文件上传漏洞- upload- labs

我习惯这个地方称为代码部分漏洞。（如果不对请各位师傅指出）
代码漏洞产生的原因：由于代码对我们上传文件的信息过滤不严格，我们就可以对文件上传部分进行漏洞的注入

基础要求
php代码审计基础
javascript基础
upload-labs漏洞环境搭建
burp 使用

未完成部分：二次渲染 条件竞争 （ 利用文件夹命名漏洞）

将代码部分漏洞做一个分类
一、前段代码漏洞：js过滤漏洞
题目：labs-1
绕过方式：2种方式进行绕过（有总结）
二、后端代码漏洞：
一、黑名单部分
1、特殊解析后缀
2、.htaccess解析
3、大小写绕过
4、点绕过
5、空格绕过
6、::$DATA绕过
7、配合解析漏洞
8、双后缀名绕过

二、白名单部分
1、mime信息绕过
2、%00截断
3、0x00截断
4、0x0a截断

其他部分：文件头检测。二次渲染。条件竞争。突破getimagesize。突破exif_imagesize。

1、mime信息绕过 labs-2
$is_upload = false;
$msg=null;if(isset($_POST[‘submit’])) {
if (file_exists(UPLOAD_PATH)) {
//就是这个${}_{F}ILES函数将信息进行过滤if(($_FILES[‘upload_file’][‘type’] == ‘image/jpeg’) || (${}_{F}ILES{[}^{\prime }uploa{d}_{f}il{e}^{\prime }]{[}^{\prime }typ{e}^{\prime }]={=}^{\prime }image/pn{g}^{\prime })||($_FILES[‘upload_file’][‘type’] == ‘image/gif’)) {
$temp_file = $_FILES[‘upload_file’][‘tmp_name’];
$img_path = UPLOAD_PATH . ‘/’ . ${}_{F}ILES{[}^{\prime }uploa{d}_{f}il{e}^{\prime }]{[}^{\prime }nam{e}^{\prime }]if(mov{e}_{u}ploade{d}_{f}ile($temp_file, $img_path)) {
$is_upload = true;
} else {
$msg = ‘上传出错！’;
}
} else {
$msg = ‘文件类型不正确，请重新上传！’;
}
} else {
$msg = UPLOAD_PATH.‘文件夹不存在,请手工创建！’;
}
}

了解一下$_FILES函数的知识
$_FILES数组内容如下:
$_FILES[‘myFile’][‘name’] 客户端文件的原名称。
$_FILES[‘myFile’][‘type’] 文件的 MIME 类型，需要浏览器提供该信息的支持，例如"image/gif"。
$_FILES[‘myFile’][‘size’] 已上传文件的大小，单位为字节。
$_FILES[‘myFile’][‘tmp_name’] 文件被上传后在服务端储存的临时文件名，一般是系统默认。可以在php.ini的upload_tmp_dir 指定，但 用 putenv() 函数设置是不起作用的。
$_FILES[‘myFile’][‘error’] 和该文件上传相关的错误代码。[‘error’] 是在 PHP 4.2.0 版本中增加的。下面是它的说明：(它们在PHP3.0以后成了常量)

我们用burp包抓一下，修改一下mime 直接进行绕过
原：
改：

2、labs-03 特殊解析后缀绕过

源代码
$is_upload = false;
$msg=null;if(isset($_POST[‘submit’])) {
if (file_exists(UPLOAD_PATH)) {
$deny_ext = array(’.asp’,’.aspx’,’.php’,’.jsp’);
//对后缀名进行了过滤
$fil{e}_{n}ame=trim($_FILES[‘upload_file’][‘name’]);
$fil{e}_{n}ame=deldot($file_name);//删除文件名末尾的点
$fil{e}_{e}xt=strrchr($file_name, ‘.’);
$fil{e}_{e}xt=strtolower($file_ext); //转换为小写
$fil{e}_{e}xt=st{r}_{i}replace{(}^{\prime }::$DATA’, ‘’, $fil{e}_{e}xt);//去除字符串::$DATA
$fil{e}_{e}xt=trim($file_ext); //收尾去空

