, 2022

mazapip.blogspot.com - Hallo
Kembali lagi di Maz Apip - Blog, Oke pada artikel kali ini gue ingin memberikan sebuah Tutorial Deface lagi yaitu Deface POC Slims7 phpThumb Command Injection.

Artikel ini dibuat karena banyaknya Defacer yang Show Off menggunakan POC ini, Jadi gue penasaran dengan POC yang dulu pernah booming beberapa tahun lalu ini.

Oke langsung aja ke tutorialnya Tanpa berlama-lama lagi, hehe.

Mencari Target

kek biasanya ya,Tahap awal untuk melakukan Deface ini harus mencari target terlebih dahulu. Kalian bisa menggunakan Google dork dibawah ini untuk mencarinya.

DORK:

intext:"Powered By Slims"

Note : Dikembangin lagi dorknya, biar dapat banyak website yang fresh

Dan untuk Exploitnya adalah sebagai berikut.

EXPLOIT:

Pastebin

Note : [COMMAND] Di isi perintah seperti di dalam terminal seperti dir, ls dan lain-lain.

Ciri-Ciri Target Vuln

Versi phpThumb yang vuln adalah v1.7xxx, gue kurang tau versi yang diatas itu vuln atau enggak (Tapi coba aja dulu ya kan), Untuk ciri-ciri vuln nya adalah command yang kita masukkan berhasil ter-eksekusi.

Pada saat Admin memasukkan command ls;echo https://blog.eviltwin.id, Command tersebut berhasil ter-eksekusi dan outputnya bisa dilihat gambar diatas.

Upload Shell

Jika sudah mendapatkan target yang vuln maka selanjutnya tinggal mengupload shell backdoornya saja, Command untuk mengupload shellnya adalah sebagai berikut:

Pastebin

Simpel nya sih command seperti ls atau yg lain di ganti menjadi lwp-download linkshell atau bisa juga menggunakan wget, curl (Tapi tadi pas gue coba pake wget eh malah 406 Not acceptable)

Setelah gud masukkan command untuk melihat list file dan dir, Ada file shell.php yang tadi kita Download menggunakan command diatas, Itu artinya berhasil. Tinggal akses aja deh shellnya.

Shell berhasil di akses. Sekarang bebas deh mau ngapain aja, asal Permissionnya Writable(Green Dir)

Akhir Kata

Oke mungkin cukup sampai disini aja artikel tentang Deface POC Slims7 phpThumb Command Injection

Mohon maaf bila ada kesalahan kata dan sebagainya, Mohon dimaklumi karena gue juga masih dalam tahap belajar.

Semoga bermanfaat dan Sampai jumpa di Artikel selanjutnya!

