Pass-08

1.源码分析

    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空

发现没有对点进行过滤，在 windows 中文件后缀名. 系统会自动忽略.所以 shell.php. 像 shell.php 的效果一
样。所以可以在文件名后面加上.绕过。

1.2 分析上面得到的拓展名

<?php
if (isset($_GET['id'])){

	$str = $_GET['id'];
	$str = strrchr($str, '.');
	$str = strtolower($str); //转换为小写
	$str = str_ireplace('::$DATA', '', $str);//去除字符串::$DATA
	$str = trim($str); //首尾去空

	echo $str;
}
?>

可以发现没有过滤点，最终得到的扩展名是.，不在黑名单里，所以可以绕过黑名单

2. 上传

访问链接，代码也可以正常执行