upload-labs通关记录

已于 2022-06-12 15:23:08 修改
阅读量688 收藏 2
点赞数
文章标签： 前端 php web安全
于 2022-06-07 21:04:21 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/kindyyy/article/details/125172218
版权

PASS-01js前端验证

本题主要是考察js前端验证，在我还没有上传题目的时候就一直提示只允许上传png/jpg文件，就是最典型的前端验证。在火狐浏览器上我们用about:config将javascrip-enabled关闭即可直接上传

记得在WWW/upload-labs文件下创建一个upload的文件夹,存放上传成功的，马儿文件

上传成功：

 测试后文件存在，用蚁剑连接

连接成功即可

 PASS-02 MIME验证

 

 经过提示，本题是mime验证。MIME类型校验就是我们在上传文件到服务端的时候，服务端会对客户端也就是我们上传的文件的Content-Type类型进行检测，如果是白名单所允许的，则可以正常上传，否则上传失败。其实只要记住是对concent-type类型的文件进行检测。

只允许上传image/jpeg、png、gif的文件

上传文件，用bp抓包，将concent-type的类型修改为image/png上传成功

用蚁剑连接： 

打开即可找到相关的马儿位置。 

PASS-03 黑名单限制

浅浅看了一下提示，应该是黑名单绕过

查看一下源码： 

 可以将这几个后缀用php1,php2,php5等来替换，用bp和蚁剑解题即可 （可以直接上传php3文件）

上传成功 

不知道是不是靶场的问题蚁剑没有连上，我们先追一下进度。

PASS-04 .hataccess文件上传

看一下源码：

s_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists($UPLOAD_ADDR)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2","php1",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2","pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //收尾去空

        if (!in_array($file_ext, $deny_ext)) {
            if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {
                $img_path = $UPLOAD_ADDR . $_FILES['upload_file']['name'];
                $is_upload = true;
            }
        } else {
            $msg = '此文件不允许上传!';
        }
    } else {
        $msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建！';
    }
}

被过滤了许多的，但是不要忘记了还有.hataccess类型的文件，本题主要考察的就是hataccess文件的上传。现在上传一下试一试

补充：.htaccess 文件使用

上传成功。 

用蚁剑连接一下试一试 

连接成功

PASS-05  .ueser.ini

查看源码：

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists($UPLOAD_ADDR)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空

        if (!in_array($file_ext, $deny_ext)) {
            if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {
                $img_path = $UPLOAD_ADDR . '/' . $file_name;
                $is_upload = true;
            }
        } else {
            $msg = '此文件不允许上传';
        }
    } else {
        $msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建！';
    }
}

发现第五题和第四题大同小异，但是第五题将.htaccess文件也过滤了，要换一种上传方法，通过看大神的wp后要用ini配置文件上传。（今天发现我的靶场多多少少有点问题，我用buuctf上面的做题）

用ini配置文件我的确也传不上。后来我用点空格点的方式绕过了

用bp抓包后修改它的文件后缀，加上. .

上传成功后用蚁剑连接成功。 

（我感觉文件上传的题目真的做的好懵啊，害） 

PASS-06 黑名单绕过——大小写绕过

在我的靶场出问题后重新安装了一个靶场。查看源码发现将.ini和.htaccess类型的文件都禁止了。在用. .然过后我学习了一种新的绕过方法：大小写绕过。

分享一下源码：

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空

        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

trim()是去除空格，所以不能使用空格绕过。

上传一个php文件，用bp抓包，更改php后缀为PHp，即可上传成功

用蚁剑连接。

PASS-07 黑名单绕过—— 空格绕过

首先查看源码：

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = $_FILES['upload_file']['name'];
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file,$img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件不允许上传';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

本关没有trim()过滤空格，所以相比起大小写绕过可以用空格绕过。

先上传一个 php文件用bp抓包，在后缀名处加上一个空格点击forward放包之后 ，上传成功，用F12找文件位置

 用蚁剑连接即可连接成功。

 PASS-08 黑名单绕过—— . 绕过

查看源码：

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

发现没有delot()函数去除文件名末尾的点。所以可以用末尾加.的方式绕过 

上传成功。

查看当前文件所在的位置 

用蚁剑连接试一试 。连接的时候记得在末尾加上.

