Waraxe IT Security Portal
Login or Register
July 14, 2024
Menu
Home
Logout
Discussions
Forums
Members List
IRC chat
Tools
Base64 coder
MD5 hash
CRC32 checksum
ROT13 coder
SHA-1 hash
URL-decoder
Sql Char Encoder
Affiliates
y3dips ITsec
Md5 Cracker
User Manuals
AlbumNow
Content
Content
Sections
FAQ
Top
Info
Feedback
Recommend Us
Search
Journal
Your Account
User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144

People Online:
Visitors: 70
Members: 0
Total: 70
Full disclosure
CVE-2024-33326
CVE-2024-33327
CVE-2024-33328
CVE-2024-33329
CyberDanube Security Research 20240703-0 | Authenticated Command Injection in Helmholz Industrial Router REX100
SEC Consult SA-20240627-0 :: Local Privilege Escalation via MSI installer in SoftMaker Office / FreeOffice
SEC Consult SA-20240626-0 :: Multiple Vulnerabilities in Siemens Power Automation Products
Novel DoS Vulnerability Affecting WebRTC Media Servers
APPLE-SA-06-25-2024-1 AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8
40 vulnerabilities in Toshiba Multi-Function Printers
17 vulnerabilities in Sharp Multi-Function Printers
SEC Consult SA-20240624-0 :: Multiple Vulnerabilities allowing complete bypass in Faronics WINSelect (Standard + Enterprise)
SEC Consult SA-20240620-0 :: Arbitrary File Upload in edu-sharing (metaVentis GmbH)
Zip Slip meets Artifactory: A Bug Bounty Story
Backdoor.Win32.Plugx / Insecure Permissions
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> General discussion -> upload a PHP file
Post new topicReply to topic View previous topic :: View next topic
upload a PHP file
PostPosted: Mon Oct 19, 2009 12:11 am Reply with quote
crazynou
Advanced user
Advanced user
Joined: Feb 08, 2009
Posts: 199
Location: AlGeRiA




i found this script in VICTIM target and i whant to upload a PHP file with it but i have a Error!!!

Code:
<?php
session_start();

require('config.php');
require_once('include/functions.php');
require_once('include/user_functions.php');
require_once('include/islogged.php');

// define meta tags & common variables
$meta_title = sprintf($lang['upload_avatar'], $userdata['name']);
$meta_description = '';
// end
function resize_then_crop( $filein,$fileout,
$imagethumbsize_w,$imagethumbsize_h,$red,$green,$blue)
{

// Get new dimensions
list($width, $height) = getimagesize($filein);
$new_width = $width * $percent;
$new_height = $height * $percent;

if(preg_match("/.jpg/i", "$filein"))
{
$format = 'image/jpeg';
}
if (preg_match("/.gif/i", "$filein"))
{
$format = 'image/gif';
}
if(preg_match("/.png/i", "$filein"))
{
$format = 'image/png';
}

switch($format)
{
case 'image/jpeg':
$image = imagecreatefromjpeg($filein);
break;
case 'image/gif';
$image = imagecreatefromgif($filein);
break;
case 'image/png':
$image = imagecreatefrompng($filein);
break;
}

$width = $imagethumbsize_w ;
$height = $imagethumbsize_h ;
list($width_orig, $height_orig) = getimagesize($filein);

if ($width_orig < $height_orig) {
$height = ($imagethumbsize_w / $width_orig) * $height_orig;
} else {
$width = ($imagethumbsize_h / $height_orig) * $width_orig;
}

if ($width < $imagethumbsize_w)
//if the width is smaller than supplied thumbnail size
{
$width = $imagethumbsize_w;
$height = ($imagethumbsize_w/ $width_orig) * $height_orig;;
}

if ($height < $imagethumbsize_h)
//if the height is smaller than supplied thumbnail size
{
$height = $imagethumbsize_h;
$width = ($imagethumbsize_h / $height_orig) * $width_orig;
}

$thumb = imagecreatetruecolor($width , $height);
$bgcolor = imagecolorallocate($thumb, $red, $green, $blue);
ImageFilledRectangle($thumb, 0, 0, $width, $height, $bgcolor);
imagealphablending($thumb, true);

imagecopyresampled($thumb, $image, 0, 0, 0, 0,
$width, $height, $width_orig, $height_orig);
$thumb2 = imagecreatetruecolor($imagethumbsize_w , $imagethumbsize_h);
// true color for best quality
$bgcolor = imagecolorallocate($thumb2, $red, $green, $blue);
ImageFilledRectangle($thumb2, 0, 0,
$imagethumbsize_w , $imagethumbsize_h , $white);
imagealphablending($thumb2, true);

