文件上传（Upload Labs）通关指南

最新推荐文章于 2024-06-18 10:18:51 发布

Gundam-

最新推荐文章于 2024-06-18 10:18:51 发布

阅读量1.6k

点赞数 3

分类专栏：学习文章标签：渗透测试文件上传

本文链接：https://blog.csdn.net/weixin_45146120/article/details/103462910

版权

学习专栏收录该内容

37 篇文章 2 订阅

订阅专栏

0x1 Pass 1 前端过滤

打开burpSuite，上传一个php探针，发现上传之后Burp并没有抓到包，推断是前端过滤

禁用JavaScript

在这里插入图片描述

Burp拦截请求

修改文件名为info.png，绕过前端过滤之后，在burp中修改文件后缀名

在这里插入图片描述

0x2 Pass 2 Content-Type验证

禁用JavaScript修改Content-Type绕过

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        if (($_FILES['upload_file']['type'] == 'image/jpeg') || ($_FILES['upload_file']['type'] == 'image/png') || ($_FILES['upload_file']['type'] == 'image/gif')) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH . '/' . $_FILES['upload_file']['name']            
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '文件类型不正确，请重新上传！';
        }
    } else {
        $msg = UPLOAD_PATH.'文件夹不存在,请手工创建！';
    }
}

$_FILES['upload_file']['type'] == 'image/jpeg'对传来的FILE文件的Content-type进行验证，当在前端禁止了js之后，上传info.php Content-Type 为 application/octet-stream，修改Content-Type为允许的图片类型，则绕过Content- Type验证

在这里插入图片描述

修改文件后缀名

修改文件后缀名为合法后缀名之后，通过burp抓包可以看到,Content-Type为 image/png（文件后缀为.png），此时在burp中修改文件后缀为.php

在这里插入图片描述

0x3 Pass 3 黑名单策略

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array('.asp','.aspx','.php','.jsp');
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //收尾去空

        if(!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;            
            if (move_uploaded_file($temp_file,$img_path)) {
                 $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '不允许上传.asp,.aspx,.php,.jsp后缀文件！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

strrchr 函数： 查找字符串从右面开始的第一次出现的位置
str_ireplace 函数 替换字符串中的一些字符（不区分大小写）

分析：

针对windows删除::$DATA，文件末尾的点，以及末尾的空格；但是基于黑名单策略，可以上传除黑名单以外，web服务器可以解析的文件

Apache解析漏洞

Apache 在解析文件时有一个规则 : 当碰到不认识的扩展名时 , 将会从后向前解析 , 直到碰到认识的扩展名位置 , 如果都不认识 , 则会暴露其源码，如：1.php.rar.xx.aa，Apache 首先会解析 aa 扩展名 , 如果不认识则接着解析 xx 扩展名 , 这样一直遍历到认识的扩展名为止 , 然后再将其进行解析

apache的解析漏洞无法使用，因为使用的strrchr函数，从文件的右边开始找到第一个.之后的后缀名作为存储在服务器的后缀，所以多个点无法使用被正确保留在文件名中

Apache扩展解析

Apache新增扩展解析文件后缀如phtml,php1,php2,php3等绕过黑名单

AddType application/x-httpd-php .php .phtml .php1 .php2 .php3

在这里插入图片描述

在这里插入图片描述
访问该文件http://192.168.124.21/upload/201912031554277736.php1

双写::$DATA绕过黑名单

str_ireplace 函数漏洞

str_ireplace函数只会替换一次，针对windows系统，可以使用双写的方法保留::$DATA，从而绕过黑名单策略

在这里插入图片描述

直接访问http://192.168.124.21/upload/201912031502162017.php即可

0x4 Pass 4 黑名单策略(过滤Apache可解析的常用扩展名如phtml, php1等)

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2","php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2","pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //收尾去空

        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件不允许上传!';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

黑名单过滤了大部分Apache可以解析的文件后缀，但是过滤之后没有重命名文件，那么可以上传.htaccess文件

在这里插入图片描述

当设置了 AllowOverride All 那么 upload-labs-master录下所有项目都能读取到.htaccess文件，当.htaccess文件内容如下，则可以将用户上传的任意文本，只要包含php代码，即解析成php

SetHandler application/x-httpd-php

上传`.htaccess`文件

在这里插入图片描述

上传任意文件，文件中包含php代码

在这里插入图片描述

文件末尾添加.空格.绕过

在这里插入图片描述

0x5 黑名单策略(.htaccess过滤)

