中国网络渗透测试联盟
标题:
.用友ICC网站客服系统远程代码执行漏洞EXP
[打印本页]
作者:
admin
时间:
2012-9-13 17:51
标题:
.用友ICC网站客服系统远程代码执行漏洞EXP
<?php
# u4 [. I1 c9 A5 E7 F$ {3 J% j
/**
- {) T6 L! r9 b/ ~# b* w7 J' Y
* uploadFlash.php
+ k$ Y$ Y0 [# q" z2 L2 P2 Y4 R
* Flash文件上传.
/ P0 T2 C5 ~3 {1 A* ^, J9 R* X
*/
$ @9 j5 T# x) E* G
require_once('../global.inc.php');
( g2 T$ l0 s' U( P. f
! ~. G" ^9 p o5 S4 J- v( e
//operateId=1 上传,operateId=2 获取地址.
/ N, P. B! g, {; P
$operateId = intval($_REQUEST['operateId']);
* C1 S, o) u( z% q; E
if(empty($operateId)) exit;
8 N- B) L5 ~- c. H6 e, \) W7 R* A
2 b; A* { O. S k; [4 O
if($operateId == 1){
& G1 s/ T0 U6 y: f- G4 f0 k) b" S
$date = date("Ymd");
1 i! V) l6 d% D) E+ S7 O. X' y: L
$dest = $CONFIG->basePath."data/files/".$date."/";
" y& W% N; u0 O; O! i v1 J+ \% G: u# c5 A
$COMMON->createDir($dest);
1 V9 b* b/ O. J2 a( |7 j a
//if (!is_dir($dest)) mkdir($dest, 0777);
* F1 i2 A- o& d+ W
3 d3 {1 F7 X5 k! D- ]
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
: N9 f) @6 X- Q, C
$ g. _# I/ \+ y/ E. A
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
. S$ v9 O$ R! w3 Z# x
5 U- i* N, e" z f
if(!in_array($nameExt, $allowedType)){
. ~1 Z, d/ ^" X: r$ M1 }
$msg = 0;
& g* g/ c7 `5 B& b
}
, b; Y6 q0 T+ M
if(empty($msg)){
! ~5 ]( Y2 E6 ?6 \6 q
$filename = getmicrotime().'.'.$nameExt;
2 L( e! V, r* T. k$ n' y
$file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
% v" g0 R: ~* x. q' D
+ P0 l# ~/ C5 z& `$ D2 b4 C1 q {
$filename = $dest.$filename;
% J2 q% W- e% A/ M
if(empty($_FILES['Filedata']['error'])){
# X) a: N2 _/ J; F; }
move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
) e4 g8 }3 @# B( H: Z0 q7 e7 x; T. [
}
+ O, d. X- {( y% U: u. Z
" t8 D0 G- W2 ]$ ~5 s
if (file_exists($filename)){
" x# c5 Z: O: n+ F
//$msg = 1;
* f, b4 `$ B: p9 I; }
$msg = $file_url;
( ~7 n( O4 m9 F, f3 d6 J/ M, X; q
@chmod($filename, 0444);
- G9 x$ s. n( U7 C- f
}else{
% K: x, i1 q. z# y/ z
$msg = 0;
+ x& k" a5 L( u4 l+ I
}
# N W& U1 Q' W. Y7 Z0 C
}
4 m( g; n- T# ~; n A" m
$outMsg = "fileUrl=".$msg;
- e. V8 s, {! p
$_SESSION["eoutmsg"] = $outMsg;
& [9 ~4 }( D8 L' D8 \
exit;
2 x1 ~9 q6 |. F& z7 M' N1 K
}else if($operateId == 2){
1 w' X+ O" m% @; {
$outMsg = $_SESSION["eoutmsg"];
, ^9 @* H0 ^5 M4 C
if(!empty($outMsg)){
' `( I7 q; I) j4 k
session_unregister("eoutmsg");
( _; P% C' n' J0 _9 T
echo '&'.$outMsg;
' x: M9 _2 m+ a( x, {3 V3 N
exit;
& j* L0 }+ t# [ g
}else{
" r, n& a$ C; F, A0 {6 p" U
echo "&fileUrl=0";
/ K9 _. S$ k. I0 r# [& k8 Q
exit;
" B6 Y1 @: I. i- Y8 d. c
}
# o) y1 p1 X2 H8 W9 {- S9 l
}
' F0 n5 E; i" {
* [3 M; W* B2 l
function getmicrotime(){
7 Z/ e. \/ F# E+ z% y
list($usec, $sec) = explode(" ",microtime());
- _4 i. T6 t# b% C+ r% O
return ((float)$usec + (float)$sec);
* [3 F+ Z4 X: P- B# [9 ~
}
% \" w; U4 R+ y$ U9 d% O
K( @+ J, U6 d5 g9 W; f
?>
/ R! S, A- e K. [8 K* W
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2