中国网络渗透测试联盟

标题: .用友ICC网站客服系统远程代码执行漏洞EXP [打印本页]

作者: admin    时间: 2012-9-13 17:51
标题: .用友ICC网站客服系统远程代码执行漏洞EXP
<?php# u4 [. I1 c9 A5 E7 F$ {3 J% j
/**- {) T6 L! r9 b/ ~# b* w7 J' Y
* uploadFlash.php
+ k$ Y$ Y0 [# q" z2 L2 P2 Y4 R * Flash文件上传./ P0 T2 C5 ~3 {1 A* ^, J9 R* X
*/
$ @9 j5 T# x) E* Grequire_once('../global.inc.php');
( g2 T$ l0 s' U( P. f! ~. G" ^9 p  o5 S4 J- v( e
//operateId=1 上传,operateId=2 获取地址.
/ N, P. B! g, {; P$operateId = intval($_REQUEST['operateId']);* C1 S, o) u( z% q; E
if(empty($operateId)) exit;8 N- B) L5 ~- c. H6 e, \) W7 R* A
2 b; A* {  O. S  k; [4 O
if($operateId == 1){
& G1 s/ T0 U6 y: f- G4 f0 k) b" S $date = date("Ymd");1 i! V) l6 d% D) E+ S7 O. X' y: L
$dest = $CONFIG->basePath."data/files/".$date."/";
" y& W% N; u0 O; O! i  v1 J+ \% G: u# c5 A $COMMON->createDir($dest);1 V9 b* b/ O. J2 a( |7 j  a
//if (!is_dir($dest)) mkdir($dest, 0777);
* F1 i2 A- o& d+ W 3 d3 {1 F7 X5 k! D- ]
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
: N9 f) @6 X- Q, C $ g. _# I/ \+ y/ E. A
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');. S$ v9 O$ R! w3 Z# x

5 U- i* N, e" z  f if(!in_array($nameExt, $allowedType)){. ~1 Z, d/ ^" X: r$ M1 }
  $msg = 0;& g* g/ c7 `5 B& b
}, b; Y6 q0 T+ M
if(empty($msg)){
! ~5 ]( Y2 E6 ?6 \6 q  $filename = getmicrotime().'.'.$nameExt;
2 L( e! V, r* T. k$ n' y  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);% v" g0 R: ~* x. q' D
  
+ P0 l# ~/ C5 z& `$ D2 b4 C1 q  {  $filename = $dest.$filename;
% J2 q% W- e% A/ M  if(empty($_FILES['Filedata']['error'])){
# X) a: N2 _/ J; F; }   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);) e4 g8 }3 @# B( H: Z0 q7 e7 x; T. [
  }
+ O, d. X- {( y% U: u. Z  
" t8 D0 G- W2 ]$ ~5 s  if (file_exists($filename)){" x# c5 Z: O: n+ F
   //$msg = 1;
* f, b4 `$ B: p9 I; }   $msg = $file_url;
( ~7 n( O4 m9 F, f3 d6 J/ M, X; q   @chmod($filename, 0444);- G9 x$ s. n( U7 C- f
  }else{
% K: x, i1 q. z# y/ z   $msg = 0;+ x& k" a5 L( u4 l+ I
  }# N  W& U1 Q' W. Y7 Z0 C
}
4 m( g; n- T# ~; n  A" m $outMsg = "fileUrl=".$msg;
- e. V8 s, {! p $_SESSION["eoutmsg"] = $outMsg;
& [9 ~4 }( D8 L' D8 \ exit;
2 x1 ~9 q6 |. F& z7 M' N1 K}else if($operateId == 2){
1 w' X+ O" m% @; { $outMsg = $_SESSION["eoutmsg"];, ^9 @* H0 ^5 M4 C
if(!empty($outMsg)){' `( I7 q; I) j4 k
  session_unregister("eoutmsg");( _; P% C' n' J0 _9 T
  echo '&'.$outMsg;
' x: M9 _2 m+ a( x, {3 V3 N  exit;
& j* L0 }+ t# [  g }else{
" r, n& a$ C; F, A0 {6 p" U  echo "&fileUrl=0";
/ K9 _. S$ k. I0 r# [& k8 Q  exit;" B6 Y1 @: I. i- Y8 d. c
}# o) y1 p1 X2 H8 W9 {- S9 l
}
' F0 n5 E; i" {* [3 M; W* B2 l
function getmicrotime(){ 7 Z/ e. \/ F# E+ z% y
    list($usec, $sec) = explode(" ",microtime());
- _4 i. T6 t# b% C+ r% O    return ((float)$usec + (float)$sec);
* [3 F+ Z4 X: P- B# [9 ~}
% \" w; U4 R+ y$ U9 d% O  K( @+ J, U6 d5 g9 W; f
?>/ R! S, A- e  K. [8 K* W





欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2