    if(!in_array($file_ext, $deny_ext)) {
        $temp_file = $_FILES['upload_file']['tmp_name'];
        //对我们的文件名进行重命名处理
        $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;            
        if (move_uploaded_file($temp_file,$img_path)) {
             $is_upload = true;
        } else {
            $msg = '上传出错！';
        }
    } else {
        $msg = '不允许上传.asp,.aspx,.php,.jsp后缀文件！';
    }
} else {
    $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
}

}

这里的后缀名过滤的不完全 所以可以用特殊后缀名进行代替：php5、php3等等

特殊后缀名：

这里接个文章：https://blog.csdn.net/weixin_43571641/article/details/83755712
让我们知道为什么apache 不能解析 php5

这里文件已经上传成功但是为什么打开，明天来解释一下。

3、labs-04 .htaccess上传漏洞

.htaccess是apache服务器中的一个配置文件,不是上传的文件的黑名单之内 ,所以.htaccess文件是可以上传成功。

使用条件：apache才能使用
.htaccess解释：https://blog.csdn.net/whatiwhere/article/details/84453810（文章里对。htaccess 有详细的解释）

$is_upload = false;
$msg=null;if(isset($_POST[‘submit’])) {
if (file_exists(UPLOAD_PATH)) {
//黑名单内容更加丰富
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".ini");
$fil{e}_{n}ame=trim($_FILES[‘upload_file’][‘name’]);
$fil{e}_{n}ame=deldot($file_name);//删除文件名末尾的点
$fil{e}_{e}xt=strrchr($file_name, ‘.’);
$fil{e}_{e}xt=strtolower($file_ext); //转换为小写
$fil{e}_{e}xt=st{r}_{i}replace{(}^{\prime }::$DATA’, ‘’, $fil{e}_{e}xt);//去除字符串::$DATA
$fil{e}_{e}xt=trim($file_ext); //收尾去空

怎么使用.htaccess
AddType application/x-httpd-php .jpg（可修改） 将这句话复制到文本中以后缀名 .htaccess方式保存 进行文件上传
然后上传我们的 php文件。 在burp中将一句话文件attack.php后缀名改为 .png

上传成功到服务器的.htaccess文件里的代码可以让 .jpg后缀名文件格式的文件名以 php格式解析 所以我们把yijuhua.php文件的后缀名改为.jpg格式,让.htaccess文件解析 yijuhua.jpg文件里的php代码 ,使木马上传成功。

5、labs-05 黑名单——也是.htaccess 绕过
代码：$is_upload = false;
$msg=null;if(isset($_POST[‘submit’])) {
if (file_exists(UPLOAD_PATH)) {
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
$fil{e}_{n}ame=trim($_FILES[‘upload_file’][‘name’]);
$fil{e}_{n}ame=deldot($file_name);//删除文件名末尾的点
$fil{e}_{e}xt=strrchr($file_name, ‘.’);
$fil{e}_{e}xt=strtolower($file_ext); //转换为小写
$fil{e}_{e}xt=st{r}_{i}replace{(}^{\prime }::$DATA’, ‘’, $fil{e}_{e}xt);//去除字符串::$DATA
$fil{e}_{e}xt=trim($file_ext); //首尾去空
与labs-04进行对比代码部分一致 做法相同

6、labs-06 黑名单 大小写绕过
$is_upload = false;
$msg=null;if(isset($_POST[‘submit’])) {
if (file_exists(UPLOAD_PATH)) {
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
$fil{e}_{n}ame=trim($_FILES[‘upload_file’][‘name’]);
$fil{e}_{n}ame=deldot($file_name);//删除文件名末尾的点
$fil{e}_{e}xt=strrchr($file_name, ‘.’);
$fil{e}_{e}xt=st{r}_{i}replace{(}^{\prime }::$DATA’, ‘’, $fil{e}_{e}xt);//去除字符串::$DATA
$fil{e}_{e}xt=trim($file_ext); //首尾去空

