WooYun.org

 WooYun: 国内外多家vpn设备厂商批量漏洞(续集一) 

<?
include_once "management/certificate.php";//此文件没有权限的验证,SO...
$MAX_SIZE= 2*1000*1000;
if ($_FILES['gw_cert']) {
	$file_size = $_FILES['gw_cert']['size'];
	$file_type = $_FILES['gw_cert']['type'];
	
	$temp_name = $_FILES['gw_cert']['tmp_name'];
	$gw_file_name = $_FILES['gw_cert']['name'];
	$gw_file_name = str_replace("\\","",$gw_file_name);
	$gw_file_name = str_replace("'","",$gw_file_name);
	$gw_file_name = str_replace(" ","",$gw_file_name);
	$file_path = $CFG_UPLOAD_PATH.$gw_file_name;
	//File Name Check
	if ( $gw_file_name == "" ) { 
		include "include/error.php";
		return;
	}
	$gw_file_name = $file_path;
	$result  =  move_uploaded_file($temp_name, $file_path);
	chmod($file_path, $CFG_UPLOAD_MOD);
} else {
	include "include/error.php";
	return;
}
if ($_FILES['iss_cert']) {
	$file_size = $_FILES['iss_cert']['size'];
	$file_type = $_FILES['iss_cert']['type'];
	
	$temp_name = $_FILES['iss_cert']['tmp_name'];
	$iss_file_name = $_FILES['iss_cert']['name'];
	$iss_file_name = str_replace("\\","",$iss_file_name);
	$iss_file_name = str_replace("'","",$iss_file_name);
	$iss_file_name = str_replace(" ","",$iss_file_name);
	$file_path = $CFG_UPLOAD_PATH.$iss_file_name;
	//File Name Check
	if ( $iss_file_name == "" ) { 
		include "include/error.php";
		return;
	}
	$iss_file_name = $file_path;
	$result  =  move_uploaded_file($temp_name, $file_path);
	chmod($file_path, 0777);
}
$CM = new CertificateManager;
if ($_FILES['iss_cert'])
	$msg = $CM->Import_GW_CA_Cert($ticket, $gw_file_name, $iss_file_name);
else
	$msg = $CM->Import_GW_CA_Cert($ticket, $gw_file_name, "");
$RURL = "?body=3";
$RURL1 = "?body=4";
if ($msg != "OK")
	include "include/error.php";
else
	echo "<META HTTP-EQUIV=\"REFRESH\" CONTENT=\"0; URL=".$RURL."\">";
?>

if ($_FILES['gw_cert']) {
	$file_size = $_FILES['gw_cert']['size'];
	$file_type = $_FILES['gw_cert']['type'];
	
	$temp_name = $_FILES['gw_cert']['tmp_name'];
	$gw_file_name = $_FILES['gw_cert']['name'];
	$gw_file_name = str_replace("\\","",$gw_file_name);
	$gw_file_name = str_replace("'","",$gw_file_name);
	$gw_file_name = str_replace(" ","",$gw_file_name);
	$file_path = $CFG_UPLOAD_PATH.$gw_file_name;
	//File Name Check
	if ( $gw_file_name == "" ) { 
		include "include/error.php";
		return;
	}
	$gw_file_name = $file_path;
	$result  =  move_uploaded_file($temp_name, $file_path);
	chmod($file_path, $CFG_UPLOAD_MOD);
} else {
	include "include/error.php";
	return;
}

/sub_ca_action.php
/admin/system/gw_cert_import_action.php
/admin/account/admin_add_action.php
/admin/account/group_batch_add_action.php
/admin/authentication/mini_ca_action.php
/admin/authentication/mini_ca_action.php
....

