中国网络渗透测试联盟
标题:
.用友ICC网站客服系统远程代码执行漏洞EXP
[打印本页]
作者:
admin
时间:
2012-9-13 17:51
标题:
.用友ICC网站客服系统远程代码执行漏洞EXP
<?php
7 |( I* V) M% l% M- e
/**
" h9 p+ _9 q# A( N& |
* uploadFlash.php
& m. f" A1 r/ a' R, i- S. X
* Flash文件上传.
$ d2 a+ e" F) J, N9 J
*/
* w- K% ?8 P, D) D$ j
require_once('../global.inc.php');
! [& d* M" w- }% a6 t& v
' [. N# S% s! o$ Q4 w1 D
//operateId=1 上传,operateId=2 获取地址.
" S! r. W/ D" h: v& `# o7 m
$operateId = intval($_REQUEST['operateId']);
3 ]7 Y. D! x% Y, A; W. l; P
if(empty($operateId)) exit;
; g8 O0 R/ V$ [
; `4 u0 u2 G/ r; O5 N1 K4 A- u
if($operateId == 1){
% K( C) d# X9 a& u, l3 [2 R
$date = date("Ymd");
( J" D K) e5 w x9 R
$dest = $CONFIG->basePath."data/files/".$date."/";
$ ]/ x: p; K9 v/ \
$COMMON->createDir($dest);
- R5 j$ ^9 C' ^7 y, u* `" A
//if (!is_dir($dest)) mkdir($dest, 0777);
* Q0 n' m" B5 U/ j1 n* T3 n M
7 z* Q6 n! K) u9 r
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
1 F o- M0 h& M, W
. ~" D! N* S1 n
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
( V+ D% f& V, v# C N0 ~
( K; Q# c9 N8 _8 r1 d
if(!in_array($nameExt, $allowedType)){
) y4 C$ H1 J, m4 |% r
$msg = 0;
9 T; ]2 n. ^# E C5 G
}
' U- o) q. h& [& a3 i) N
if(empty($msg)){
& s) H0 i7 g( g2 o( F2 I! G
$filename = getmicrotime().'.'.$nameExt;
# N% H' X3 E1 P) \ u
$file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
; @: ?% R% t }/ V% V N
$ x' Y# I6 n) Y* `5 N
$filename = $dest.$filename;
- o! ]9 r: S$ w2 h6 g* N
if(empty($_FILES['Filedata']['error'])){
+ z& B+ ] u) O: Y6 r+ F& W- J2 D
move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
! `% t+ W% W# B: M5 i. W6 p5 Y! ~' M
}
8 C1 P' g- D, |# v* q; E' Q2 R: T) Z" M
$ [, j0 D- L6 s4 S
if (file_exists($filename)){
3 W9 p; O8 ]; Z! F4 b
//$msg = 1;
7 k- I s/ ~3 `0 A! _
$msg = $file_url;
7 R/ \+ H' x1 k W( @
@chmod($filename, 0444);
/ _, Z0 C' k7 Z# V/ U
}else{
7 t' ^/ N5 Z3 ]5 ^ X" c
$msg = 0;
7 g) x6 N% g; Y0 a8 l) k& T
}
) Z* `# q1 |7 p# {8 l
}
, F( K* U3 ~- S8 I
$outMsg = "fileUrl=".$msg;
, J$ ?6 d [+ K- e- C$ i6 |
$_SESSION["eoutmsg"] = $outMsg;
! b8 e+ ^( W0 q( |
exit;
! E# E! I. E8 ~ v# v6 I
}else if($operateId == 2){
5 M: _' B8 q3 A7 _1 H- ]# r
$outMsg = $_SESSION["eoutmsg"];
5 B4 i# U4 h, I' C* y, x
if(!empty($outMsg)){
7 z" z6 D' Y" r5 O# L
session_unregister("eoutmsg");
- q! i; \% @% Y1 n7 T
echo '&'.$outMsg;
$ j, @( u4 _- k- U& u; s4 @
exit;
7 `0 f# l6 q0 u4 J
}else{
/ l9 {% q3 q3 \" j0 H0 B4 A3 t
echo "&fileUrl=0";
: x) V% e7 [2 A+ `. ^& T
exit;
$ Q8 `! y& R3 ^
}
. a. I( |4 ?- D& e( ]/ l% @
}
" T2 { O6 Y2 \1 U& R9 Q1 R
8 A2 x# ]( Q# A% k
function getmicrotime(){
3 ^7 [6 I/ A' @% w- d
list($usec, $sec) = explode(" ",microtime());
# P. B9 n' L1 k; c% N f3 T
return ((float)$usec + (float)$sec);
4 G3 M. V9 K: d, n0 `5 h% }
}
% ]5 ^# a8 [9 {9 O+ O E) i% r
1 }9 C5 t7 B4 Y3 {& q2 h/ A5 R) }
?>
. p0 d8 u: U* @% w0 L, k' k- O: S
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2