upload-labs(6-10)
阿新 • • 發佈：2021-08-05
前面自己配的靶場各種問題,整的頭大
找個線上靶場也是一堆問題,清理檔案把上傳目錄給刪了,我直接迷惑
更換成作者配置好的靶場了,用著很舒服
pass-6 沒轉換為小寫
黑盒測試
1.php空格失敗
1.PhP成功,看來沒有全部轉換成小寫
原始碼分析
$is_upload = false; $msg = null; if (isset($_POST['submit'])) { if (file_exists(UPLOAD_PATH)) { $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini"); $file_name = trim($_FILES['upload_file']['name']); $file_name = deldot($file_name);//刪除檔名末尾的點 $file_ext = strrchr($file_name, '.'); $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字串::$DATA $file_ext = trim($file_ext); //首尾去空 if (!in_array($file_ext, $deny_ext)) { $temp_file = $_FILES['upload_file']['tmp_name']; $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext; if (move_uploaded_file($temp_file, $img_path)) { $is_upload = true; } else { $msg = '上傳出錯！'; } } else { $msg = '此檔案型別不允許上傳！'; } } else { $msg = UPLOAD_PATH . '資料夾不存在,請手工建立！'; } }
沒有轉換成小寫,藉助windows特性繞過
pass-7 檢測後用原檔名命名
黑盒測試
1.PhP失敗
1.php空格失敗
1.php.空格.成功
連線成功
原始碼分析
$is_upload = false; $msg = null; if (isset($_POST['submit'])) { if (file_exists(UPLOAD_PATH)) { $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess"); $file_name = trim($_FILES['upload_file']['name']); $file_ext = strrchr($file_name, '.'); $file_ext = strtolower($file_ext); //轉換為小寫 $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字串::$DATA $file_ext = trim($file_ext); //首尾去空 if (!in_array($file_ext, $deny_ext)) { $temp_file = $_FILES['upload_file']['tmp_name']; $img_path = UPLOAD_PATH.'/'.$file_name; if (move_uploaded_file($temp_file, $img_path)) { $is_upload = true; } else { $msg = '上傳出錯！'; } } else { $msg = '此檔案型別不允許上傳！'; } } else { $msg = UPLOAD_PATH . '資料夾不存在,請手工建立！'; } }
1.獲取傳過來的檔名file_name
2.用strrchr來獲得字尾名file_ext,這一步對系統來說本來萬無一失了
3.接下來file_ext轉換成小寫,去::$DATA,首尾去空
4.file_ext內容為.,因為不在黑名單中,所以允許上傳
5.在上傳檔案命名時出現問題,他用的原來的file_name命名,沒用一系列操作後的file_ext,導致檔名還是1.php.空格.,從而繞過
pass-8 未過濾::$DATA
黑盒測試
1.php失敗
1.PhP失敗
1.php空格失敗
1.php.空格.上傳成功,但是被重新命名為202108051714064328.導致連線失敗
1.php::$DATA
為什麼失敗呢,因為命名時是202108051722031308.php::$data,但是儲存到系統上後,根據windows特性,自動變成了202108051722031308.php
把檔名後面的::$DATA刪掉再連線就成功了
原始碼分析
$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
if (file_exists(UPLOAD_PATH)) {
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
$file_name = trim($_FILES['upload_file']['name']);
$file_name = deldot($file_name);//刪除檔名末尾的點
$file_ext = strrchr($file_name, '.');
$file_ext = strtolower($file_ext); //轉換為小寫
$file_ext = trim($file_ext); //首尾去空
if (!in_array($file_ext, $deny_ext)) {
$temp_file = $_FILES['upload_file']['tmp_name'];
$img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
if (move_uploaded_file($temp_file, $img_path)) {
$is_upload = true;
} else {
$msg = '上傳出錯！';
}
} else {
$msg = '此檔案型別不允許上傳！';
}
} else {
$msg = UPLOAD_PATH . '資料夾不存在,請手工建立！';
}
}
各種措施都挺好,就是沒過濾掉::$DATA
pass-9原檔名命名
黑盒測試
1.php上傳失敗
1.php 上傳失敗
1.php. .上傳成功,名字為1.php.,連線成功
原始碼分析
$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
if (file_exists(UPLOAD_PATH)) {
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
$file_name = trim($_FILES['upload_file']['name']);
$file_name = deldot($file_name);//刪除檔名末尾的點
$file_ext = strrchr($file_name, '.');
$file_ext = strtolower($file_ext); //轉換為小寫
$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字串::$DATA
$file_ext = trim($file_ext); //首尾去空
if (!in_array($file_ext, $deny_ext)) {
$temp_file = $_FILES['upload_file']['tmp_name'];
$img_path = UPLOAD_PATH.'/'.$file_name;
if (move_uploaded_file($temp_file, $img_path)) {
$is_upload = true;
} else {
$msg = '上傳出錯！';
}
} else {
$msg = '此檔案型別不允許上傳！';
}
} else {
$msg = UPLOAD_PATH . '資料夾不存在,請手工建立！';
}
}
和pass7步驟差不多
檔名file_name過濾了一次末尾的點
最後命名時用file_name命名
pass-10 雙寫
黑盒測試
1.php上傳成功,被重新命名為1.,難道把php過濾了?
雙寫試試
1.phphpp上傳成功, 重新命名為1.hpp,雙寫錯誤,換個寫法
1.pphphp上傳成功,被重新命名為1.php
連線成功
原始碼分析
$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
if (file_exists(UPLOAD_PATH)) {
$deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");
$file_name = trim($_FILES['upload_file']['name']);
$file_name = str_ireplace($deny_ext,"", $file_name);
$temp_file = $_FILES['upload_file']['tmp_name'];
$img_path = UPLOAD_PATH.'/'.$file_name;
if (move_uploaded_file($temp_file, $img_path)) {
$is_upload = true;
} else {
$msg = '上傳出錯！';
}
} else {
$msg = UPLOAD_PATH . '資料夾不存在,請手工建立！';
}
}
將黑名單中的替換為空,再命名,雙寫繞過