WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

6 B0 b0 _3 C2 a  |& E6 Z利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

Post任意数据
( c" N+ M5 V) n% _. _" [& m$ F. y保存位置http://localhost/chart/tmp-upload-images/hfy.php


2 ?5 H- E9 h3 M" V9 U) V& d* h最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
+ a: p$ u8 h" @2 b
<?php

9 T( j. t) J' c//
9 F5 O+ O( ?# q// In Open Flash Chart -> save_image debug mode, you
, R+ N9 C' _/ {, g/ {4 @// will see the 'echo' text in a new window.
//

2 @2 f) u7 o& v# x$ V6 D/*

print_r( $_GET );
" t6 L: O6 ^( z/ pprint_r( $_POST );
print_r( $_FILES );
. N. ^4 A/ ]3 p) [' \- f: q8 A
print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
! [& ]* {) J! a4 {
*/
' H$ w; F0 f3 s& N' C// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
; u* i* s) d' h  k/ |$ `
  ^( ]# Q% e0 G/ }4 E( Dif (!file_exists($default_path)) mkdir($default_path, 0777, true);
, @! K2 u2 a$ [$ _
// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
8 K# V% k1 d5 v' m' R7 {) _1 k
echo 'Saving your image to: '. $destination;
% [7 |! z3 Z$ ^9 j// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

//
% S! ~: G, S5 n& n1 X1 g$ K// POST data is usually string data, but we are passing a RAW .png
  H! O, ^0 F3 M1 n$ E. N4 T# l// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
2 d0 q/ f/ ~% o2 [//
1 M, J' ~, `" E6 x' U4 o) Z
+ S) c+ X# |+ A5 O/ K. x5 B" [" Z$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
5 v) X% o2 c* N8 ?. K
//
8 Q- Z( [4 a! F7 C) \2 R// LOOK:
8 t) I" T  y8 o$ o) G//
exit();
% Q) u) L8 w! a//
// PHP5:
//
8 e8 \& Z* B+ q- H
) f8 D! v; v4 ]- R- h
// default path for the image to be stored //
" n/ C0 S" Q* r( F2 p# ?/ H$ N" G: z$default_path = 'tmp-upload-images/';
+ p& \4 R! b/ i* x2 }6 [$ N
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
1 M6 P6 L+ x5 F# U+ ]' |. {# E
// full path to the saved image including filename //
8 n" v4 w; E, v6 e  |7 t" h$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
* R0 A! Y( t. D& r( F
! H# \/ @) J: P1 K0 d// move the image into the specified directory //
; X0 E0 ]  e, y. oif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
6 l6 s6 }1 M+ H& f0 f8 r' G    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
/ y3 E* U; c8 w    echo "FILE UPLOAD FAILED";
}
. Q1 u# n% W1 o. T* [

?>
' q' |) X& r/ c, w
3 y; ]6 u# `5 ^  l+ B$ W
- R5 B# r7 ]% s3 w: M8 w: t+ M* `


' G7 c6 _* L; W& Y
修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞


" {9 m) q& f: T/ f" k: F. k
: j& }$ B) n; C& c) i( }# a