<?
if (isset($_POST["file_name"]))
	$file_name = "/datahttps://wooyun-img.oss-cn-beijing.aliyuncs.com/upload/sysbackup_".$_POST["file_name"].".bin";
else {
	header("Location: ../login.php");
	return;
}
header("Pragma: "); 
header("Cache-Control: "); 
header("Content-type: application/octet-stream");
header("Content-Length: ".filesize($file_name));
header("Content-Disposition: attachment; filename=\"sysbackup.bin\"");
readfile($file_name);
@unlink($file_name);
?>

2014/01/09  16:40    <DIR>          .
2014/01/09  16:40    <DIR>          ..
2014/01/07  14:00             3,550 httpd-mpm.conf.big
2014/01/07  14:00             3,550 httpd-mpm.conf.small
2014/01/07  14:00             3,089 httpd.conf
2014/01/07  14:00             3,148 httpd.conf-80
2014/01/07  14:00             2,183 index.php
               5 个文件         15,520 字节
               2 个目录 105,551,912,960 可用字节

ServerRoot "/usr"
Listen 127.0.0.1:1
#Listen 80
LoadModule auth_basic_module lib/httpd/modules/mod_auth_basic.so
LoadModule include_module lib/httpd/modules/mod_include.so
LoadModule env_module lib/httpd/modules/mod_env.so
LoadModule mime_magic_module lib/httpd/modules/mod_mime_magic.so
LoadModule expires_module lib/httpd/modules/mod_expires.so
LoadModule headers_module lib/httpd/modules/mod_headers.so
LoadModule setenvif_module lib/httpd/modules/mod_setenvif.so
LoadModule mime_module lib/httpd/modules/mod_mime.so
LoadModule autoindex_module lib/httpd/modules/mod_autoindex.so
LoadModule cgi_module lib/httpd/modules/mod_cgi.so
LoadModule vhost_alias_module lib/httpd/modules/mod_vhost_alias.so
LoadModule dir_module lib/httpd/modules/mod_dir.so
LoadModule actions_module lib/httpd/modules/mod_actions.so
LoadModule alias_module lib/httpd/modules/mod_alias.so
LoadModule rewrite_module lib/httpd/modules/mod_rewrite.so
User root
Group root
ServerAdmin cheng.zhang@o2micro.com
#ServerName www.example.com:80
ServerName 127.0.0.1
DocumentRoot "/ssl/www"
<Directory />
    Options FollowSymLinks ExecCGI
    AllowOverride None
#    Order deny,allow
#    Deny from all
</Directory>
<Directory "/ssl/www">
    Options -Indexes FollowSymLinks MultiViews ExecCGI
    AllowOverride None
</Directory>
<IfModule dir_module>
    DirectoryIndex index.html index.php login.php
</IfModule>
ErrorLog /dev/null
#ErrorLog /var/log/httpd/error_log
#LogLevel warn
DefaultType text/plain
<IfModule mime_module>
    TypesConfig /etc/httpd/mime.types
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz
    AddHandler cgi-script .cgi
</IfModule>
#MIMEMagicFile /etc/httpd/magic
# Server-pool management (MPM specific)
Include /etc/httpd/extra/httpd-mpm.conf
# Multi-language error messages
#Include /etc/httpd/extra/httpd-multilang-errordoc.conf
# Fancy directory listings
#Include /etc/httpd/extra/httpd-autoindex.conf
# Language settings
#Include /etc/httpd/extra/httpd-languages.conf
# User home directories
#Include /etc/httpd/extra/httpd-userdir.conf
# Real-time info on requests and configuration
#Include /etc/httpd/extra/httpd-info.conf
# Virtual hosts
#Include /etc/httpd/extra/httpd-vhosts.conf
# Local access to the Apache HTTP Server Manual
#Include /etc/httpd/extra/httpd-manual.conf
# Distributed authoring and versioning (WebDAV)
#Include /etc/httpd/extra/httpd-dav.conf
# Various default settings
Include /etc/httpd/extra/httpd-default.conf
# Override the setting in httpd-default.conf
KeepAlive Off
ServerSignature Off
ServerTokens Prod 
Timeout 180  
# Uncomment the following line to enable PHP:
#
Include /etc/httpd/mod_php.conf
<VirtualHost 127.0.0.1:1>
	ServerName 127.0.0.1
	DocumentRoot "/ssl/www"
	RewriteEngine on 
	RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
	RewriteRule .* -[F]
	RewriteRule ^/admin$ /admin/ [R] 
</VirtualHost>
#<VirtualHost _default_:80>
#	ServerName 127.0.0.1
#	DocumentRoot "/ssl/www/htdocs"
#	Alias /admin/ "/ssl/www/htdocs/"
#	RewriteEngine on 
#	RewriteRule ^/admin$ /admin/ [R] 
#</VirtualHost>