与labs-04对比发现少了转换小写代码
直接进行大小写替换绕过
在burp里修改一句话文件 attack.php 的后缀名 .phP
上传发现问题 在访问图片地址是会弹出500（明天解决）

7、labs-07 点绕过
题目代码：
$is_upload = false;
$msg=null;if(isset($_POST[‘submit’])) {
if (file_exists(UPLOAD_PATH)) {
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
$file_name = $_FILES[‘upload_file’][‘name’];
$fil{e}_{n}ame=deldot($file_name);//删除文件名末尾的点
$fil{e}_{e}xt=strrchr($file_name, ‘.’);
$fil{e}_{e}xt=strtolower($file_ext); //转换为小写
$fil{e}_{e}xt=st{r}_{i}replace{(}^{\prime }::$DATA’, ‘’, $fil{e}_{e}xt);//去除字符串::$DATA
少了一行收尾去空代码
$fil{e}_{e}xt=trim($file_ext); //首尾去空
用burp抓到数据后
在php 后面加一个空格

原理：利用系统对文件判断的漏洞进行注入 举例：我们在创建txt文件时 是不能在文件类型末尾加上空格的，就算加上空格 系统也会将文件判断为 txt

8、labs-08 这里与我们.htaccess绕过方式相识 （看看还有没有其他的绕过方式）
还有另外一个注意的地方： $fil{e}_{n}ame=deldot($file_name);//删除文件名末尾的点 缺失
代码：
if (isset($_POST[‘submit’])) {
if (file_exists(UPLOAD_PATH)) {
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
$fil{e}_{n}ame=trim($_FILES[‘upload_file’][‘name’]);
$fil{e}_{e}xt=strrchr($file_name, ‘.’);
$fil{e}_{e}xt=strtolower($file_ext); //转换为小写
$fil{e}_{e}xt=st{r}_{i}replace{(}^{\prime }::$DATA’, ‘’, $fil{e}_{e}xt);//去除字符串::$DATA
$fil{e}_{e}xt=trim($file_ext); //首尾去空

    if (!in_array($file_ext, $deny_ext)) {
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = UPLOAD_PATH.'/'.$file_name;
        if (move_uploaded_file($temp_file, $img_path)) {
            $is_upload = true;
        } else {
            $msg = '上传出错！';
        }
    } else {
        $msg = '此文件类型不允许上传！';
    }
} else {
    $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
}

}

利用点的缺失

9、labs-09 ::$DATA绕过if(isset($_POST[‘submit’])) {
if (file_exists(UPLOAD_PATH)) {
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
$fil{e}_{n}ame=trim($_FILES[‘upload_file’][‘name’]);
$fil{e}_{e}xt=strrchr($file_name, ‘.’);
$fil{e}_{e}xt=strtolower($file_ext); //转换为小写
$fil{e}_{e}xt=trim($file_ext); //首尾去空
if (!in_array($file_ext, $deny_ext)) {
$temp_file = $_FILES[‘upload_file’][‘tmp_name’];
$im{g}_{p}ath=UPLOA{D}_{P}ATH{.}^{\prime }{/}^{\prime }.date("YmdHis").rand(1000,9999).$file_ext;
if (move_uploaded_file($temp_file, $img_path)) {
$is_upload = true;
} else {
$msg = ‘上传出错！’;
}
} else {
$msg = ‘此文件类型不允许上传！’;
}
} else {
KaTeX parse error: Expected 'EOF', got '}' at position 42: …在,请手工创建！'; }̲ } 缺失 ::DATA 去除字符串