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
   if (file_exists(UPLOAD_PATH)) {
       $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
       $file_name = trim($_FILES['upload_file']['name']);
       $file_name = deldot($file_name);//删除文件名末尾的点
       $file_ext = strrchr($file_name, '.');
       $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
       $file_ext = trim($file_ext); //首尾去空

       if (!in_array($file_ext, $deny_ext)) {
           $temp_file = $_FILES['upload_file']['tmp_name'];
           $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
           if (move_uploaded_file($temp_file, $img_path)) {
               $is_upload = true;
           } else {
               $msg = '上传出错！';
           }
       } else {
           $msg = '此文件类型不允许上传！';
       }
   } else {
       $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
   }
}

大小写绕过

查看代码可知，并未对文件后缀进行大小写转换，可以使用大小写交替上传至服务器

双写::$DATA绕过

在这里插入图片描述

0x6 黑名单策略（文件后缀未过滤改空格）

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = $_FILES['upload_file']['name'];
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file,$img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件不允许上传';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

文化后缀添加空格

在这里插入图片描述

双写::$DATA 绕过

在这里插入图片描述

0x7 黑名单策略(未过滤.)

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

文件后缀后+ `.`

在这里插入图片描述

0x8 黑名单策略（未过滤::$DATA）

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

文件后缀添加::$DATA绕过

在这里插入图片描述

0x9 黑名单策略(未修改文件名)

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

对上传的文件名后缀提取判断是否为黑名单里的文件名，如果不是，则将上传的文件名保存在服务器中

利用strrchr($file_name, '.')函数特性，从字符串中的右边开始找到第一个.，返回.及其之后的字符串

对提取出来的后缀做判断，不存在黑名单中则将改文件上传至服务器,针对此特性，配合windows特性.,空格会在文件保存的时候自动去掉，所以构造文件名为info.php. .

在这里插入图片描述

0x10 黑名单策略（删除黑名单中的文件后缀名）

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");

        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = str_ireplace($deny_ext,"", $file_name);
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = UPLOAD_PATH.'/'.$file_name;        
        if (move_uploaded_file($temp_file, $img_path)) {
            $is_upload = true;
        } else {
            $msg = '上传出错！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

str_ireplace函数会将黑名单中的不合法后缀删除为"",因为只匹配一次，可以采用双写绕过

双写绕过

在这里插入图片描述

0x11 白名单策略（文件上传路径可控）

白名单与黑名单策略最大的区别就在于白名单只允许列表里的文件类型上传成功，黑名单则是不允许列表里的上传，黑名单是永远包纳不完的，所以白名单策略是更为安全的一种方式

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    $ext_arr = array('jpg','png','gif');
    $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
    if(in_array($file_ext,$ext_arr)){
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = $_GET['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;

        if(move_uploaded_file($temp_file,$img_path)){
            $is_upload = true;
        } else {
            $msg = '上传出错！';
        }
    } else{
        $msg = "只允许上传.jpg|.png|.gif类型文件！";
    }
}

可以看到$img_path则是上传的路径，该路径从save_path中获取，然后再将文件重命名

get型0x00截断绕过

0x00 截断原理

0x00是十六进制表示方法，是ascii码为0的字符，在有些函数处理时，会把这个字符当做结束符。这个可以用在对文件类型名的绕过

php 0x00截断的条件

php版本< 5.3.4
magic_quotes_gpc = off

在这里插入图片描述

%00被当做结束符，后面的数据其实就已经被截断了，服务器保存的则是info.php这个文件名

在这里插入图片描述

0x12 白名单策略(文件上传路径可控)

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    $ext_arr = array('jpg','png','gif');
    $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
    if(in_array($file_ext,$ext_arr)){
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = $_POST['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;

        if(move_uploaded_file($temp_file,$img_path)){
            $is_upload = true;
        } else {
            $msg = "上传失败";
        }
    } else {
        $msg = "只允许上传.jpg|.png|.gif类型文件！";
    }
}

由于 save_path是通过post传进来的，还是利用00截断，但这次需要在二进制中进行修改，因为post不会像get对%00进行自动解码

post型0x00 截断

在这里插入图片描述

0x13 文件头绕过

function getReailFileType($filename){
   $file = fopen($filename, "rb");
   $bin = fread($file, 2); //只读2字节
   fclose($file);
   $strInfo = @unpack("C2chars", $bin);    
   $typeCode = intval($strInfo['chars1'].$strInfo['chars2']);    
   $fileType = '';    
   switch($typeCode){      
       case 255216:            
           $fileType = 'jpg';
           break;
       case 13780:            
           $fileType = 'png';
           break;        
       case 7173:            
           $fileType = 'gif';
           break;
       default:            
           $fileType = 'unknown';
       }    
       return $fileType;
}

