中国网络渗透测试联盟
标题:
.用友ICC网站客服系统远程代码执行漏洞EXP
[打印本页]
作者:
admin
时间:
2012-9-13 17:51
标题:
.用友ICC网站客服系统远程代码执行漏洞EXP
<?php
1 _. _+ [0 b- M: [, B
/**
" ]& h7 j) Z/ j9 J2 ?* c: }6 Y8 k1 z
* uploadFlash.php
& x- L& ?: q4 V$ h( Y
* Flash文件上传.
7 z+ c3 [# z* `- ~
*/
1 D% j4 I4 [; s1 q# `
require_once('../global.inc.php');
* K1 D3 W* N5 U2 m
5 |4 _: \# Z$ I. T
//operateId=1 上传,operateId=2 获取地址.
3 ]* a8 x( C& T7 h
$operateId = intval($_REQUEST['operateId']);
8 i1 K9 o/ s1 G; c( a7 L; s
if(empty($operateId)) exit;
4 V7 F. w- f# v9 F% Q/ P
7 z Q( ]# k1 S* d: U0 B5 S3 ?: y" V+ n+ i: c
if($operateId == 1){
7 [7 n- l6 z8 b" J& H
$date = date("Ymd");
1 g) ?1 h* B1 A6 }" h
$dest = $CONFIG->basePath."data/files/".$date."/";
" X7 m: v: o- {: w& Y T; h9 K
$COMMON->createDir($dest);
3 o( ?8 q0 k6 ]% T2 B+ C z* i
//if (!is_dir($dest)) mkdir($dest, 0777);
! c* R* L e+ ~9 \( O
7 h& d% @" N% L
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
) ^) k& [1 w& c4 W: g2 U, ^
1 ?8 I: X, v1 c2 y6 V
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
+ @! K8 F2 P, b2 H0 @
( L" `0 n, X E
if(!in_array($nameExt, $allowedType)){
/ V) {( E0 Q# w0 ^' I. d# C k# @
$msg = 0;
* G( d, o* N3 f8 q# s
}
. a0 E$ J9 T) j
if(empty($msg)){
6 R. @8 G, C# |8 e
$filename = getmicrotime().'.'.$nameExt;
! y0 A D; k8 g! ?* q/ X
$file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
8 t. F" Y- W, u$ p: b0 l
' Y1 A# m% O6 \3 y
$filename = $dest.$filename;
: ?/ a( M; H+ d) Z/ X: r1 G/ C
if(empty($_FILES['Filedata']['error'])){
! N# }0 ?8 z! {. x0 f4 o. ]
move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
( K+ s2 u4 |* k7 ~6 Z
}
$ e6 }$ A( I$ q, T' x3 _! u- Z, I
4 |5 m% L6 o- }1 S$ R+ j. I
if (file_exists($filename)){
; H; v3 A7 w4 Y4 X) d
//$msg = 1;
8 g7 x1 }- `; E8 b+ p) J1 u
$msg = $file_url;
, M" N8 U" `, e/ U7 V# f
@chmod($filename, 0444);
( x5 Z5 k1 ^* t/ @$ l
}else{
5 d+ w$ o3 u" {# t: \
$msg = 0;
! F" m% { u& x; ? _
}
, M1 T1 A4 }) G6 z5 N1 H
}
% O( ^5 T6 s: ?' e6 f( I
$outMsg = "fileUrl=".$msg;
0 O, ~6 _/ m& G) [, A( t, b! z
$_SESSION["eoutmsg"] = $outMsg;
! i) a* L1 ~/ D9 y& f6 N
exit;
* Q: r, m; K. E! j/ F
}else if($operateId == 2){
3 A8 g" @6 h/ v. v0 {6 H3 H3 U* a
$outMsg = $_SESSION["eoutmsg"];
/ v% k+ y: ]( b! b0 c: T
if(!empty($outMsg)){
( ?. i9 L1 T9 ^ `+ m7 f: A
session_unregister("eoutmsg");
/ O2 D" M0 g" m4 a, @: A
echo '&'.$outMsg;
4 y% G9 Y3 I* m' L8 }/ E" P) C! H
exit;
0 ]" J* y7 L6 Q7 u% k+ Y4 g, _" Y
}else{
. W5 |% ^+ P8 w: `* F
echo "&fileUrl=0";
5 ^6 w8 l) q$ C; W) W
exit;
2 d6 k9 Z& H7 Z o% R6 _
}
' J3 D) ~0 L+ \8 y+ J
}
" |& W: o9 Y" a( a0 V
+ W. o2 u) ~, |: j+ C
function getmicrotime(){
* K5 y2 ~' w' _
list($usec, $sec) = explode(" ",microtime());
8 k/ r7 B5 ^$ N' c3 I8 `* K
return ((float)$usec + (float)$sec);
[: I: y& h$ D# E9 D
}
2 c, E3 m/ `: p, W3 x, S1 ~
) B3 m- S9 z3 W/ W' j% s
?>
h/ r4 N* n# E& {
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2