moe图床

ytl_storm

已于 2023-10-17 19:53:16 修改

阅读量118

点赞数 1

分类专栏： MoeCTF 文章标签： web安全

于 2023-08-21 18:30:39 首次发布

本文链接：https://blog.csdn.net/ytl_storm/article/details/132414030

版权

MoeCTF 专栏收录该内容

3 篇文章 1 订阅

订阅专栏

考点

文件上传，php代码审计

题目

我们准备了一个moe图床用于上传一些图片

题解

先尝试上传一个文件，发现只让传png

查看源代码

<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8">
    <title>moe图床</title>
</head>
<body>
    <input type="file" id="fileInput">
    <button onclick="uploadFile()">上传</button>
    <div id="uploadResult"></div>
    <script>
        function uploadFile() {
            const fileInput = document.getElementById('fileInput');
            const file = fileInput.files[0];
            
            if (!file) {
                alert('请选择一个文件进行上传！');
                return;
            }
            
            const allowedExtensions = ['png'];
            const fileExtension = file.name.split('.').pop().toLowerCase();
            if (!allowedExtensions.includes(fileExtension)) {
                alert('只允许上传后缀名为png的文件！');
                return;
            }
            
            const formData = new FormData();
            formData.append('file', file);

            fetch('upload.php', {
                method: 'POST',
                body: formData
            })
            .then(response => response.json())
            .then(result => {
                if (result.success) {
                    const uploadResult = document.getElementById('uploadResult');
                    const para = document.createElement('p');
                    para.textContent = ('地址：');
                    const link = document.createElement('a');
                    link.textContent = result.file_path;
                    link.href = result.file_path;
                    link.target = '_blank';
                    para.append(link);
                    uploadResult.appendChild(para);

                    alert('文件上传成功！');
                } else {
                    alert('文件上传失败：' + result.message);
                }
            })
            .catch(error => {
                console.error('文件上传失败:', error);
            });
        }
    </script>
</body>
</html>

可以看到提到了upload.php

<?php
$targetDir = 'uploads/';
$allowedExtensions = ['png'];


if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['file'])) {
    $file = $_FILES['file'];
    $tmp_path = $_FILES['file']['tmp_name'];

    if ($file['type'] !== 'image/png') {
        die(json_encode(['success' => false, 'message' => '文件类型不符合要求']));
    }

    if (filesize($tmp_path) > 512 * 1024) {
        die(json_encode(['success' => false, 'message' => '文件太大']));
    }

    $fileName = $file['name'];
    $fileNameParts = explode('.', $fileName);

    if (count($fileNameParts) >= 2) {
        $secondSegment = $fileNameParts[1];
        if ($secondSegment !== 'png') {
            die(json_encode(['success' => false, 'message' => '文件后缀不符合要求']));
        }
    } else {
        die(json_encode(['success' => false, 'message' => '文件后缀不符合要求']));
    }

    $uploadFilePath = dirname(__FILE__) . '/' . $targetDir . basename($file['name']);

    if (move_uploaded_file($tmp_path, $uploadFilePath)) {
        die(json_encode(['success' => true, 'file_path' => $uploadFilePath]));
    } else {
        die(json_encode(['success' => false, 'message' => '文件上传失败']));
    }
}
else{
    highlight_file(__FILE__);
}
?>

找到最关键的代码

$fileName = $file['name'];
    $fileNameParts = explode('.', $fileName);

    if (count($fileNameParts) >= 2) {
        $secondSegment = $fileNameParts[1];
        if ($secondSegment !== 'png') {
            die(json_encode(['success' => false, 'message' => '文件后缀不符合要求']));
        }
    } else {
        die(json_encode(['success' => false, 'message' => '文件后缀不符合要求']));
    }

将文件名根据"."分割，其中第二部分需要为png

故将文件后缀改为.png.php