<style>/*
<script type="text/javascript" src="https://www.blogger.com/static/v1/widgets/4290687098-widgets.js"></script>
<script type='text/javascript'>
window['__wavt'] = 'AOuZoY5H38V3vfzoB6fncGhVQOWRNNEMXg:1715205735132';_WidgetManager._Init('//www.blogger.com/rearrange?blogID\x3d4645632544988684701','//mazapip.blogspot.com/2022/01/deface-poc-.html','4645632544988684701');
_WidgetManager._SetDataContext([{'name': 'blog', 'data': {'blogId': '4645632544988684701', 'title': 'membahas hal-hal yang menarik dan hanya sekedar info. ', 'url': 'https://mazapip.blogspot.com/2022/01/deface-poc-.html', 'canonicalUrl': 'https://mazapip.blogspot.com/2022/01/deface-poc-.html', 'homepageUrl': 'https://mazapip.blogspot.com/', 'searchUrl': 'https://mazapip.blogspot.com/search', 'canonicalHomepageUrl': 'https://mazapip.blogspot.com/', 'blogspotFaviconUrl': 'https://mazapip.blogspot.com/favicon.ico', 'bloggerUrl': 'https://www.blogger.com', 'hasCustomDomain': false, 'httpsEnabled': true, 'enabledCommentProfileImages': true, 'gPlusViewType': 'FILTERED_POSTMOD', 'adultContent': false, 'analyticsAccountNumber': 'UA-216045933-1', 'encoding': 'UTF-8', 'locale': 'en', 'localeUnderscoreDelimited': 'en', 'languageDirection': 'ltr', 'isPrivate': false, 'isMobile': false, 'isMobileRequest': false, 'mobileClass': '', 'isPrivateBlog': false, 'isDynamicViewsAvailable': true, 'feedLinks': '\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22membahas hal-hal yang menarik dan hanya sekedar info.  - Atom\x22 href\x3d\x22https://mazapip.blogspot.com/feeds/posts/default\x22 /\x3e\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/rss+xml\x22 title\x3d\x22membahas hal-hal yang menarik dan hanya sekedar info.  - RSS\x22 href\x3d\x22https://mazapip.blogspot.com/feeds/posts/default?alt\x3drss\x22 /\x3e\n\x3clink rel\x3d\x22service.post\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22membahas hal-hal yang menarik dan hanya sekedar info.  - Atom\x22 href\x3d\x22https://www.blogger.com/feeds/4645632544988684701/posts/default\x22 /\x3e\n\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22membahas hal-hal yang menarik dan hanya sekedar info.  - Atom\x22 href\x3d\x22https://mazapip.blogspot.com/feeds/7716933048411608079/comments/default\x22 /\x3e\n', 'meTag': '', 'adsenseClientId': 'ca-pub-3823271028074031', 'adsenseHostId': 'ca-host-pub-1556223355139109', 'adsenseHasAds': true, 'adsenseAutoAds': true, 'boqCommentIframeForm': true, 'loginRedirectParam': '', 'view': '', 'dynamicViewsCommentsSrc': '//www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js', 'dynamicViewsScriptSrc': '//www.blogblog.com/dynamicviews/a26ecadc30bb77e6', 'plusOneApiSrc': 'https://apis.google.com/js/platform.js', 'disableGComments': true, 'interstitialAccepted': false, 'sharing': {'platforms': [{'name': 'Get link', 'key': 'link', 'shareMessage': 'Get link', 'target': ''}, {'name': 'Facebook', 'key': 'facebook', 'shareMessage': 'Share to Facebook', 'target': 'facebook'}, {'name': 'BlogThis!', 'key': 'blogThis', 'shareMessage': 'BlogThis!', 'target': 'blog'}, {'name': 'Twitter', 'key': 'twitter', 'shareMessage': 'Share to Twitter', 'target': 'twitter'}, {'name': 'Pinterest', 'key': 'pinterest', 'shareMessage': 'Share to Pinterest', 'target': 'pinterest'}, {'name': 'Email', 'key': 'email', 'shareMessage': 'Email', 'target': 'email'}], 'disableGooglePlus': true, 'googlePlusShareButtonWidth': 0, 'googlePlusBootstrap': '\x3cscript type\x3d\x22text/javascript\x22\x3ewindow.