中国网络渗透测试联盟
标题:
.用友ICC网站客服系统远程代码执行漏洞EXP
[打印本页]
作者:
admin
时间:
2012-9-13 17:51
标题:
.用友ICC网站客服系统远程代码执行漏洞EXP
<?php
6 F3 E8 F9 h% B$ A! q2 r
/**
H' |" |+ [9 y* E- I) J) _
* uploadFlash.php
7 B: a' [, ]7 I2 K+ A! Y
* Flash文件上传.
- [ S! _3 r: s+ l1 v1 U- U
*/
' x* U4 ?5 M6 E- k
require_once('../global.inc.php');
/ x, t6 k: k9 h" _1 x
5 @: F# {! v2 d: ]+ L, I# L
//operateId=1 上传,operateId=2 获取地址.
& i& Q/ d) q; n. O* n% m( ^ K1 q
$operateId = intval($_REQUEST['operateId']);
9 q2 A7 H) W T0 V- m# m; |: W* g
if(empty($operateId)) exit;
9 }! x- c" F, [7 @' l
! ~8 ]. K# V/ \: \5 v }
if($operateId == 1){
7 b. r* o8 d' l9 v6 P
$date = date("Ymd");
4 d2 X( a0 t0 @: p' n
$dest = $CONFIG->basePath."data/files/".$date."/";
: t$ u: R# L6 i' B" b- p
$COMMON->createDir($dest);
4 v, ]+ g3 y) Y4 V+ H
//if (!is_dir($dest)) mkdir($dest, 0777);
k1 m" Q; q2 ~; T+ O2 Z& L0 J" t6 a
( [5 k, } T7 Z
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
( ?; Q$ T5 H4 R
7 R, f# A' Z7 e6 K
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
0 f6 F5 v. \2 o6 \* O0 C. Q
/ M7 E1 d s; G" Y. m. y: z6 v
if(!in_array($nameExt, $allowedType)){
& b- G% k% n! J. i6 [+ O( @
$msg = 0;
& i' {3 H& |4 s+ S) a2 n
}
- K( A* J( W/ o/ u- C p
if(empty($msg)){
5 X* p0 C. u2 w4 ]* V' T; D
$filename = getmicrotime().'.'.$nameExt;
/ y8 R' M' q0 O1 M( @ m, K
$file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
: j. c: O+ c, ]$ {, I7 N2 h2 j
: s( P6 r, b3 S- Q
$filename = $dest.$filename;
/ A5 l, M) o5 M# i( H7 I" x) F. U% b
if(empty($_FILES['Filedata']['error'])){
! }0 x2 \1 k: a% R3 i. w, V
move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
" z( W6 e8 x3 C/ J& B. s1 H
}
/ O: J$ X# U( K0 ]. n
8 Q2 X. z/ X: D- M p9 J5 {. z% r
if (file_exists($filename)){
4 l8 }, i; A, I+ Z. w0 M) w
//$msg = 1;
! o- E/ B5 z6 [7 n
$msg = $file_url;
: V, \2 T2 [% w3 d
@chmod($filename, 0444);
, _4 d3 A0 x6 k0 ?- I: r) ?5 R1 F }
}else{
& ^ r/ P" b; l" J: G( R( U
$msg = 0;
) q: k$ t; F! }5 A% P: ]2 H. }) U
}
) ~+ `+ g; N) g, E
}
3 `4 ]& k5 ?9 q& f6 P! ~
$outMsg = "fileUrl=".$msg;
1 {: T0 z, r% S$ w- U* P
$_SESSION["eoutmsg"] = $outMsg;
& ]' U/ @0 x9 |! Z3 B% p8 b. h5 J
exit;
6 t1 ?6 A, R$ c$ A$ n/ e% n
}else if($operateId == 2){
" k1 D/ T9 r) B% y5 P
$outMsg = $_SESSION["eoutmsg"];
/ Q: \1 T' N- ]' @) E ?4 S# W
if(!empty($outMsg)){
8 w( ]. u) |: }$ g: q8 Z
session_unregister("eoutmsg");
* v$ O( E" N7 C+ p* Z& f' L) L8 R
echo '&'.$outMsg;
0 T! v& e' E2 Y& G
exit;
- L( C1 F7 Z; s4 r
}else{
0 ]( S; b! U9 T
echo "&fileUrl=0";
: U5 G+ u4 F$ m. m% E( o! {
exit;
+ `1 @, X. ?. S+ v: _$ ~- Y
}
+ t4 R1 p9 C, P3 V# _$ B
}
5 ^+ K/ Z& l8 k. u1 D Y8 D
% R" M2 G& v0 y& k5 K8 I
function getmicrotime(){
! A- z5 y* G7 [' P0 |
list($usec, $sec) = explode(" ",microtime());
* h! Z) G, W9 m$ w; N2 V& J
return ((float)$usec + (float)$sec);
/ M& _- w5 d4 x- {
}
4 d" Q+ c. ?# ]; z
& d9 t0 ?; d1 Y" m9 o
?>
+ H! b- X0 \" O* u5 ~, ?7 D; A( V
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2