檔案上傳 [upload-labs-master][Pass1-10]

2023-05-18 12:20:04

目錄

Pass-01（JS檢測檔案字尾名）禁用JS或抓包修改字尾名繞過

Pass-02（檔案類型限制）抓包修改檔案類型繞過

Pass-03（黑名單過濾）php3繞過

Pass-04（黑名單過濾）.htaccess繞過

Pass-05（黑名單過濾）大小寫繞過

Pass-06（黑名單過濾）空格繞過

Pass-07（黑名單過濾）點繞過

Pass-08（黑名單過濾）::$DATA繞過

Pass-09（黑名單過濾）點+空格+點繞過

Pass-10（黑名單過濾）雙寫繞過

Pass-01（JS檢測檔案字尾名）禁用JS或抓包修改字尾名繞過

前端源碼如下：

function checkFile() {
    var file = document.getElementsByName('upload_file')[0].value;
    if (file == null || file == "") {
        alert("請選擇要上傳的檔案!");
        return false;
    }
    //定義允許上傳的檔案類型
    var allow_ext = ".jpg|.png|.gif";
    //提取上傳檔案的類型
    var ext_name = file.substring(file.lastIndexOf("."));
    //判斷上傳檔案類型是否允許上傳
    if (allow_ext.indexOf(ext_name + "|") == -1) {
        var errMsg = "該檔案不允許上傳，請上傳" + allow_ext + "類型的檔案,目前檔案類型為：" + ext_name;
        alert(errMsg);
        return false;
    }
}

上傳一句話發現：

檔案上傳 [upload-labs-master][Pass1-10]

結合源碼可以看出是前端JS限制檔案字尾，我們抓包修改字尾名，發現上傳成功。這裡修改檔案類型也可以成功。

檔案上傳 [upload-labs-master][Pass1-10]

Pass-02（檔案類型限制）抓包修改檔案類型繞過

源碼如下：

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        if (($_FILES['upload_file']['type'] == 'image/jpeg') || ($_FILES['upload_file']['type'] == 'image/png') || ($_FILES['upload_file']['type'] == 'image/gif')) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH . '/' . $_FILES['upload_file']['name']            
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '檔案類型不正确，請重新上傳！';
        }
    } else {
        $msg = UPLOAD_PATH.'檔案夾不存在,請手工建立！';
    }
}

檢視源碼，發現是檢查檔案類型的，我們抓包修改檔案類型，上傳成功。

檔案上傳 [upload-labs-master][Pass1-10]

Pass-03（黑名單過濾）php3繞過

源碼如下：

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array('.asp','.aspx','.php','.jsp');
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除檔案名末尾的點
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //轉換為小寫
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字元串::$DATA
        $file_ext = trim($file_ext); //收尾去空

        if(!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;            
            if (move_uploaded_file($temp_file,$img_path)) {
                 $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '不允許上傳.asp,.aspx,.php,.jsp字尾檔案！';
        }
    } else {
        $msg = UPLOAD_PATH . '檔案夾不存在,請手工建立！';
    }
}

黑名單過濾判斷，這裡我們可以上傳php2、php3一句話木馬檔案，上傳成功。

檔案上傳 [upload-labs-master][Pass1-10]

Pass-04（黑名單過濾）.htaccess繞過

源碼如下：

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2","php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2","pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除檔案名末尾的點
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //轉換為小寫
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字元串::$DATA
        $file_ext = trim($file_ext); //收尾去空

        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '此檔案不允許上傳!';
        }
    } else {
        $msg = UPLOAD_PATH . '檔案夾不存在,請手工建立！';
    }
}

可以看到，過濾了很多檔案，但是我們可以使用上傳.htaccess檔案。具體利用姿勢，将一句話木馬檔案改為.jpg字尾，然後上傳.htaccess檔案将.jpg檔案當成.php文見解析。

檔案上傳 [upload-labs-master][Pass1-10]

然後上傳.htaccess檔案，内容如下：AddType application/x-httpd-php .jpg

檔案上傳 [upload-labs-master][Pass1-10]

注意這裡需要抓包修改檔案名，要把這裡的key删掉。

檔案上傳 [upload-labs-master][Pass1-10]

然後我們通路：http://192.168.41.129/upload-labs-master/upload/phpinfo.jpg，發現圖檔已經成功被當成php解析。

檔案上傳 [upload-labs-master][Pass1-10]

Pass-05（黑名單過濾）大小寫繞過

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除檔案名末尾的點
        $file_ext = strrchr($file_name, '.');
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字元串::$DATA
        $file_ext = trim($file_ext); //首尾去空

        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '此檔案類型不允許上傳！';
        }
    } else {
        $msg = UPLOAD_PATH . '檔案夾不存在,請手工建立！';
    }
}