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
   $temp_file = $_FILES['upload_file']['tmp_name'];
   $file_type = getReailFileType($temp_file);

   if($file_type == 'unknown'){
       $msg = "文件未知，上传失败！";
   }else{
       $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").".".$file_type;
       if(move_uploaded_file($temp_file,$img_path)){
           $is_upload = true;
       } else {
           $msg = "上传出错！";
       }
   }
}

读取文件2字节，即读取文件的文件头，所以此类型为文件头绕过

添加文件头绕过

添加两个字节的文件头，png

89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52

在这里插入图片描述

gif在文见内容上添加如下字段

GIF89a

在这里插入图片描述

0x14 getimagesize() 检查绕过

function isImage($filename){
    $types = '.jpeg|.png|.gif';
    if(file_exists($filename)){
        $info = getimagesize($filename);
        $ext = image_type_to_extension($info[2]);
        if(stripos($types,$ext)>=0){
            return $ext;
        }else{
            return false;
        }
    }else{
        return false;
    }
}

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $res = isImage($temp_file);
    if(!$res){
        $msg = "文件未知，上传失败！";
    }else{
        $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").$res;
        if(move_uploaded_file($temp_file,$img_path)){
            $is_upload = true;
        } else {
            $msg = "上传出错！";
        }
    }
}

getimagesize() 函数将测定任何 GIF，JPG，PNG，SWF，SWC，PSD，TIFF，BMP，IFF，JP2，JPX，JB2，JPC，XBM 或 WBMP 图像文件的大小并返回图像的尺寸以及文件类型及图片高度与宽度，所以上传的文件不能只是包含文件头那么简单，所以采用图片马技术绕过

图片马技术绕过

copy hack.jpg/b + info.php hack.jpg

合成的图片马如下

在这里插入图片描述

修改文件头绕过

在这里插入图片描述

0x15 exif_imagetype()验证

exif_imagetype() 读取一个图像的第一个字节并检查其签名。

function isImage($filename){
    //需要开启php_exif模块
    $image_type = exif_imagetype($filename);
    switch ($image_type) {
        case IMAGETYPE_GIF:
            return "gif";
            break;
        case IMAGETYPE_JPEG:
            return "jpg";
            break;
        case IMAGETYPE_PNG:
            return "png";
            break;    
        default:
            return false;
            break;
    }
}

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $res = isImage($temp_file);
    if(!$res){
        $msg = "文件未知，上传失败！";
    }else{
        $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").".".$res;
        if(move_uploaded_file($temp_file,$img_path)){
            $is_upload = true;
        } else {
            $msg = "上传出错！";
        }
    }
}

图片马技术

上传图片马绕过验证，因为图片马其实就是一张将shell融合在图片里的图片

修改文件头

在这里插入图片描述

0x16 二次渲染

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])){
    // 获得上传文件的基本信息，文件名，类型，大小，临时文件路径
    $filename = $_FILES['upload_file']['name'];
    $filetype = $_FILES['upload_file']['type'];
    $tmpname = $_FILES['upload_file']['tmp_name'];

    $target_path=UPLOAD_PATH.'/'.basename($filename);

    // 获得上传文件的扩展名
    $fileext= substr(strrchr($filename,"."),1);

    //判断文件后缀与类型，合法才进行上传操作
    if(($fileext == "jpg") && ($filetype=="image/jpeg")){
        if(move_uploaded_file($tmpname,$target_path)){
            //使用上传的图片生成新的图片
            $im = imagecreatefromjpeg($target_path);

            if($im == false){
                $msg = "该文件不是jpg格式的图片！";
                @unlink($target_path);
            }else{
                //给新图片指定文件名
                srand(time());
                $newfilename = strval(rand()).".jpg";
                //显示二次渲染后的图片（使用用户上传图片生成的新图片）
                $img_path = UPLOAD_PATH.'/'.$newfilename;
                imagejpeg($im,$img_path);
                @unlink($target_path);
                $is_upload = true;
            }
        } else {
            $msg = "上传出错！";
        }

    }else if(($fileext == "png") && ($filetype=="image/png")){
        if(move_uploaded_file($tmpname,$target_path)){
            //使用上传的图片生成新的图片
            $im = imagecreatefrompng($target_path);

            if($im == false){
                $msg = "该文件不是png格式的图片！";
                @unlink($target_path);
            }else{
                 //给新图片指定文件名
                srand(time());
                $newfilename = strval(rand()).".png";
                //显示二次渲染后的图片（使用用户上传图片生成的新图片）
                $img_path = UPLOAD_PATH.'/'.$newfilename;
                imagepng($im,$img_path);

