中国网络渗透测试联盟
标题:
.用友ICC网站客服系统远程代码执行漏洞EXP
[打印本页]
作者:
admin
时间:
2012-9-13 17:51
标题:
.用友ICC网站客服系统远程代码执行漏洞EXP
<?php
- o( i: z% ^5 l; \4 i5 _
/**
' |! R: H4 a/ C, K8 P
* uploadFlash.php
; @8 Q6 Y: o3 k5 |6 I* x l
* Flash文件上传.
9 H: _/ v/ R N; ?1 j/ v7 p1 @/ U6 L
*/
! Z- B# C3 V' N9 J2 D
require_once('../global.inc.php');
, }7 @ D- m! \3 i1 ^9 Y
% p7 R" i* q% x- O8 x9 n. J
//operateId=1 上传,operateId=2 获取地址.
! E- i ]! s% _# y( r* U* e3 |
$operateId = intval($_REQUEST['operateId']);
/ E' m" U( O8 B
if(empty($operateId)) exit;
4 w8 `. Q s7 M0 T7 ~
) @/ H/ G* ]: t
if($operateId == 1){
R& \# e# P# `2 E
$date = date("Ymd");
( f% @6 t& u: K% k4 n
$dest = $CONFIG->basePath."data/files/".$date."/";
/ z3 K' `8 X$ _0 e | j" w
$COMMON->createDir($dest);
1 n, } f# Y Z4 p- m) p
//if (!is_dir($dest)) mkdir($dest, 0777);
/ Z* g7 r1 I A
" ~, d2 p/ g" n* z
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
- T7 n! @+ P6 y( {% u
* e- I8 n" r4 m1 \2 G7 D
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
6 g! u% o; A- q' W9 }; Q. r; F
* ^& K' W9 v2 r. p7 ]
if(!in_array($nameExt, $allowedType)){
( o+ y5 E" r: {" x' O. \2 ]6 d( p
$msg = 0;
0 L4 z4 u% j7 g5 Z$ n+ [
}
6 X& ]2 F0 @. j' ?3 E# M! K% I! i- T
if(empty($msg)){
1 f" q2 J* }6 {) o+ Q
$filename = getmicrotime().'.'.$nameExt;
$ x) C) m$ R- g9 |/ ?( P; S
$file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
4 ~; t ~ W/ Q* C" _- M9 u7 _* M
5 q+ g2 c7 [" `- C
$filename = $dest.$filename;
+ P4 x1 Y. r" T) { D
if(empty($_FILES['Filedata']['error'])){
4 |# T; [2 D# J5 y8 V5 }
move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
5 I, i8 E! c* Q( x
}
$ _6 a0 v' ~+ A6 N
3 W1 [1 r0 W$ O0 ~1 c8 ^+ s
if (file_exists($filename)){
2 X3 G* n, T% R
//$msg = 1;
4 S5 I8 m8 r7 ?4 S) ]9 L j
$msg = $file_url;
% V* S( k l0 t! x- }
@chmod($filename, 0444);
* @" V$ m" Z% X% g8 d
}else{
; ]( O9 h& _# h) P, l z) [
$msg = 0;
# Z1 N6 E& F; U: G
}
2 |1 q) w5 |, y2 I0 v9 d9 _
}
2 s8 x% s8 Q0 O. u/ C! S
$outMsg = "fileUrl=".$msg;
& k) [9 ^) [) S& j
$_SESSION["eoutmsg"] = $outMsg;
+ k4 L) f* `1 o: ~4 A+ {
exit;
! k- z+ X+ r% u4 f
}else if($operateId == 2){
- {6 {. r, {8 ~; W- l: V% u: v7 C
$outMsg = $_SESSION["eoutmsg"];
) M; v" M& A& N+ v2 u2 m- N
if(!empty($outMsg)){
: o0 N F8 w4 _& Z
session_unregister("eoutmsg");
! l& v" M+ u" O* `- p5 W
echo '&'.$outMsg;
, C2 N+ `# `( x, X: ?5 z
exit;
4 s7 j. c; w# B
}else{
* D) f9 @: h, Y6 A. Z
echo "&fileUrl=0";
6 H) F. X0 R( e }& ?
exit;
6 a- O4 W7 F+ l. G w7 h. M
}
' m. {1 b; G5 q1 u
}
4 F6 M, F5 f* U% ?7 `
; z1 w- b7 o& |/ |# o7 H! y
function getmicrotime(){
6 l' Z! d1 E- [: Z: {
list($usec, $sec) = explode(" ",microtime());
7 {# z' }0 z) ]+ _9 I! x
return ((float)$usec + (float)$sec);
1 t: o8 j+ N( u8 U0 z- q4 Z
}
& ^: t q( z: n: @' H; K
9 e' J& j/ u; b2 E
?>
$ j4 @; D2 M+ T; c: W& V
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2