[The Alchemist]

Hello Hack Community.

Through this tutorial, I'm going to teach you how to upload your deface page or maybe even shells on remote servers of websites.

The dork for finding vulnerable websites is : inurl:"/imce?dir=" intitle:"File Browser"

The vulnerable url will be something like this : http://site.com/imce?dir=

Once you open up the URL, it should look like this :


Now, on the left panel, click on the blue folder.
The blue folder is the root and clicking on it, takes you to the root directory. If it says Access Denied, go to another site.

Now, click on the upload button as shown in the screenshot.
Select your deface page in HTML format or shell in PHP format and click on Upload.

After your file is uploaded, it should look like this :


The file you've uploaded will be selected automatically.
To view your deface page, double click on the selected file.
Here's mine :

Spoiler:

And you're done!!! Your deface page or shell got uploaded and executed.:whistle:

Remember, our forum is an ethical hacking forum. Do not abuse, threaten or blackmail the owner of the website through your deface page or shell.
Try as far as possible to keep it ethical.
This tutorial is for educational purposes only. Please do not harm anybody and avoid getting into trouble.

Please do not forget to give feedback.

[noize]

As easy as that? IMCE should seek some new coders.

[The Alchemist]

As easy as that? IMCE should seek some new coders.

Yup its as easy as that. Even now, you'll find lots of vulnerable websites to hack(for practise)!!!!

[Ex094]

IMCE Is a Drupal module right? I've used it on my site previously and I heard many security Issues about it. Nice exploitation mate

[The Alchemist]

IMCE Is a Drupal module right? I've used it on my site previously and I heard many security Issues about it. Nice exploitation mate

Yes, IMCE is a drupal module. They've patched the vulnerability but yet, there are so many sites vulnerable....

[noize]

I've just had a look yesterday and there are actually not. I spent pretty much time trying to edit the POST data with Tamper and no way to either get access to the root directory (not the one in the upload manager, 'cause files are actually saved in a subdirectory) or to upload shells or whatever. If you upload a PHP, ASP or whatever file it gets renamed to *.txt.

[The Alchemist]

I've just had a look yesterday and there are actually not. I spent pretty much time trying to edit the POST data with Tamper and no way to either get access to the root directory (not the one in the upload manager, 'cause files are actually saved in a subdirectory) or to upload shells or whatever. If you upload a PHP, ASP or whatever file it gets renamed to *.txt.

You may not be able to upload stuff in the root directory, but you can, in the sub directories. You may put HTML files there with annoying content.
Its actually good to see the vulnerability getting patched.

[noize]

I've just had a look yesterday and there are actually not. I spent pretty much time trying to edit the POST data with Tamper and no way to either get access to the root directory (not the one in the upload manager, 'cause files are actually saved in a subdirectory) or to upload shells or whatever. If you upload a PHP, ASP or whatever file it gets renamed to *.txt.

You may not be able to upload stuff in the root directory, but you can, in the sub directories. You may put HTML files there with annoying content.
Its actually good to see the vulnerability getting patched.

Yes, you can, but what's the point in it? I've actually seen some skids saying "Look at this defacement!" and giving a URL like www.example.com/images/files/upload/woioafjoeijsiof/defaced.html . Defacing is the act of replacing, redirecting or editing some content of the website (though it should be mostly the index page, I'd say that e.g. Anti-sec's attack to Imageshack was a kind of defacement).

[The Alchemist]

Spoiler:

I've just had a look yesterday and there are actually not. I spent pretty much time trying to edit the POST data with Tamper and no way to either get access to the root directory (not the one in the upload manager, 'cause files are actually saved in a subdirectory) or to upload shells or whatever. If you upload a PHP, ASP or whatever file it gets renamed to *.txt.

You may not be able to upload stuff in the root directory, but you can, in the sub directories. You may put HTML files there with annoying content.
Its actually good to see the vulnerability getting patched.

Yes, you can, but what's the point in it? I've actually seen some skids saying "Look at this defacement!" and giving a URL like www.example.com/images/files/upload/woioafjoeijsiof/defaced.html . Defacing is the act of replacing, redirecting or editing some content of the website (though it should be mostly the index page, I'd say that e.g. Anti-sec's attack to Imageshack was a kind of defacement).

Just ignore skids... You know you're not one of them...

[noize]

Just ignore skids... You know you're not one of them...

Was just saying this might be exploitable, but it's not so vulnerable (I couldn't exploit it).