借助文章理解：https://blog.csdn.net/weixin_44032232/article/details/109005766
原理：Windows文件流特性绕过
使用方式：

10、labs-10

$is_upload = false;
$msg=null;if(isset($_POST[‘submit’])) {
if (file_exists(UPLOAD_PATH)) {
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
$fil{e}_{n}ame=trim($_FILES[‘upload_file’][‘name’]);//移除字符串两侧的字符
$fil{e}_{n}ame=deldot($file_name);//删除文件名末尾的点
$fil{e}_{e}xt=strrchr($file_name, ‘.’);//查找点 在文件名中最后一次出现的位置，并返回从该位置到字符串结尾的所有字符
$fil{e}_{e}xt=strtolower($file_ext); //转换为小写
$fil{e}_{e}xt=st{r}_{i}replace{(}^{\prime }::$DATA’, ‘’, $fil{e}_{e}xt);//去除字符串::$DATA
$fil{e}_{e}xt=trim($file_ext); //首尾去空

    if (!in_array($file_ext, $deny_ext)) {
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = UPLOAD_PATH.'/'.$file_name;
        if (move_uploaded_file($temp_file, $img_path)) {
            $is_upload = true;
        } else {
            $msg = '上传出错！';
        }
    } else {
        $msg = '此文件类型不允许上传！';
    }
} else {
    $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
}

}

代码分析： $temp_file = ${}_{F}ILES{[}^{\prime }uploa{d}_{f}il{e}^{\prime }]{[}^{\prime }tm{p}_{n}am{e}^{\prime }];上传命名拼接的是.$file_name; 不是 $file_ext
$fil{e}_{n}ame=deldot($file_name);//删除文件名末尾的点
$fil{e}_{e}xt=strrchr($file_name, ‘.’)
有 $im{g}_{p}ath=UPLOA{D}_{P}ATH{.}^{\prime }{/}^{\prime }.$file_name 这里上传命名之后拼接的是 .$fil{e}_{n}ame不是.$file_ext; //上传的是原文件名

结合windows和其他操作系统的特性 我们依次绕过一下这几种过滤

绕过方式：xxx.php. .（中间有空格）
11、labs-11 双写绕过
代码：
is_upload = false;
$msg=null;if(isset($_POST[‘submit’])) {
if (file_exists(UPLOAD_PATH)) {
$deny_ext = array(“php”,“php5”,“php4”,“php3”,“php2”,“html”,“htm”,“phtml”,“pht”,“jsp”,“jspa”,“jspx”,“jsw”,“jsv”,“jspf”,“jtml”,“asp”,“aspx”,“asa”,“asax”,“ascx”,“ashx”,“asmx”,“cer”,“swf”,“htaccess”,“ini”);

    $file_name = trim($_FILES['upload_file']['name']);
    $file_name = str_ireplace($deny_ext,"", $file_name);
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $img_path = UPLOAD_PATH.'/'.$file_name;        
    if (move_uploaded_file($temp_file, $img_path)) {
        $is_upload = true;
    } else {
        $msg = '上传出错！';
    }
} else {
    $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
}

}
php代码分析：
trim() 函数移除字符串两侧的空白字符或其他预定义字符。
str_ireplace() 函数替换字符串中的一些字符（不区分大小写）。

$fil{e}_{n}ame=st{r}_{i}replace($deny_ext,"", $file_name); 将黑名单里的内容替换成空

这里将我们过滤文件名替换成空格 但是过滤值做了一次 （如果做一个递归的循环来判断是否有php等文件 那就直接jj）

白名单
12、白名单 %00绕过

%00绕过的使用条件：（1）php版本必须小于5.3.4
（2）打开php的配置文件php-ini，将magic_quotes_gpc设置为Off
$is_upload = false;
$msg=null;if(isset($_POST[‘submit’])){
$ext_arr = array(‘jpg’,‘png’,‘gif’);
$fil{e}_{e}xt=substr($_FILES[‘upload_file’][‘name’],strrpos(${}_{F}ILES{[}^{\prime }uploa{d}_{f}il{e}^{\prime }]{[}^{\prime }nam{e}^{\prime }],".")+1);if(i{n}_{a}rray($file_ext,$ext_arr)){
$temp_file = $_FILES[‘upload_file’][‘tmp_name’];
$img_path = ${}_{G}ET{[}^{\prime }sav{e}_{p}at{h}^{\prime }]."/".rand(10,99).date("YmdHis").".".$file_ext;

