WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
* _! l# c( m9 J5 n3 C8 p: i' ], n 漏洞文件/chart/php-ofc-library/ofc_upload_image.php
, D8 p. G+ ]% D2 H  {# H
! B1 ^1 t5 {9 Y利用：
$ U! {# C: j' z" d. d/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

; V5 q* \% r! G' gPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php
# @* F( l- W4 ]/ [7 H3 P
3 m6 H' {9 J9 u' j* M+ R
. g. r! `! u7 ?最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php
1 i5 V/ P7 P  F# I  |" ?
! f- G( g* k6 t//
0 z  K+ Z2 Y9 I: f% j// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
; [4 _6 _5 [2 g" D//
% P5 T" _- h8 c+ U1 o
) }" M% F! N. [6 _" u  y/*
/ ?1 W) r1 l# l+ a: F, N
+ J5 [( c: Q1 nprint_r( $_GET );
+ z1 h9 f2 s) p' W$ Pprint_r( $_POST );
1 m  y, Y/ i0 f9 S6 b8 Kprint_r( $_FILES );
8 v4 t4 B2 L: L% @( f
print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

9 ~0 V+ R, q6 R2 M*/
$ r" I2 v$ j# O- B9 s/ s* i1 S// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

8 W5 c  l% a6 v* w& [/ a- j/ zif (!file_exists($default_path)) mkdir($default_path, 0777, true);

: |3 B0 a  P, }' ]7 O1 P// full path to the saved image including filename //
& ~# h) k7 M  p$destination = $default_path . basename( $_GET[ 'name' ] );
5 C9 |: W6 ?$ Y2 n( Z
  q0 }0 f6 M$ o2 R- _+ Uecho 'Saving your image to: '. $destination;
3 q2 i! f- v( f// print_r( $_POST );
// print_r( $_SERVER );
2 J. l% m* {' k1 @& f// echo $HTTP_RAW_POST_DATA;

//
# y. C% J# U7 W// POST data is usually string data, but we are passing a RAW .png
' U1 f1 q2 b0 F- `// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//

# a5 O) N5 E7 \$ I6 i$jfh = fopen($destination, 'w') or die("can't open file");
- {+ I* }0 v9 b+ i8 ~3 ]; X3 jfwrite($jfh, $HTTP_RAW_POST_DATA);
9 Q' t3 w% _! m  a) yfclose($jfh);

//
// LOOK:
//
exit();
//
// PHP5:
) w3 c, O. g7 E3 A//

# e; {( n3 V0 R) X( p; N
: _( N) M- R! h& Y0 \7 r: ^: Q// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
: R) L9 _, K1 c9 s; f
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
& a- w  D. C7 f% O
// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
! b2 j8 o( Y6 J' c. H$ Mif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
3 u, @) f' F4 S! Q( p! N    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
    echo "FILE UPLOAD FAILED";
) i2 X" ]4 P( e3 @% n$ ?; h9 \; |}


?>

. y' p3 @8 _% `3 ^- R/ u/ o+ \2 \
3 |% P+ o5 J: K' k



) U  [0 Q4 s4 l/ g8 t修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
+ p9 M' T& i- q' x8 @3 J
" A& {" g. p: e. z# L# F