                @unlink($target_path);
                $is_upload = true;               
            }
        } else {
            $msg = "上传出错！";
        }

    }else if(($fileext == "gif") && ($filetype=="image/gif")){
        if(move_uploaded_file($tmpname,$target_path)){
            //使用上传的图片生成新的图片
            $im = imagecreatefromgif($target_path);
            if($im == false){
                $msg = "该文件不是gif格式的图片！";
                @unlink($target_path);
            }else{
                //给新图片指定文件名
                srand(time());
                $newfilename = strval(rand()).".gif";
                //显示二次渲染后的图片（使用用户上传图片生成的新图片）
                $img_path = UPLOAD_PATH.'/'.$newfilename;
                imagegif($im,$img_path);

                @unlink($target_path);
                $is_upload = true;
            }
        } else {
            $msg = "上传出错！";
        }
    }else{
        $msg = "只允许上传后缀为.jpg|.png|.gif的图片文件！";
    }
}

gif 绕过

上传gif文件，访问该gif包含的php代码没有，将其download下来，利用cmp命令比较两者的不同

在这里插入图片描述

关于绕过gif的二次渲染,只需要找到渲染前后没有变化的位置,然后将php代码写进去,就可以成功上传带有php代码的图片了. 在6-781字节处是未变化的，所以在6-781字节处用winhex写入

在这里插入图片描述

最后将其上传访问该gif

在这里插入图片描述

0x17 条件竞争

$is_upload = false;
$msg = null;

if(isset($_POST['submit'])){
    $ext_arr = array('jpg','png','gif');
    $file_name = $_FILES['upload_file']['name'];
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $file_ext = substr($file_name,strrpos($file_name,".")+1);
    $upload_file = UPLOAD_PATH . '/' . $file_name;

    if(move_uploaded_file($temp_file, $upload_file)){
        if(in_array($file_ext,$ext_arr)){
             $img_path = UPLOAD_PATH . '/'. rand(10, 99).date("YmdHis").".".$file_ext;
             rename($upload_file, $img_path);
             $is_upload = true;
        }else{
            $msg = "只允许上传.jpg|.png|.gif类型文件！";
            unlink($upload_file);
        }
    }else{
        $msg = '上传出错！';
    }
}

条件竞争绕过

在这里插入图片描述

上传的脚本为

<?php
$myfile = fopen("../upload/hello.php", "w") or die("Unable to open file!");
$txt = "<?php phpinfo() ?>\n";
fwrite($myfile, $txt);
fclose($myfile);
?>

当burp中的Intruder开始攻击的时候，在浏览器中访问/upload/info.php,当访问的页面不为404等，就可以直接访问/upload/hello.php因为条件竞争中，是在文件删除之前访问，无法得到稳定的shell，所以上传的脚本中使用I/O操作，写入脚本从而持久化控制

在这里插入图片描述

0x18 条件竞争+Apache 解析漏洞

//index.php
$is_upload = false;
$msg = null;
if (isset($_POST['submit']))
{
    require_once("./myupload.php");
    $imgFileName =time();
    $u = new MyUpload($_FILES['upload_file']['name'], $_FILES['upload_file']['tmp_name'], $_FILES['upload_file']['size'],$imgFileName);
    $status_code = $u->upload(UPLOAD_PATH);
    switch ($status_code) {
        case 1:
            $is_upload = true;
            $img_path = $u->cls_upload_dir . $u->cls_file_rename_to;
            break;
        case 2:
            $msg = '文件已经被上传，但没有重命名。';
            break; 
        case -1:
            $msg = '这个文件不能上传到服务器的临时文件存储目录。';
            break; 
        case -2:
            $msg = '上传失败，上传目录不可写。';
            break; 
        case -3:
            $msg = '上传失败，无法上传该类型文件。';
            break; 
        case -4:
            $msg = '上传失败，上传的文件过大。';
            break; 
        case -5:
            $msg = '上传失败，服务器已经存在相同名称文件。';
            break; 
        case -6:
            $msg = '文件无法上传，文件不能复制到目标目录。';
            break;      
        default:
            $msg = '未知错误！';
            break;
    }
}

//myupload.php
class MyUpload{
......
......
...... 
  var $cls_arr_ext_accepted = array(
      ".doc", ".xls", ".txt", ".pdf", ".gif", ".jpg", ".zip", ".rar", ".7z",".ppt",
      ".html", ".xml", ".tiff", ".jpeg", ".png" );

......
......
......  
  /** upload()
   **
   ** Method to upload the file.
   ** This is the only method to call outside the class.
   ** @para String name of directory we upload to
   ** @returns void
  **/
  function upload( $dir ){
    