连接成功。

PASS-09 黑名单绕过——特殊字符串绕过：::$DATA

对比源码得知，本题没有过滤::$DATA这个特殊字符串。所以使用::$DATA绕过。在文件名末尾加上::$DATA

上传成功

查找文件的位置： 

用蚁剑连接成功 

PASS-10 黑名单绕过——综合绕过

查看源码

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

 看似把所有绕过方式都过滤了。但是有一个新的知识点。有关delot()函数

deldot()函数从后向前检测，当检测到末尾的第一个点时会继续它的检测，但是遇到空格会停下来。所以可以用. .进行绕过。

如图，用bp抓包后更改后缀名。

放包后，上传成功 

查看文件所在位置。 

用蚁剑连接。文件名末尾一定记得加上. 。连接成功 

 PASS-11 黑名单绕过——双写绕过

查看源码：

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess","ini");

        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = str_ireplace($deny_ext,"", $file_name);
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = UPLOAD_PATH.'/'.$file_name;        
        if (move_uploaded_file($temp_file, $img_path)) {
            $is_upload = true;
        } else {
            $msg = '上传出错！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

发现有一个全新的函数：str_ireplace()函数

 于此，我们可以得出结论，将文件名中的php,phtml等文件后缀替换为空格。所以我们用双写绕过该函数。如图：

上传成功： 查找文件的位置：

用蚁剑连接，连接成功。

PASS-12 

kindyyy
关注
Upload-labs（1-21关详细教程）【简单易懂】【万字教程】
墨鱼菜鸡
09-10 4205
目录 思维导图 练习网站： 注意： 知识点 Pass-01 代码： 提示： 解题思路： Pass-02 知识点： 代码： 提示： 解题思路： Pass-03(本关需要使用自己搭建upload-labs) 代码： 提示： 解题思路： Pass-04 代码： 提示： 解题思路： Pass-05(建议使用本机搭建的...
upload-labs 文件上传靶场 详细攻略(pass1-10)
最新发布
weixin_73904941的博客
10-11 1624
upload-labs 文件上传靶场 详细攻略(pass1-10)
upload-labs通关教程
qq_73792226的博客
09-10 1231
首先准备一个php小马这是调用phpinfo这个函数，查看php的配置信息首先上传1.php发现使用BP抓不到包，猜测被前端验证了，查看网页源代码可以看到下面有一段js代码过滤了，只能传.jpg/.png/.gif，进行了白名单过滤，所以我们需要禁用前端的js代码使用这个扩展可以禁用前端代码的执行，也可以直接按F12进入开发者模式，在按F1进入设置这里可以禁用js代码右键在新窗口打开，出现下面的页面就成功了。
Upload-labs
qq_52671379的博客
04-01 4723
Upload-labs
upload-labs
Z_blog
03-29 290
upload-labsPass-01-js校验Pass-02-content-type类型Pass-03-黑名单Pass-04-黑名单 Pass-01-js校验 查看源码 function checkFile() { var file = document.getElementsByName('upload_file')[0].value; if (file == null || ...
安装upload-labs
10-22
同时，upload-labs还提供了详细的课程讲解和write up（通关指南），可以帮助您更好地理解和掌握文件上传漏洞的防御方法。 结语 安装upload-labs是一个非常重要的步骤，它可以帮助您快速掌握文件上传漏洞的基础知识...
upload-labs通关手册
12-03
详细记录了upload-labs靶场的通关步骤，并且附带有caidao和burpsuite工具资源，非常适合初学者！！！
upload-labs靶场
09-09
upload-labs靶场
真的没办法一心一意麽？ php 文件操作
想个标题偏头痛
06-14 575
"r" （只读方式打开，将文件指针指向文件头） "r+" （读写方式打开，将文件指针指向文件头） "w" （写入方式打开，清除文件内容，如果文件不存在则尝试创建之） "w+" （读写方式打开，清除文件内容，如果文件不存在则尝试创建之） "a" （写入方式打开，将文件指针指向文件末尾进行写入，如果文件不存在则尝试创建之） "a+" （读写方式打开，通过将文件指针指向文件末尾进行写入来保存文件
UPLOAD-LABS靶场[超详细通关教程，通关攻略]
muyuchen110的博客
07-27 2794
Upload-labs是一个使用PHP语言编写，专门用于渗透测试和CTF中遇到的各种文件上传漏洞的靶场。目前一共20关，每个关都包含着不同上传方式。文件上传漏洞：用户可以越过其本身权限，向服务器上传可执行的动态脚本文件，例如木马、病毒、恶意脚本或者WebShell等。文件上传漏洞本身就是一个危害巨大的漏洞，WebShell更是将这种漏洞的利用无限扩大。
upload-labs通关
05-12
以下是一些通关Upload-labs的建议： 1. 熟悉文件上传的原理和常见的文件上传漏洞类型，如未授权上传、文件类型绕过、文件名绕过等。 2. 仔细阅读每个挑战的题目和描述，理解题目要求和目标。 3. 使用常见的文件...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值