中国网络渗透测试联盟
标题:
.用友ICC网站客服系统远程代码执行漏洞EXP
[打印本页]
作者:
admin
时间:
2012-9-13 17:51
标题:
.用友ICC网站客服系统远程代码执行漏洞EXP
<?php
$ s1 I# S( ^: u8 T2 M, C6 e! e
/**
' p+ I+ E% w" o; Y- E
* uploadFlash.php
( a, Q4 L$ }: K0 \! k
* Flash文件上传.
2 H- G0 l6 ?- p2 ?
*/
! `& }% u4 b& ]& w" G
require_once('../global.inc.php');
. n+ F, i- A- O% \- e7 e8 G
* r: A8 {. w, Z& D+ Y8 J
//operateId=1 上传,operateId=2 获取地址.
5 K% f9 M) L, Z' D" E7 }4 n4 I
$operateId = intval($_REQUEST['operateId']);
}1 U, E8 {4 y' G# T3 v) `& m" r6 _
if(empty($operateId)) exit;
9 R4 ?7 [5 Z4 D) X* Y( F* k! E
& `* `0 W5 e) a. n8 n1 \+ ~) @
if($operateId == 1){
9 L2 _9 A/ I* r1 Y
$date = date("Ymd");
( h" U6 T" Z3 x& ~
$dest = $CONFIG->basePath."data/files/".$date."/";
( ~) O7 u% q7 ~2 B% ^; }/ t
$COMMON->createDir($dest);
, B5 Z9 K# ?/ n+ {. w. B
//if (!is_dir($dest)) mkdir($dest, 0777);
- E) W/ M q9 H) s& ?& o, g
7 Y% A7 N X1 u6 F5 f! o. z1 p C) \
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
$ O. I5 {! I- T8 ^, J0 c$ @
: F1 y" }- d' b+ i& V
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
: d' f* b9 M) |
1 J( Q& \! [; z) T% J
if(!in_array($nameExt, $allowedType)){
% u1 ^7 j! E; y$ V$ d4 t. E- E0 j
$msg = 0;
/ A# d6 x9 d6 z" I5 ?! M) p
}
9 c6 ^; y' A$ s+ m2 Z6 q4 O
if(empty($msg)){
; D; ~, ?9 B! f) A H
$filename = getmicrotime().'.'.$nameExt;
% Z6 i- l/ R/ d, H7 j
$file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
+ u# G4 b6 k% |- X/ }9 o3 g& V
( a8 P% @- B5 w! P: q6 ~, {
$filename = $dest.$filename;
9 @" N: p2 A" \8 @' z
if(empty($_FILES['Filedata']['error'])){
* d" B/ ^7 b( W! z9 z, j# s; m
move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
, c0 |9 ?( X; S: t6 Y
}
& u" J! u0 {2 }# r- ?
% }% Z8 _ z# F0 ~& H( m# D! D
if (file_exists($filename)){
" U2 x8 T1 H4 N- E3 t5 U) O
//$msg = 1;
0 s( j! G# F# a$ [4 o/ R
$msg = $file_url;
( s2 |3 r# e7 ]% N8 ~4 O
@chmod($filename, 0444);
0 K8 a7 Y* n- O, J
}else{
" w7 q7 Q5 w6 w; ^
$msg = 0;
5 r/ ]' S. p H1 j; _: `
}
0 L. `3 K; w' G2 t
}
/ u; `7 @0 A/ T: {; g, p! }$ W
$outMsg = "fileUrl=".$msg;
8 `/ h* L. w" A! M
$_SESSION["eoutmsg"] = $outMsg;
, \ }6 M1 n2 g" ?
exit;
5 x ` `5 b/ Q' l* c
}else if($operateId == 2){
8 B* g0 P& m$ p1 W; c! ?
$outMsg = $_SESSION["eoutmsg"];
1 v1 I$ e5 x# `4 T' d- e, X
if(!empty($outMsg)){
6 s. g$ W$ Q! b4 w4 U1 K; R- b
session_unregister("eoutmsg");
. ?& t7 X* n8 e* U
echo '&'.$outMsg;
2 s4 J- C- C7 T" I+ w# h
exit;
6 w) W9 Y- y+ U' `1 \
}else{
9 a& }/ j# J: T
echo "&fileUrl=0";
1 ] s: f1 Q# {+ G# i3 h" x7 X+ h
exit;
2 R& b2 \" q, x7 c# E: @
}
0 o7 f* [4 V. {( d
}
4 h* D3 W# \4 j4 V. z- I# j
/ H' U0 L; m+ J9 L1 c+ m
function getmicrotime(){
$ l* l! i8 Y1 e. O2 x1 G& o
list($usec, $sec) = explode(" ",microtime());
- M- X- t$ g0 X+ L+ }
return ((float)$usec + (float)$sec);
, [0 Y N" _! h1 _5 }2 ?: |
}
; A2 r* x- R) O9 x# _
6 g' a2 w, I, M
?>
/ v; o! a3 x/ Q' u# M
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2