中国网络渗透测试联盟
标题:
.用友ICC网站客服系统远程代码执行漏洞EXP
[打印本页]
作者:
admin
时间:
2012-9-13 17:51
标题:
.用友ICC网站客服系统远程代码执行漏洞EXP
<?php
" U. l( L1 O3 ]$ J9 W
/**
; u7 {3 A4 z! f
* uploadFlash.php
5 S/ h$ Y {) {' a
* Flash文件上传.
# N, D2 x3 h r8 j- D
*/
1 f' B; U# u( F* t
require_once('../global.inc.php');
9 {3 Y8 d( J, B# b
1 ]* t; s" b4 H; p) k
//operateId=1 上传,operateId=2 获取地址.
! d# u5 i6 j2 x% y
$operateId = intval($_REQUEST['operateId']);
, x# v6 F2 J1 K l, v
if(empty($operateId)) exit;
5 v1 D6 u$ s8 F- f! A [/ g
# j8 O# L; m* E4 f& B3 v
if($operateId == 1){
5 J* K5 p' H' X k" O2 G
$date = date("Ymd");
5 Z$ d0 q' j; }
$dest = $CONFIG->basePath."data/files/".$date."/";
+ d# H* n2 c/ ^, o6 Y/ [( L' M7 E
$COMMON->createDir($dest);
/ P4 l/ G3 t4 i7 P* C2 P
//if (!is_dir($dest)) mkdir($dest, 0777);
) S6 k [) v O
# b, d- T" H* U
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
- x+ x: S! | k7 c3 \6 S. V
: W9 o: i9 }7 W1 ~/ M; h5 w
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
* g! a; j/ j: U! Z* M& R7 @0 m
- d( Q B9 T; Q! y6 r- }
if(!in_array($nameExt, $allowedType)){
! x7 u. H$ r6 |9 q- r
$msg = 0;
2 L0 e4 s2 |0 ]
}
. V7 z9 Y' b% v- n0 W0 K/ d' i
if(empty($msg)){
6 j. m: y" v7 p, K; E' a$ M
$filename = getmicrotime().'.'.$nameExt;
- D4 S8 A# [4 L6 F5 o* i
$file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
X9 C, `# z5 w* R- @
! T9 W/ q0 \) k7 r
$filename = $dest.$filename;
& ^! T& {2 v) {% ~
if(empty($_FILES['Filedata']['error'])){
! n$ _( L4 N; O' y$ V4 C
move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
5 H5 K/ L- d4 S6 Q- z3 r. [: A
}
2 _: B: @0 U; n4 f5 R2 E& Q% S
' z4 J5 C* _: m
if (file_exists($filename)){
7 h( j6 {/ D) u0 [
//$msg = 1;
! G- I/ a% ^/ {9 C# y3 ^$ h
$msg = $file_url;
, O$ }- z9 O) y
@chmod($filename, 0444);
" H4 O8 a o# V/ S* ^" Y0 {* a
}else{
. y7 d2 I4 P- z( C0 f. U/ y
$msg = 0;
7 H7 N' j# ]; |2 q8 _( ~
}
1 ^* G, O" g% I8 t8 D: y. S
}
- t$ x: i0 n( i+ U( X1 s
$outMsg = "fileUrl=".$msg;
( e& A5 i" N5 a8 U
$_SESSION["eoutmsg"] = $outMsg;
2 d! y; K/ T$ C: W: L* l
exit;
7 K8 g0 A1 E7 j, j5 v5 G* U& i! d
}else if($operateId == 2){
2 W$ I& q; G. G3 S
$outMsg = $_SESSION["eoutmsg"];
7 u8 W* j9 ~8 F
if(!empty($outMsg)){
( ]! E* a G) v8 b- M& ]1 j) q
session_unregister("eoutmsg");
& w: E+ @( C$ o; M3 d
echo '&'.$outMsg;
& i+ C0 t5 f/ W! m
exit;
3 z, l5 r7 y. C# n5 G" E6 u
}else{
5 z+ C* ]7 b* Y J0 d' }( q
echo "&fileUrl=0";
1 d* p/ f5 V+ _5 V9 H
exit;
7 S i$ _: l# P, r6 U$ i C7 O; D* e4 n
}
; o# p: B @+ `; z# A+ m! I- _; y
}
) k$ s2 Q) Y" N
0 J6 _& _& a' n) F/ j5 n
function getmicrotime(){
/ x$ o3 B3 l0 D
list($usec, $sec) = explode(" ",microtime());
- {6 d. ~7 s5 s1 i
return ((float)$usec + (float)$sec);
9 Q0 E4 {, l- {/ B
}
4 ^" o& {+ F0 Y7 `$ U6 f! R( S
. B5 e2 S* Y7 ?# |0 x* T
?>
D, q, A! ]$ g: `2 l F j/ L
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2