upload(Pass-10~Pass-)

最新推荐文章于 2023-04-12 15:46:15 发布

圣默

最新推荐文章于 2023-04-12 15:46:15 发布

阅读量272

点赞数

分类专栏： upload-labs 文章标签： php 安全靶场

本文链接：https://blog.csdn.net/kangzinian/article/details/120494224

版权

本文详细介绍了在一系列PHP安全靶场中的上传漏洞利用过程。从Pass-10的白名单绕过，到Pass-11的双写规则利用，再到Pass-12尝试通过hex编码注释掉限制，但最终未能成功。作者通过查看源码、分析PHP逻辑和尝试抓包修改请求，展示了渗透测试中的思考和实验过程。

摘要由CSDN通过智能技术生成

文章目录

Pass-10
Pass-11
Pass-12（失败）

Pass-10

查看提示：本pass只允许上传.jpg|.png|.gif后缀的文件！
有预感是白名单，再查看源码

is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
   
    if (file_exists(UPLOAD_PATH)) {
   
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer"