首页 > 其他分享 >文件上传漏洞靶场（1-10）

文件上传漏洞靶场（1-10）

时间：2024-07-15 10:56:05浏览次数：8  
标签：10 name upload ext file msg 靶场 上传

第一关（js绕过）

先建立一个php文件，内容如下：

<?php phpinfo();?>

题目要求是上传一个webshell到服务器，上传一个php文件提示错误

第一种思路

查看源代码，可以发现有一个checkFile()函数，用来检查上传文件类型，想要成功上传 . php 文件，第一个思路就可以是删除这一部分，让其无法检查上传文件类型

 

上传成功

右键点击图片复制图片地址，在浏览器打开，就可以看到成功上传的文件了

第二种思路

本关是在客户端使用JavaScript对不合法图片进行检查，也可以直接在浏览器关闭 js

例如在火狐浏览器上，按F12，在设置中找到禁用JavaScript

 第三种思路

将原来的12.php文件后缀改为.jpg ,进行上传，同时使用burpsuite抓包，直接将对应位置的文件后缀再改为.php,，传到Reperter

上传成功！ 

第二关（MIME检测）

查看提示，可以发现是MIME检测

MIME：是设定某种扩展名的文件用一种应用程序来打开的方式类型，当该扩展名文件被访问的时候，浏览器会自动使用指定应用程序来打开。多用于指定一些客户端自定义的文件名，以及一些媒体文件打开方式。即文件后缀

常见的MIME类型：

超文本标记语言文本 .html、.html text/html

普通文本 .txt text/plain

RTF 文本 .rtf application/rtf

GIF 图形 .gif image/gif

JPEG 图形 .jpeg、.jpg image/jpeg

au 声音文件 .au audio/basic

MIDI 音乐文件 mid、.midi audio/midi、audio/x-midi

RealAudio 音乐文件 .ra、.ram audio/x-pn-realaudio

MPEG 文件 .mpg、.mpeg video/mpeg

AVI 文件 .avi video/x-msvideo

GZIP 文件 .gz application/x-gzip

TAR 文件 .tar application/x-tar

 也可以直接查看源代码，看一下到底什么类型的文件才能被成功上传

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        if (($_FILES['upload_file']['type'] == 'image/jpeg') || ($_FILES['upload_file']['type'] == 'image/png') || ($_FILES['upload_file']['type'] == 'image/gif')) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH . '/' . $_FILES['upload_file']['name']            
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '文件类型不正确，请重新上传！';
        }
    } else {
        $msg = UPLOAD_PATH.'文件夹不存在,请手工创建！';
    }
}

 可以先上传一个.jpg文件，然后直接使用burpsuite进行抓包，其实可以发现.jpg文件可以成功上传，接着就要找MIME出现的位置，找到了MIMIE的位置，在Content-Type中

如果要上传一个.php文件，也可以通过抓包把他 Content-Type的内容改的和.jpg 文件一样，这样就可以成功上传.php文件了

成功上传

 第三关（黑名单绕过）

查看一下提示

直接查看源码也是可以的

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array('.asp','.aspx','.php','.jsp');
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //收尾去空

        if(!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;            
            if (move_uploaded_file($temp_file,$img_path)) {
                 $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '不允许上传.asp,.aspx,.php,.jsp后缀文件！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

 Tips:PHP文件的后缀名有php、php2、php3、php4、php5、php6、php7、pht、phtm、phtml。

直接上传一个名为1.php5的文件，可以发现直接上传成功

第四关（.htaccess文件上传）

查看一下源代码，可以发现本关的禁止上传的文件类型有很多

".php",".php5",".php4",".php3",".php2",".php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".ini"

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //收尾去空

        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件不允许上传!';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

这些后缀的都无法上传，这时候就要用到传说中的.htaccess文件上传了。


首先创建一个.htaccess文件（文件名就为.htaccess）内容如下 

AddType application/x-httpd-php .png
//意思就是如果文件里面有一个后缀为.png的文件，他就会被解析成.php。先上传一个1.png文件，然后上传这个.htaccess，再访问1.png，完美通关。

 

第五关

查看提示

查看源代码

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

源代码中含有大小写转换的函数 

第六关 （大小写绕过）

查看提示，要求上传目录存在PHP文件

 

查看本关的源代码

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空

        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

 可以发现不能上传.htaccess文件了，但是通过源代码发现没有转换大小写的代码，那么我们就能通过上传大小写混合的后缀名来进行绕过。上传一个5.Php文件直接成功

第七关（空格绕过）

先查看源代码,可以发现大小写绕过已经不行了，但是没有首尾去空，我们可以尝试通过抓包在文件名后面加几个空格

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = $_FILES['upload_file']['name'];
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file,$img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件不允许上传';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

可以发现上传成功

 

 第八关( . 绕过)

查看源代码，可以发现没有删除文件末尾的".",所以我们可以通过抓包在文件末尾加上“.”

