文件上传漏洞解析

lay77.

于 2023-08-29 20:50:18 发布

阅读量625

点赞数 1

文章标签： web安全安全网络安全

本文链接：https://blog.csdn.net/lay77/article/details/132569747

版权

1.任意文件上传概述

文件上传是Web应用必备功能之一，如头像上传、附件分享。如果服务器配置不当未进行足够过滤，Web用户可以上传任意文件，包括恶意脚本文件，exe程序等，这就造成了任意文件上传漏洞

1. 漏洞成因

服务器配置不当，开启了PUT 方法。 Web 应用开放了文件上传功能，没有对上传的文件做足够的限制和过滤。在程序开发部署时，没有考虑以下因素，导致限制被绕过：

代码特性；
组件漏洞；
Web 容器漏洞；
系统特性；

2.漏洞危害

上传恶意代码（文件，程序），并执行恶意代码（文件，程序）：

上传后门文件并执行，导致网站沦陷；
通过恶意文件，利用其他漏洞拿到管理员权限（提权），导致服务器沦陷。

通过文件上传漏洞获得的网站后门，叫WebShell。

2.WebShell

1.命令解释器

linux	Windows
bash	powershell
sh	cmd
zsh

2.WebShell

WebShell 一个网站后门，也一个命令解释。通 Web 方式，使 HTTP| HTTPS 协议递命令消息到，并且继承了Web 权限，在服务器上远程执行命令。WebShell 从本质上讲，就是服务器端可运行的脚本文件，后缀名通常为： .php .asp .aspx .jsp

WebShell 接收来自于Web 用户的命令，然后在服务器端执行，也称为网站木马、木马后门、网马等。

Web容器	脚本语言
Apache HTTPD	php
IIS	asp\| aspx\| php
Tomcat	jsp\| jspx

大马代码量比较大，与小马对比。
小马一句话木马，需要与中国菜刀配合。特点：短小精悍，功能强大。三大基本功能：文件管理、虚拟终端、数据库管理。 php 脚本格式：

<?php @eval($_REQUEST[777])?>
//代码执行函数+传参点

asp 脚本形式：

<%eval request("777")%>

aspx 脚本形式：

<%@ Page Language="Jscript"%>
<%eval(Request.Item["777"],"unsafe");%>

GetShell GetShell 是获取WebShell 的过程或结果。文件上传漏洞的利用是GetShell 的主要方式，但不是唯一手段。

3.任意文件上传攻防

DVWA/File Upload/Low 。

源代码

<?php
if( isset( $_POST[ 'Upload' ] ) ) {
// Where are we going to be writing to?
$target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
$target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );
// Can we move the file to the upload folder?
if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) {
// No
echo '<pre>Your image was not uploaded.</pre>';
}
else {
// Yes!
echo "<pre>{$target_path} succesfully uploaded!</pre>";
}
}
?>

代码审计对文件上传没有做任何过滤；任意文件上传。

1.黑白名单策略

黑白名单是最常用，也是最重要的安全策略之一。黑白名单策略类似于一个列表，列表中写了一些条件或者规则，黑名单就是非法条件，白名单就是合法条件，类似于手机的黑白名单。也是最常用的防御策略之一。

文件检测
- 文件后缀名
- 文件类型
- 文件内容

后缀名黑名单

$deny_ext = array(
".php",".php5",".php4",".php3",".php2","php1",".phtml",".pht",
".html",".htm",
".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jhtml",
".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",
".cer",".swf",
".htaccess"
);

后缀名白名单

$allow_ext = array(
'jpg','jpeg','png','bmp','gif','svg',
'zip','tar.gz',
'doc','docx','pdf','xls','ppt'
);

2.文件类型检测

DVWA/File Upload/Medium 。

<?php
if( isset( $_POST[ 'Upload' ] ) ) {
// Where are we going to be writing to?
$target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
$target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );
// File information
$uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
$uploaded_type = $_FILES[ 'uploaded' ][ 'type' ];
$uploaded_size = $_FILES[ 'uploaded' ][ 'size' ];
// Is it an image?
if( ( $uploaded_type == "image/jpeg" || $uploaded_type == "image/png" ) &&
( $uploaded_size < 100000 ) ) {
// Can we move the file to the upload folder?
if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) {
// No
echo '<pre>Your image was not uploaded.</pre>';
}
else {
// Yes!
echo "<pre>{$target_path} succesfully uploaded!</pre>";
}
}
else {
// Invalid file
echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>';
}
}
?>

