[HarekazeCTF2019]Avatar Uploader 1

首先打开题目环境

随便用了个用户名登录进去了

成功登录，是一个上传页面，提示了要上传一个小于256kB且小于256px*256px的png图片
这题是直接给了源码的，既然是文件上传，那就看看upload.php

<?php
error_reporting(0);

require_once('config.php');
require_once('lib/util.php');
require_once('lib/session.php');

$session = new SecureClientSession(CLIENT_SESSION_ID, SECRET_KEY);

// check whether file is uploaded
if (!file_exists($_FILES['file']['tmp_name']) || !is_uploaded_file($_FILES['file']['tmp_name'])) {
  error('No file was uploaded.');
}

// check file size
if ($_FILES['file']['size'] > 256000) {
  error('Uploaded file is too large.');
}

// check file type
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$type = finfo_file($finfo, $_FILES['file']['tmp_name']);
finfo_close($finfo);
if (!in_array($type, ['image/png'])) {
  error('Uploaded file is not PNG format.');
}

// check file width/height
$size = getimagesize($_FILES['file']['tmp_name']);
if ($size[0] > 256 || $size[1] > 256) {
  error('Uploaded image is too large.');
}
if ($size[2] !== IMAGETYPE_PNG) {
  // I hope this never happens...
  error('What happened...? OK, the flag for part 1 is: <code>' . getenv('FLAG1') . '</code>');
}

// ok
$filename = bin2hex(random_bytes(4)) . '.png';
move_uploaded_file($_FILES['file']['tmp_name'], UPLOAD_DIR . '/' . $filename);

$session->set('avatar', $filename);
flash('info', 'Your avatar has been successfully updated!');
redirect('/');

这里用finfo_file来判断上传的是否是png图片，用getimagesize()来获取图像大小及相关信息，成功返回一个数组，失败则返回 FALSE 并产生一条 E_WARNING 级的错误信息。这里不仅判断了图像大小，还再次判断了是不是png图片，如果不是png图片则返回flag
关于此数组中的内容

因为finfo_file()可以识别png图片十六进制下的第一行，而 getimagesize 不可以。所以只要保持png头破坏掉文件长宽等其余信息就能绕过了，使用winhex工具把文件头单独保留出来，然后进行文件上传


成功获得flag
flag{ee063069-482a-4091-8b70-1d16053f96e0}