upload-labs(二)

Pass-05

对于技术还不怎么样的我来说，这题折磨了我两天。

查看源码

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

发现上一关利用的htaccess也被限制了，但是它没有严格判定大小写，起初我也是想大小写绕过，但是怎么改都不对，我以为我方法有问题，查了网上的通关记录，一样的啊！！而且他们都可以上传。我从一句话代码开始反复查找自己哪里出错了，但是到现在我也没找出来…明明步骤是一样的，可是就是不能绕过。

直到我在字节社区公众号看到了通关记录，但是用的方法并不是大小写。我尝试这个方法，结果，一次成功！！

看来学习的还是不够啊…

直接给出他们的思路。

程序先是去除文件名前后的空格，再去除文件名最后所有的.，再通过strrchar来寻找.来确认文件名的后缀，但是最后保存文件的时候没有重命名而使用的原始的文件名，导致可以利用类似a.php. .(两个点号之间有一个空格)绕过。

成功上传。蚁剑连接。

Pass-06

这关就比较好理解了，看源码

$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");

虽然说限制了很多，但是漏掉了大写。直接用大写绕过就好。

上传成功。接下来可以蚁剑连接。

Pass-07

对比前面的源码。

发现少了一句首尾去空，查找一下需要空格绕过。

成功上传了。

Pass-08

还是对比一下源码。

发现这关没有对文件名末尾进行限制。所以在上传的php文件后面抓包修改加一个.就可以。

成功上传。访问。

Pass-09

对比之前的代码。

缺少了

$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA

这段代码。

这关的原理是在文件名后面添加::$DATA,会把它之后的数据当成文件流处理,不会检测后缀名，而且整个文件类型依照:: $DATA前面的文件类型定义。

上传成功。

Pass-10

这关和第五关解法可以相同，抓包在文件名后面添加. .即可。

今天就这六关了，做为一个比较菜的选手，只能一点点摸索，一起加油。