___gcfg \x3d {\x27lang\x27: \x27en\x27};\x3c/script\x3e'}, 'hasCustomJumpLinkMessage': false, 'jumpLinkMessage': 'Read more', 'pageType': 'item', 'postId': '7716933048411608079', 'postImageThumbnailUrl': 'https://blogger.googleusercontent.com/img/a/AVvXsEjXXTjtgRnEBk_jp4B5CJeWwEus-z0K0NZ4XAOEKCTEH71crui2TCfaUdLDh_U0BcG0OizSXNy6c935BmA6G5o-mNQ7VJ49CU-vzzDoQaTppEMjgLLIQqfm1qnbf5fRlI4_DVyQretG9jcS3D0IWutGQm1WysxaZ9AX1KsXRE-s8Bven2cf1VRSkGoPAA\x3ds72-c', 'postImageUrl': 'https://blogger.googleusercontent.com/img/a/AVvXsEjXXTjtgRnEBk_jp4B5CJeWwEus-z0K0NZ4XAOEKCTEH71crui2TCfaUdLDh_U0BcG0OizSXNy6c935BmA6G5o-mNQ7VJ49CU-vzzDoQaTppEMjgLLIQqfm1qnbf5fRlI4_DVyQretG9jcS3D0IWutGQm1WysxaZ9AX1KsXRE-s8Bven2cf1VRSkGoPAA', 'pageName': 'Deface POC Slims7 phpThumb Command Injection.', 'pageTitle': 'membahas hal-hal yang menarik dan hanya sekedar info. : Deface POC Slims7 phpThumb Command Injection.', 'metaDescription': ''}}, {'name': 'features', 'data': {}}, {'name': 'messages', 'data': {'edit': 'Edit', 'linkCopiedToClipboard': 'Link copied to clipboard!', 'ok': 'Ok', 'postLink': 'Post Link'}}, {'name': 'template', 'data': {'name': 'custom', 'localizedName': 'Custom', 'isResponsive': true, 'isAlternateRendering': false, 'isCustom': true}}, {'name': 'view', 'data': {'classic': {'name': 'classic', 'url': '?view\x3dclassic'}, 'flipcard': {'name': 'flipcard', 'url': '?view\x3dflipcard'}, 'magazine': {'name': 'magazine', 'url': '?view\x3dmagazine'}, 'mosaic': {'name': 'mosaic', 'url': '?view\x3dmosaic'}, 'sidebar': {'name': 'sidebar', 'url': '?view\x3dsidebar'}, 'snapshot': {'name': 'snapshot', 'url': '?view\x3dsnapshot'}, 'timeslide': {'name': 'timeslide', 'url': '?view\x3dtimeslide'}, 'isMobile': false, 'title': 'Deface POC Slims7 phpThumb Command Injection.', 'description': 'Tutorial Deface Dan Upload Shell\nMaz Apip', 'featuredImage': 'https://blogger.googleusercontent.com/img/a/AVvXsEjXXTjtgRnEBk_jp4B5CJeWwEus-z0K0NZ4XAOEKCTEH71crui2TCfaUdLDh_U0BcG0OizSXNy6c935BmA6G5o-mNQ7VJ49CU-vzzDoQaTppEMjgLLIQqfm1qnbf5fRlI4_DVyQretG9jcS3D0IWutGQm1WysxaZ9AX1KsXRE-s8Bven2cf1VRSkGoPAA', 'url': 'https://mazapip.blogspot.com/2022/01/deface-poc-.html', 'type': 'item', 'isSingleItem': true, 'isMultipleItems': false, 'isError': false, 'isPage': false, 'isPost': true, 'isHomepage': false, 'isArchive': false, 'isLabelSearch': false, 'postId': 7716933048411608079}}, {'name': 'widgets', 'data': [{'title': 'Menu', 'type': 'LinkList', 'sectionId': 'upload-image', 'id': 'LinkList155'}, {'title': 'membahas hal-hal yang menarik dan hanya sekedar info.  (Header)', 'type': 'Header', 'sectionId': 'upload-image', 'id': 'Header1'}, {'title': 'Main Tags', 'type': 'Label', 'sectionId': 'upload-image', 'id': 'Label2'}, {'title': '', 'type': 'LinkList', 'sectionId': 'upload-image', 'id': 'LinkList152'}, {'title': 'Link List', 'type': 'LinkList', 'sectionId': 'upload-image', 'id': 'LinkList153'}, {'title': 'Popular Posts', 'type': 'PopularPosts', 'sectionId': 'upload-image', 'id': 'PopularPosts1', 'posts': [{'title': 'cara deface poc ojs', 'id': 6149305758175368731}, {'title': 'cara deface poc Alfa perl rce', 'id': 665367589033489567}, {'title': 'Cara Deface WordPress Default', 'id': 5412312465927835321}]}, {'title': 'Contact Form', 'type': 'ContactForm', 'sectionId': 'upload-image', 'id': 'ContactForm1'}, {'title': '#Advertisement', 'type': 'HTML', 'sectionId': 'before-blog', 'id': 'HTML11'}, {'title': 'Blog Posts', 'type': 'Blog', 'sectionId': 'blog-post', 'id': 'Blog1', 'posts': [{'id': '7716933048411608079', 