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

可以发现上传成功

第九关 （::$DATA绕过）

$DATA在文件解析漏洞中的妙用

在window的时候如果文件名+"::$DATA"会把::$DATA之后的数据当成文件流处理,不会检测后缀名，且保持::$DATA之前的文件名，他的目的就是不检查后缀名

例如:"phpinfo.php::$DATA"Windows会自动去掉末尾的::$DATA变成"phpinfo.php"

继续对比，我们发现，相比于第前面几关，此关没有进行data字符的绕过，所以我们继续抓包

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

可以发现绕过成功

 第十关（双写绕过）

查看源代码可以发现这一关似乎过滤了所有的条件，可以尝试一下双写

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

将文件名改为1.pphphp ,上传成功

标签：10,name,upload,ext,file,msg,靶场,上传
From： https://blog.csdn.net/2301_80358831/article/details/140375540

相关文章

  • XSS靶场——通关笔记
    第一关页面很简单，可以发现通过修改url中level1.php?name后面的字段，页面会改变，显示该字段的总长再查看源代码，根据源代码可知当有个弹窗就会执行函数，最后得到我们想要的“完成的不错”<script>alert(111)</script>第二关第二关似乎和第一关一样，不确定，试试同样的代码在......
  • vulnstack1靶场学习
    描述红队实战系列，主要以真实企业环境为实例搭建一系列靶场，通过练习、视频教程、博客三位一体学习。另外本次实战完全模拟ATT&CK攻击链路进行搭建，开成完整闭环。后续也会搭建真实APT实战环境，从实战中成长。关于环境可以模拟出各种各样实战路线，目前给出作者实战的一套攻击实战路线......
  • 1100. 抓住那头牛
    //1100.抓住那头牛.cpp:此文件包含"main"函数。程序执行将在此处开始并结束。//#include<iostream>#include<queue>#include<map>usingnamespacestd;/*https://www.acwing.com/problem/content/1102/农夫知道一头牛的位置，想要抓住它。农夫和牛都位于数轴......
  • STM32F103控制0.96寸OLED显示
            OLED支持IIC通信，IIC通信的详细知识在（http://t.csdnimg.cn/VALuO）中可以查看，STM32通过IIC将要显示的数据传输到OLED屏幕上。        除了需要显示的信息需要传输外，还有显示的坐标也需要传输。那么具体的操作如下所示：1.首先配置IIC通信的时钟线与数据线......
  • CF1107F Vasya and Endless Credits
    KM做法这么简单好想为什么都在dp？我第一次过也是用的dp。建模非常好想，每天只能收一次钱，最简单的思路是我们枚举第几天开车跑路，但是再一想我们不关心是第几天，只关心每次贷款离开车跑路还差几天，于是我们从\(i\)向\(j\)连边，边权是\(a_i+b_i\times\min(k_i,j)\)，意义为第\(i\)......
  • 企业网络运维-给华为交换机配置sftp，浏览交换机文件并下载上传
    文章目录需求实验开户stelnet权限已完成stelnet账号下的sftp配置使用xshell-sftp访问需求浏览交换机文件并下载上传实验开户stelnet权限参考https://blog.csdn.net/xzzteach/article/details/140419150已完成stelnet账号下的sftp配置服务类型all包括stelnet......
  • 《痞子衡嵌入式半月刊》 第 104 期
    痞子衡嵌入式半月刊：第104期这里分享嵌入式领域有用有趣的项目/工具以及一些热点新闻，农历年分二十四节气，希望在每个交节之日准时发布一期。本期刊是开源项目（GitHub:JayHeng/pzh-mcu-bi-weekly），欢迎提交issue，投稿或推荐你知道的嵌入式那些事儿。上期回顾：《痞子衡嵌入式半月......
  • Unraid 连接雷迪司 H1000M UPS 教程
    前言上周六租住的小区更换电表，由于本人未注意贴在楼下的通知，直到断电时往去楼下咨询更换电表的工作人员才知晓通知已经提前一周下达。强制断电对NAS的硬盘影响是致命的，于是当机立断购入了雷迪司的这款NAS备用电源。选择这款备用电源的原因主要是便宜，Unraid和TheNetwork......
  • VulnHub-TR0LL: 1靶场实操
    TR0LL:1靶场实操靶场信息下载后使用vm打开即可TR0LL1靶场地址：https://www.vulnhub.com/entry/tr0ll-1,100/靶场创建时间：2014年8月14日靶场描述：Tr0ll的灵感来自于OSCP实验室内对机器的不断拖钓。目标很简单，获取root权限并从/root目录获取Proof.txt。不适合容易沮丧......
  • python 基础10 requests
    requests官方文档：https://requests.readthedocs.io/projects/cn/zh-cn/latest/快速上手https://requests.readthedocs.io/projects/cn/zh-cn/latest/user/quickstart.html安装找到目标路径Scriptspipinstallrequests-ihttps://pipy.douban.com/simple发送请求简洁：im......

赞助商

阅读排行

网站主页关于我们联系我们网站地图

本网站内容转载自其他媒体，侵权联系[admin##ips99.com]。

Copyright © 2020-2023 IPS99 版权所有 IPS99