    $ret = $this->isUploadedFile();
    
    if( $ret != 1 ){
      return $this->resultUpload( $ret );
    }

    $ret = $this->setDir( $dir );
    if( $ret != 1 ){
      return $this->resultUpload( $ret );
    }

    $ret = $this->checkExtension();
    if( $ret != 1 ){
      return $this->resultUpload( $ret );
    }

    $ret = $this->checkSize();
    if( $ret != 1 ){
      return $this->resultUpload( $ret );    
    }
    
    // if flag to check if the file exists is set to 1
    
    if( $this->cls_file_exists == 1 ){
      
      $ret = $this->checkFileExists();
      if( $ret != 1 ){
        return $this->resultUpload( $ret );    
      }
    }

    // if we are here, we are ready to move the file to destination

    $ret = $this->move();
    if( $ret != 1 ){
      return $this->resultUpload( $ret );    
    }

    // check if we need to rename the file

    if( $this->cls_rename_file == 1 ){
      $ret = $this->renameFile();
      if( $ret != 1 ){
        return $this->resultUpload( $ret );    
      }
    }
    
    // if we are here, everything worked as planned :)

    return $this->resultUpload( "SUCCESS" );
  
  }
......
......
...... 
};

Apache 解析漏洞

分析代码白名单策略，只允许 “.doc”, “.xls”, “.txt”, “.pdf”, “.gif”, “.jpg”, “.zip”, “.rar”, “.7z”,".ppt",".html", “.xml”, “.tiff”, “.jpeg”, “.png” 上传，则可以使用条件竞争当服务器来不及更改名字，则可以上传成功诸如info.php.7z之类的文件，再利用Apache的解析漏洞直接访问改文件，当从右至左解析，7z无法成功解析，就直接解析php脚本

在这里插入图片描述

0x19 CVE-2015-2348

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");

        $file_name = $_POST['save_name'];
        $file_ext = pathinfo($file_name,PATHINFO_EXTENSION);

        if(!in_array($file_ext,$deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH . '/' .$file_name;
            if (move_uploaded_file($temp_file, $img_path)) { 
                $is_upload = true;
            }else{
                $msg = '上传出错！';
            }
        }else{
            $msg = '禁止保存为该类型文件！';
        }

    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

00 截断

修改save_name的参数其后加上00同 pass 11
在这里插入图片描述

0x20 upload in CTF(数组绕过)

$is_upload = false;
$msg = null;
if(!empty($_FILES['upload_file'])){
    //检查MIME
    $allow_type = array('image/jpeg','image/png','image/gif');
    if(!in_array($_FILES['upload_file']['type'],$allow_type)){
        $msg = "禁止上传该类型文件!";
    }else{
        //检查文件名
        $file = empty($_POST['save_name']) ? $_FILES['upload_file']['name'] : $_POST['save_name'];
        if (!is_array($file)) {
            $file = explode('.', strtolower($file));
        }

        $ext = end($file);
        $allow_suffix = array('jpg','png','gif');
        if (!in_array($ext, $allow_suffix)) {
            $msg = "禁止上传该后缀文件!";
        }else{
            $file_name = reset($file) . '.' . $file[count($file) - 1];
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH . '/' .$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $msg = "文件上传成功！";
                $is_upload = true;
            } else {
                $msg = "文件上传失败！";
            }
        }
    }
}else{
    $msg = "请选择要上传的文件！";
}

通过源码可以发现:

$file_name 经过`reset($ file).’.’. $f i l e p [c o u n t ($ file)-1]`处理

如果上传的是数组，则会跳过$file = explode('.', strtolower($file));

后缀白名单过滤

$ext = end($file);
$allow_suffix = array('jpg','png','gif');

最终的文件后缀名取的是$file[count($file) - 1]，因此可以让$file为数组，此时设置$file[0]为upload-20.php/也就是reset($file),然后再令$file[2]为白名单中的jpg,end($file)等于jpg，$file(count($file)-1)为空

而reset($file).'.'.$filep[count($file)-1] 也就是upload-20.php/，最终move_uploaded_file会忽略/上传为upload-20.php

在这里插入图片描述

Gundam-

关注

3
点赞
踩
7

收藏

觉得还不错? 一键收藏
0
评论
文件上传（Upload Labs）通关指南

0x1 Pass 1 前端过滤打开burpSuite，上传一个php探针，发现上传之后Burp并没有抓到包，推断是前端过滤禁用JavaScriptBurp拦截请求修改文件名为info.png，绕过前端过滤之后，在burp中修改文件后缀名0x2 Pass 2 Content-Type验证禁用JavaScript修改Content-Type绕过$is_upload = false...
复制链接

扫一扫