    if(move_uploaded_file($temp_file,$img_path)){
        $is_upload = true;
    } else {
        $msg = '上传出错！';
    }
} else{
    $msg = "只允许上传.jpg|.png|.gif类型文件！";
}

}

文章参考：https://www.cnblogs.com/tac2664/p/14293043.html

代码分析： $img_path = ${}_{G}ET{[}^{\prime }sav{e}_{p}at{h}^{\prime }]."/".rand(10,99).date("YmdHis").".".$file_ext;
解读：get方式提取save_path地址 + 随机时间戳 +文件后缀名

这里 就可以直接 用在save_path 里进行绕过

这里 地址变成：save_path=…/upload/attack.php%00截断

我上传之后显示上传错误，也就是文件上传是成功的但是在某个部分出问题
把php魔术引号关闭了

13、post提交方式+%00绕过

$is_upload = false;
$msg=null;if(isset($_POST[‘submit’])){
$ext_arr = array(‘jpg’,‘png’,‘gif’);
$fil{e}_{e}xt=substr($_FILES[‘upload_file’][‘name’],strrpos(${}_{F}ILES{[}^{\prime }uploa{d}_{f}il{e}^{\prime }]{[}^{\prime }nam{e}^{\prime }],".")+1);if(i{n}_{a}rray($file_ext,$ext_arr)){
$temp_file = $_FILES[‘upload_file’][‘tmp_name’];
$img_path = ${}_{P}OST{[}^{\prime }sav{e}_{p}at{h}^{\prime }]."/".rand(10,99).date("YmdHis").".".$file_ext;

    if(move_uploaded_file($temp_file,$img_path)){
        $is_upload = true;
    } else {
        $msg = "上传失败";
    }
} else {
    $msg = "只允许上传.jpg|.png|.gif类型文件！";
}

}
$img_path = ${}_{P}OST{[}^{\prime }sav{e}_{p}at{h}^{\prime }]."/".rand(10,99).date("YmdHis").".".$file_ext;
这里我们的提交方式改变了 上一个题是get方式提交

解释get与post有什么不同
在get中已经对%00进行编译
在post中 不能对%00进行编译 我们就得自己添加

文件上传成功

14.图片马

15.突破getimagesize
getimagesize函数是干什么的：php中规定getimagesize是获取图片信息

16、

17、

pass-18 分析代码。二次渲染：先将文件上传到服务器，服务器再选择保存或删除。
这里只是一个代码问题， 在文件移动之前没有对文件进行过滤处理

条件竞争：利用的是系统的占用。配合逻辑上的问题

这一关卡的逻辑出现了一些问题 ，在过滤之前就将 文件 移动到 服务器中
重命名的函数

条件竞争资源占用的问题

那我们怎么解决：

二次渲染可能不会出现漏洞，漏洞是因为代码的写法有问题

pass-18 分析代码。
用burp不断发包 intruder 不断发包功能 字典设置为number
设置一个不断变化的数据包：x-for。。。。
pyloads
然后通过浏览器不断访问webshell的地址

pass-19 分析代码。
1、利用文件名绕过（本题 是黑名单绕过）。利用%00截断
2、利用文件夹的名称绕过。将我们的文件上传 利用文件夹形式
upload/upload-18.php/.

pass-20 分析代码
利用文件夹绕过加数组问题进行绕过