'title': 'Deface POC Slims7 phpThumb Command Injection.', 'featuredImage': 'https://blogger.googleusercontent.com/img/a/AVvXsEjXXTjtgRnEBk_jp4B5CJeWwEus-z0K0NZ4XAOEKCTEH71crui2TCfaUdLDh_U0BcG0OizSXNy6c935BmA6G5o-mNQ7VJ49CU-vzzDoQaTppEMjgLLIQqfm1qnbf5fRlI4_DVyQretG9jcS3D0IWutGQm1WysxaZ9AX1KsXRE-s8Bven2cf1VRSkGoPAA', 'showInlineAds': false}], 'headerByline': {'regionName': 'header1', 'items': [{'name': 'share', 'label': ''}, {'name': 'author', 'label': 'by'}, {'name': 'timestamp', 'label': 'd MMM, yyyy'}]}, 'footerBylines': [{'regionName': 'footer2', 'items': [{'name': 'labels', 'label': ''}]}], 'allBylineItems': [{'name': 'share', 'label': ''}, {'name': 'author', 'label': 'by'}, {'name': 'timestamp', 'label': 'd MMM, yyyy'}, {'name': 'labels', 'label': ''}]}, {'title': '#Advertisement', 'type': 'HTML', 'sectionId': 'ads-post', 'id': 'HTML13'}, {'title': '#You may also like', 'type': 'HTML', 'sectionId': 'ads-post', 'id': 'HTML15'}, {'title': 'SVG Icons', 'type': 'HTML', 'sectionId': 'Blogspot-options', 'id': 'HTML24'}]}]);
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList155', 'upload-image', document.getElementById('LinkList155'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HeaderView', new _WidgetInfo('Header1', 'upload-image', document.getElementById('Header1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LabelView', new _WidgetInfo('Label2', 'upload-image', document.getElementById('Label2'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList152', 'upload-image', document.getElementById('LinkList152'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList153', 'upload-image', document.getElementById('LinkList153'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_PopularPostsView', new _WidgetInfo('PopularPosts1', 'upload-image', document.getElementById('PopularPosts1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_ContactFormView', new _WidgetInfo('ContactForm1', 'upload-image', document.getElementById('ContactForm1'), {'contactFormMessageSendingMsg': 'Sending...', 'contactFormMessageSentMsg': 'Your message has been sent.', 'contactFormMessageNotSentMsg': 'Message could not be sent. Please try again later.', 'contactFormInvalidEmailMsg': 'A valid email address is required.', 'contactFormEmptyMessageMsg': 'Message field cannot be empty.', 'title': 'Contact Form', 'blogId': '4645632544988684701', 'contactFormNameMsg': 'Name', 'contactFormEmailMsg': 'Email', 'contactFormMessageMsg': 'Message', 'contactFormSendMsg': 'Send', 'contactFormToken': 'AOuZoY6UaKaPlUQumkomfTNLdbNjPubyRw:1715205735132', 'submitUrl': 'https://www.blogger.com/contact-form.do'}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML11', 'before-blog', document.getElementById('HTML11'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_BlogView', new _WidgetInfo('Blog1', 'blog-post', document.getElementById('Blog1'), {'cmtInteractionsEnabled': false, 'lightboxEnabled': true, 'lightboxModuleUrl': 'https://www.blogger.com/static/v1/jsbin/1666805145-lbx.js', 'lightboxCssUrl': 'https://www.blogger.com/static/v1/v-css/13464135-lightbox_bundle.css'}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML13', 'ads-post', document.getElementById('HTML13'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML15', 'ads-post', document.getElementById('HTML15'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML24', 'Blogspot-options', document.getElementById('HTML24'), {}, 'displayModeFull'));
</script>
</body>*/</style>