中国网络渗透测试联盟
标题:
.用友ICC网站客服系统远程代码执行漏洞EXP
[打印本页]
作者:
admin
时间:
2012-9-13 17:51
标题:
.用友ICC网站客服系统远程代码执行漏洞EXP
<?php
$ g1 d' ~$ {: K! y h# ~# N1 {
/**
% E: ]/ w/ d3 A. v/ q2 O+ h: r/ [
* uploadFlash.php
4 i+ B L" o W( d/ P
* Flash文件上传.
) X ?- U0 _9 D, n5 R5 v8 n
*/
' i$ @ z* r# P# [* I) X. c
require_once('../global.inc.php');
: y; [6 z8 b/ b2 C7 W) `
7 `% R$ F5 y% i3 V {) ~/ ~
//operateId=1 上传,operateId=2 获取地址.
: a/ g7 w/ L, f& c
$operateId = intval($_REQUEST['operateId']);
1 ]: ^5 k0 x" _+ _$ v
if(empty($operateId)) exit;
/ S O3 ~; N; K& C( F
( G' }5 Z# D* J3 V# T) H. F
if($operateId == 1){
6 K' R9 Q! r7 ?1 m2 w/ g
$date = date("Ymd");
6 g) s& [, D4 X& U" @
$dest = $CONFIG->basePath."data/files/".$date."/";
) T$ P; z3 n3 s) h/ Y3 K" J0 ?
$COMMON->createDir($dest);
0 z+ `' {" P0 V1 g o# Q0 A
//if (!is_dir($dest)) mkdir($dest, 0777);
% ]; Q* j% [* a' \
8 C3 I, G0 ^3 d1 R: X
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
/ h) ?) Z. H& B$ G t ^. [
( C& W5 |- l( c" g4 |. @
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
+ q! p9 i$ j7 y; t$ Q- E( l4 D( A- |
9 n+ ` {0 I7 X7 c/ T
if(!in_array($nameExt, $allowedType)){
, E$ d6 E* t; p4 b6 B# b
$msg = 0;
# t3 z' y2 l# d5 r
}
7 F! [5 r) [9 ]) g+ D% o- N
if(empty($msg)){
1 T& m. u% f: A/ Z) i1 h
$filename = getmicrotime().'.'.$nameExt;
* [) t" `* d$ k2 @# ^9 {
$file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
- l1 a l0 b6 l3 G( y5 U1 ^* Z; i& X
& v! n. }6 g( q8 C2 @
$filename = $dest.$filename;
" i. X/ E) a: ~3 x+ S
if(empty($_FILES['Filedata']['error'])){
' L' m' t0 @ i+ M6 n8 S* ?
move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
9 B+ P, f/ ^2 Z' ~
}
4 _% {* R3 L& v5 G
# d4 f, g! t: P1 ~8 `
if (file_exists($filename)){
& ?. c' s2 G) C
//$msg = 1;
. J$ ~" B7 h/ @" I; F- j& ^
$msg = $file_url;
- w3 ?* P, a# ]" X! N# Z6 Z* X
@chmod($filename, 0444);
; y4 G* Y3 v1 `- a' P( S
}else{
& D0 J6 h( p1 g
$msg = 0;
+ W( _8 a" C+ A6 }/ b* U$ \
}
" \- U$ N% f) z
}
# o+ l$ X1 B: o. S, {
$outMsg = "fileUrl=".$msg;
" S5 c6 P' |5 y
$_SESSION["eoutmsg"] = $outMsg;
' \$ C8 o$ z2 A) }
exit;
1 u: j8 E0 P! U+ _5 H- l
}else if($operateId == 2){
- Y' @; c& M5 T
$outMsg = $_SESSION["eoutmsg"];
$ O, i. s2 }4 O6 m1 O! O6 ^
if(!empty($outMsg)){
5 _; n: I1 W, Q3 B, A$ `) h: I
session_unregister("eoutmsg");
; a& k9 q/ Z% T6 j+ G8 r; n
echo '&'.$outMsg;
' t( ^( P. R- \2 C) ?$ ?
exit;
: f' f: r+ o2 d' d; y- s: _
}else{
! [: _: z& }$ u! ?- k( D
echo "&fileUrl=0";
- ^$ r$ T+ `8 I. D0 i( H
exit;
$ v4 j7 D' f+ e& Z- G- [
}
; Z, N- K# k6 u' k1 U5 g
}
! ]: F$ A. n7 d( P9 T# d
) X b% y @ E: R7 S( n0 O6 @, O
function getmicrotime(){
- ]/ J8 Q, X. f, a+ \) \
list($usec, $sec) = explode(" ",microtime());
! b6 E2 F; x% H" Q+ G$ C
return ((float)$usec + (float)$sec);
" e n/ H6 y h6 C3 }
}
/ X# C6 g$ P; x/ n$ |
* V) E. P( U. t$ b4 p) A
?>
% o @ c; z- R
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2