$w1 =($width/2) - ($imagethumbsize_w/2);
$h1 = ($height/2) - ($imagethumbsize_h/2);

imagecopyresampled($thumb2, $thumb, 0,0, $w1, $h1,
$imagethumbsize_w , $imagethumbsize_h ,$imagethumbsize_w, $imagethumbsize_h);

if ($fileout !="")imagegif($thumb2, $fileout); //write to file

}
if(!empty($logged_in) && ($logged_in == '1')) {

$query = mysql_query("SELECT * FROM pm_users where username = '".$userdata['username']."'");
$rows = mysql_num_rows($query);
$r = mysql_fetch_array($query);
$avatar = _URL."/"._UPFOLDER."/avatars/".$r['avatar'];

$tdir = _UPFOLDER."/avatars/"; // Path To Thumbnails Directory
$imagethumbsize_w = 80; // thumbnail size (area cropped in middle of image)
$imagethumbsize_h = 80; // thumbnail size (area cropped in middle of image)

if (!isset($_POST['submit'])) { // Image Upload Form Below
$top_videos = top_videos('', _TOPVIDS);
$smarty->assign('top_videos', $top_videos);

$smarty->assign('avatar', $avatar);
$smarty->assign('username', $username);
// --- DEFAULT SYSTEM FILES - DO NOT REMOVE --- //
$smarty->assign('meta_title', $meta_title);
$smarty->assign('meta_description', $meta_description);
$smarty->assign('template_dir', $template_f);
$smarty->display('upload_avatar.tpl');

} else if (isset($_POST['submit'])) { // Uploading/Resizing Script

$url = $_FILES['imagefile']['name']; // Set $url To Equal The Filename For Later Use
if ($_FILES['imagefile']['type'] == "image/png" || $_FILES['imagefile']['type'] == "image/gif" || $_FILES['imagefile']['type'] == "image/jpg" || $_FILES['imagefile']['type'] == "image/jpeg" || $_FILES['imagefile']['type'] == "image/pjpeg") {
$file_ext = strrchr($_FILES['imagefile']['name'], '.'); // Get The File Extention In The Format Of , For Instance, .jpg, .gif or .php
$rand_string = rand(343, 1000);
$new_name = $rand_string."-".$_FILES['imagefile']['name'];
$copy = copy($_FILES['imagefile']['tmp_name'], "$tdir" . $new_name); // Move Image From Temporary Location To Permanent Location
if ($copy) { // If The Script Was Able To Copy The Image To It's Permanent Location
resize_then_crop( "$tdir" . $new_name, $tdir."avatar".$rand_string."-".$userdata['id']."".$file_ext,$imagethumbsize_w,$imagethumbsize_h,"255","255","255");
$ttemp = "$tdir" . $new_name;
@unlink($ttemp); // delete temp image

if($r['avatar'] != 'no_avatar.gif') { // delete old avatar BUT not the default avatar
$old_avatar = "$tdir".$r['avatar'];
@unlink($old_avatar);
}

$err = $lang['ua_msg3']; // Resize successful
$output_img = "avatar".$rand_string."-".$userdata['id']."".$file_ext;
mysql_query("UPDATE pm_users SET avatar = '".$output_img."' WHERE username = '".$userdata['username']."'");
} else {
$err = $lang['ua_msg4']; // Error Message If Upload Failed
}
} else {
$err = $lang['ua_msg5']; // Error Message If Filetype Is Wrong

}
$top_videos = top_videos('', _TOPVIDS);
$smarty->assign('top_videos', $top_videos);
$smarty->assign('err_msg', $err);
$smarty->assign('avatar', $avatar);
$smarty->assign('username', $username);
// --- DEFAULT SYSTEM FILES - DO NOT REMOVE --- //
$smarty->assign('meta_title', $meta_title);
$smarty->assign('meta_description', $meta_description);
$smarty->assign('template_dir', $template_f);
$smarty->display('upload_avatar.tpl');
}
exit;
}
?>
View user's profile Send private message
PostPosted: Mon Oct 19, 2009 7:01 am Reply with quote
pexli
Valuable expert
Valuable expert
Joined: May 24, 2007
Posts: 665
Location: Bulgaria




With this script you may upload only images.
View user's profile Send private message
PostPosted: Fri Mar 19, 2010 11:25 pm Reply with quote
EluneZ
Regular user
Regular user
Joined: Mar 16, 2010
Posts: 14
Location: Bulgaria




pexli wrote:
With this script you may upload only images.
Yes.
Stop reading there:
$url = $_FILES['imagefile']['name']; // Set $url To Equal The Filename For Later Use
if ($_FILES['imagefile']['type'] == "image/png" || $_FILES['imagefile']['type'] == "image/gif" || $_FILES['imagefile']['type'] == "image/jpg" || $_FILES['imagefile']['type'] == "image/jpeg" || $_FILES['imagefile']['type'] == "image/pjpeg") {

_________________
http://www.arthackers.net - Web Security Portal!
View user's profile Send private message Visit poster's website MSN Messenger
upload a PHP file
www.waraxe.us Forum Index -> General discussion
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT
Page 1 of 1

Post new topicReply to topic


Powered by phpBB 2001-2008 phpBB Group



Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.124 Seconds