代码审计上传的文件没有重命名； Content-Type 类型白名单检测；任意文件上传。

3.文件后缀名或内容检测

DVWA/File Upload/High 。

<?php
if( isset( $_POST[ 'Upload' ] ) ) {
// Where are we going to be writing to?
$target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
$target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );
// File information
$uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
$uploaded_ext = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1);
$uploaded_size = $_FILES[ 'uploaded' ][ 'size' ];
$uploaded_tmp = $_FILES[ 'uploaded' ][ 'tmp_name' ];
// Is it an image?
if( ( strtolower( $uploaded_ext ) == "jpg" || strtolower( $uploaded_ext ) == "jpeg" || strtolower(
$uploaded_ext ) == "png" ) &&
( $uploaded_size < 100000 ) &&
getimagesize( $uploaded_tmp ) ) {
// Can we move the file to the upload folder?
if( !move_uploaded_file( $uploaded_tmp, $target_path ) ) {
// No
echo '<pre>Your image was not uploaded.</pre>';
}
else {
// Yes!
echo "<pre>{$target_path} succesfully uploaded!</pre>";
}
}
else {
// Invalid file
echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>';
}
}
?>

代码审计上传文件没有重命名；文件后缀名白名单检测；使用getimagesize() 进行文件内容检测，只检测文件头部

4.图片木马

使用cmd 命令

copy imgName/ +yjh/a newImgName

说明：图片木马没有办法直接利用，需要配合其他漏洞。图片木马中包含了恶意代码。

5.完全防御

DVWA/File Upload/Impossible 。

源代码

<?php
if( isset( $_POST[ 'Upload' ] ) ) {
// Check Anti-CSRF token
checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
// File information
$uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
$uploaded_ext = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1);
$uploaded_size = $_FILES[ 'uploaded' ][ 'size' ];
$uploaded_type = $_FILES[ 'uploaded' ][ 'type' ];
$uploaded_tmp = $_FILES[ 'uploaded' ][ 'tmp_name' ];
// Where are we going to be writing to?
$target_path = DVWA_WEB_PAGE_TO_ROOT . 'hackable/uploads/';
//$target_file = basename( $uploaded_name, '.' . $uploaded_ext ) . '-';
$target_file = md5( uniqid() . $uploaded_name ) . '.' . $uploaded_ext;
$temp_file = ( ( ini_get( 'upload_tmp_dir' ) == '' ) ? ( sys_get_temp_dir() ) : ( ini_get(
'upload_tmp_dir' ) ) );
$temp_file .= DIRECTORY_SEPARATOR . md5( uniqid() . $uploaded_name ) . '.' . $uploaded_ext;
// Is it an image?
if( ( strtolower( $uploaded_ext ) == 'jpg' || strtolower( $uploaded_ext ) == 'jpeg' || strtolower(
$uploaded_ext ) == 'png' ) &&
( $uploaded_size < 100000 ) &&
( $uploaded_type == 'image/jpeg' || $uploaded_type == 'image/png' ) &&
getimagesize( $uploaded_tmp ) ) {
// Strip any metadata, by re-encoding image (Note, using php-Imagick is recommended over php-GD)
if( $uploaded_type == 'image/jpeg' ) {
$img = imagecreatefromjpeg( $uploaded_tmp );
imagejpeg( $img, $temp_file, 100);
}
else {
$img = imagecreatefrompng( $uploaded_tmp );
imagepng( $img, $temp_file, 9);
}
imagedestroy( $img );
// Can we move the file to the web root from the temp folder?
if( rename( $temp_file, ( getcwd() . DIRECTORY_SEPARATOR . $target_path . $target_file ) ) ) {
// Yes!
echo "<pre><a href='${target_path}${target_file}'>${target_file}</a> succesfully uploaded!</pre>";
}
else {
// No
echo '<pre>Your image was not uploaded.</pre>';
}
// Delete any temp files
if( file_exists( $temp_file ) )
unlink( $temp_file );
}
else {
// Invalid file
echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>';
}
}
// Generate Anti-CSRF token
generateSessionToken();
?>