WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
4 S" D# ~: y- I- I  l4 x
利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
3 A# [0 x! K9 ]. G4 s: f( ?! T
5 R: N# ^0 i8 ZPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php

5 v( p( ?# `" Z0 {& c: Y2 F5 [
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
! g7 T! `6 a& X6 b: ^- e! Y
<?php
/ X& k$ |( Y# w0 g
//
* Q$ ?  y5 k, x" G; E// In Open Flash Chart -> save_image debug mode, you
. D+ |* w$ v! y7 I// will see the 'echo' text in a new window.
//
: b2 c' z3 e4 m$ L3 N# f
/*
- ?8 d8 }4 D3 ?6 V. u7 J7 ?% @, n
$ X- g. U( R: l1 x9 v* C& _print_r( $_GET );
print_r( $_POST );
print_r( $_FILES );
" r; U' n" d% q+ g7 |7 O( H) Z
2 }# M3 R5 ^: ~* Mprint_r( $GLOBALS );
7 w$ M3 c" d4 @) f& w; n+ x& G7 eprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
+ j4 }5 p5 c& A" a6 s0 {
3 @) C0 v& f9 }# n6 {5 o; N: y*/
( d" m' v! t# |+ b: d// default path for the image to be stored //
9 d! C, [8 a% J2 B9 n1 t( |$default_path = '../tmp-upload-images/';

& x* e( @4 F0 d2 j; y: l2 T) Aif (!file_exists($default_path)) mkdir($default_path, 0777, true);

9 A! r! O( q4 M! ~$ C* h// full path to the saved image including filename //
; q2 T1 t/ ~9 {  A8 E* |  p& J" d$destination = $default_path . basename( $_GET[ 'name' ] );
! \+ N, J' C" u8 Y. `
8 B( F8 H! ?2 l0 l! U/ y' mecho 'Saving your image to: '. $destination;
* j! h$ p6 l+ G+ R5 D, l* D7 G- g1 ]// print_r( $_POST );
2 f6 o/ n. B' \+ D. P: z+ K// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
5 E3 [( m: {; y% F! H
8 `( t* B/ a0 P5 L+ z5 Q//
// POST data is usually string data, but we are passing a RAW .png
6 k( U8 N- `- f' k, \// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
2 W; ^# V" o% O3 L" V) }3 u& F//
% D' ]/ F9 c5 t4 O3 N( h3 r
$jfh = fopen($destination, 'w') or die("can't open file");
/ i( O3 R8 T; g0 ~. mfwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

//
% A: ~3 _. s. i* Z4 k" k2 B// LOOK:
//
0 }# N9 Q' F/ r4 [exit();
//
// PHP5:
" v1 {, ~+ m$ m6 Y. Y/ I//


/ _" f9 `: e$ u: E// default path for the image to be stored //
$default_path = 'tmp-upload-images/';
3 H; C' e) O" x5 u1 f
if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
! i" ~9 |2 C$ t4 M) G. u1 G6 ~8 k. X" `
// move the image into the specified directory //
" j; o, \% Y* v" H9 ]if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
) o6 i3 s+ D% E! Q0 ?: |% P    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
! }( z/ L( X2 l} else {
: `5 Y8 a9 b' v3 U+ T    echo "FILE UPLOAD FAILED";
% T, p4 A+ W6 T: o+ r0 l" Q- I}

. ~% j% @4 y. z3 K$ I
) Y; b' @1 E; G1 V! z$ O6 J?>






修复方案：
- a3 i9 n: o3 p$ A. o这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞

! u$ Q4 C" I6 A


$ [% X8 p9 I5 g1 w5 Q0 ?2 ?8 K) Z7 N