exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Unified Layer Shell Upload

Unified Layer Shell Upload
Posted Sep 24, 2015
Authored by UmPire

Due to a server misconfiguration, customers of Unified Layer suffer from a remote shell upload vulnerability.

tags | exploit, remote, shell, file upload
SHA-256 | 38bbe1895961c77f3c46b4f57c4870d647343451c3a8616690b2f3361d104493

Unified Layer Shell Upload

Change Mirror Download
/------ Unified-Layer Unrestricted File Upload Exploit
/------ Author: UmPire / ranrep0ker@yahoo.com
/------ Iran Security Group / iransec.net

Hi guys,

With this exploit, You can upload files with any extensions you want in sites that
are hosted on unified layer and its children like bluehost, hostmonster, justhost, ...
and also these sites themselves

You know that there are many many sites out there on unified-layer and there are a huge
amount of choice for you to hack by this.

It's not important how you find target. It can be a plugin, finding by dorks and etc.

Let's visit a site and look how we do it...
Remember that it relates mostly on its existence on unified-layer, not the uploader script.


Demo Video: http://www.youtube.com/watch?v=tY4vJtTuQbQ


---=== POC ===---
In any site from unified layer

First, you should find an uploader
   It usually exists in contact forms or galleries. You can find more uploaders by searching an specific wordpress, joomla,... plugins.
The amazing part is that it works also on WHMCS. But it's your duty to find the renamed file.

Second, rename the file and add dots at the end before extension:
   example.php......jpg
 
   simple but nice

Third, it will be uploaded with ease.


---=== Notes ===---
As you perhaps know, it was a paid exploit at first. I decided to publish it for free because of anniversary of the "Sacred Defense Week" of Iran. https://en.wikipedia.org/wiki/Sacred_Defence_Week
It's better for bad guys not killing ppl in Gaza. The land will remain Palestine forever.
At last, It's really good to be good. (g2g)
Bye.
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close