黑名單過濾，相比于pass-4，過濾了.htaccess，但将字尾轉換為小寫去掉了，是以可以使用大小繞過。我們抓包修改為大寫字尾名即可成功上傳。

檔案上傳 [upload-labs-master][Pass1-10]

檔案上傳 [upload-labs-master][Pass1-10]

上傳成功。

Pass-06（黑名單過濾）空格繞過

源代碼如下：

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = $_FILES['upload_file']['name'];
        $file_name = deldot($file_name);//删除檔案名末尾的點
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //轉換為小寫
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字元串::$DATA
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file,$img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '此檔案不允許上傳';
        }
    } else {
        $msg = UPLOAD_PATH . '檔案夾不存在,請手工建立！';
    }
}

源代碼沒有首尾去空，是以可以利用windows特性，空格繞過；我們抓包進行加空格字尾，即可成功繞過。

檔案上傳 [upload-labs-master][Pass1-10]

Pass-07（黑名單過濾）點繞過

源碼如下：

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //轉換為小寫
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字元串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '此檔案類型不允許上傳！';
        }
    } else {
        $msg = UPLOAD_PATH . '檔案夾不存在,請手工建立！';
    }
}

沒有對字尾名末尾的點進行處理，利用windows特性，會自動去掉字尾名中最後的”.”，可在字尾名中加”.”繞過；

檔案上傳 [upload-labs-master][Pass1-10]

Pass-08（黑名單過濾）::$DATA繞過

源碼如下：

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除檔案名末尾的點
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //轉換為小寫
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '此檔案類型不允許上傳！';
        }
    } else {
        $msg = UPLOAD_PATH . '檔案夾不存在,請手工建立！';
    }
}

沒有對字尾名中的’::$DATA’進行過濾。在php+windows的情況下：如果檔案名+"::$DATA"會把::$DATA之後的資料當成檔案流處理,不會檢測字尾名.且保持"::$DATA"之前的檔案名。利用windows特性，可在字尾名中加” ::$DATA”繞過：

檔案上傳 [upload-labs-master][Pass1-10]

Pass-09（黑名單過濾）點+空格+點繞過

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除檔案名末尾的點
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //轉換為小寫
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字元串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '此檔案類型不允許上傳！';
        }
    } else {
        $msg = UPLOAD_PATH . '檔案夾不存在,請手工建立！';
    }
}

代碼先是去除檔案名前後的空格，再去除檔案名最後所有的點，再通過strrchar函數來尋找點來确認檔案名的字尾，但是最後儲存檔案的時候沒有重命名而使用的原始的檔案名，導緻可以利用key.php. .（點+空格+點）來繞過。

檔案上傳 [upload-labs-master][Pass1-10]

Pass-10（黑名單過濾）雙寫繞過

源代碼如下：

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");

        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = str_ireplace($deny_ext,"", $file_name);
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = UPLOAD_PATH.'/'.$file_name;        
        if (move_uploaded_file($temp_file, $img_path)) {
            $is_upload = true;
        } else {
            $msg = '上傳出錯！';
        }
    } else {
        $msg = UPLOAD_PATH . '檔案夾不存在,請手工建立！';
    }
}

黑名單過濾，将黑名單裡的字尾名替換為空且隻替換一次，是以可以用雙寫繞過。

檔案上傳 [upload-labs-master][Pass1-10]

檔案上傳 [upload-labs-master][Pass1-10]

DVWA Web漏洞漏洞複現 php web 網絡安全

上一篇: 手把手教你使用Python輕松搞定發郵件

下一篇: 怎麼做自己的微信小程式？

繼續閱讀

PHP進階學習之session寫入資料庫
php session application 資料庫網絡
08-07
php寫一個簡潔的登入頁面
php
08-07
Apache與PHP環境下配置本地虛拟主機
php apache 虛拟主機
08-07
Testlink安裝部署之XAMPP
Testlink php 資料庫
08-07
TestLink 圖表中文亂碼問題
Testlink php
08-07
ecshop屬性排序
php
08-07
Ubuntu16.04安裝Apache+MySQL+PHP1. 安裝Apache2. 安裝MySQL3. 安裝PHP4. 安裝phpMyAdmin
php apache ubuntu mysql httpd
08-07
版本号隐藏
httpd nginx php tomcat
08-07
配置網頁内容通路
Linux運維 ENGINEER web 伺服器 Linux centos
08-07
Apache配置SSLApache配置SSL
伺服器 php apache openssl ssl
08-07
配置apache支援PHP（win7）
apache httpd-conf php
08-07
Cloud Studio初體驗
Python ruby php
08-07
Bugku-WEB-web33
web安全網絡安全
08-07
NOSQL安全攻擊
php 資料庫大資料
08-07
php 去掉字元串的最後一個字元及截取原字元串1,2,3,4,5,6,
php
08-07
php——水印
php 備忘水印
08-07