upload(pass01~pass09)

我会带着你远行 2022-09-12 13:56 187阅读 0赞

### 文章目录 ###

*  Pass-01
 *  Pass-02
 *  Pass-03
 *  Pass-04（未解决）
 *  Pass-05（失败）
 *   *  自己的一些尝试：
     *  后续：
 *  Pass-06
 *  Pass-07
 *  Pass-08
 *  Pass-09

# Pass-01 #

先查看提示：  
![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16]  
在客户端使用JS对图片进行检查然后上传。  
解决方法：在客户端向服务端发送请求时抓包，对包进行修改，然后发送给服务端。  
使用burp进行抓包，抓包内容如下：  
![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 1]  
把一个php文件的后缀改成jpg上传，在抓包时把filename的参数重新更换为`1.php`，然后放包。  
![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 2]

返回之后，在控制台可以看到，上传的就是我们的php文件，点击过去就能访问。

# Pass-02 #

看提示：`本pass在服务端对数据包的MIME进行检查!`  
查看源码可以知道，他支持的MIME类型只有：  
1. image/jpeg  
2. image/png  
3. image/gif  
解决方法：我们可以上传一个php文件，在抓包之后，对文件MIME进行修改就可以。  
![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 3]  
将圈起来的部分更换为`image/png`，然后放包即可。  
![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 4]  
可以看到上传成功。

# Pass-03 #

查看提示：`本pass禁止上传.asp|.aspx|.php|.jsp后缀文件！`  
光从提示上无法明白是从什么地方去进行防护的，再查看一下源码：

$is_upload = false;
    $msg = null;
    if (isset($_POST['submit'])) { 
        if (file_exists(UPLOAD_PATH)) { 
            $deny_ext = array('.asp','.aspx','.php','.jsp');
            $file_name = trim($_FILES['upload_file']['name']);
            $file_name = deldot($file_name);//删除文件名末尾的点
            $file_ext = strrchr($file_name, '.');
            $file_ext = strtolower($file_ext); //转换为小写
            $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
            $file_ext = trim($file_ext); //收尾去空
    
            if(!in_array($file_ext, $deny_ext)) { 
                $temp_file = $_FILES['upload_file']['tmp_name'];
                $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;            
                if (move_uploaded_file($temp_file,$img_path)) { 
                     $is_upload = true;
                } else { 
                    $msg = '上传出错！';
                }
            } else { 
                $msg = '不允许上传.asp,.aspx,.php,.jsp后缀文件！';
            }
        } else { 
            $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
        }
    }

可以看到这是一个黑名单进行防护，这个时候，我们可以把上传的php文件后缀名更改为`php3`活着`php5`去进行一个绕过。原因是因为php语言除了可以解析以php为后缀的文件，还可以解析php2，php3、php4、php5这些后缀的文件。

# Pass-04（未解决） #

查看提示：`本pass禁止上传 .php|.php5|.php4|.php3|.php2|php1|.html|.htm|.phtml|.pHp|.pHp5|.pHp4|.pHp3|.pHp2|pHp1|.Html|.Htm|.pHtml|.jsp|.jspa|.jspx|.jsw|.jsv|.jspf|.jtml|.jSp|.jSpx|.jSpa|.jSw|.jSv|.jSpf|.jHtml|.asp|.aspx|.asa|.asax|.ascx|.ashx|.asmx|.cer|.aSp|.aSpx|.aSa|.aSax|.aScx|.aShx|.aSmx|.cEr|.sWf|.swf后缀文件！`  
可以看到，他的黑名单防护是更加严谨了，不仅防止php2~php5，而且对大小写也进行了一个防范。  
这里我是使用`PHP study`中的apache进行的一个靶场搭建，这个时候我们可以正对apache去上传一个htaccess文件对jpg去做一个重新解析。

<FilesMatch "\.jpg">
      SetHandler application/x-httpd-php
    </FilesMatch>

这个文件是当文件后缀名为jpg的时候，会对其进行php解析。  
新建记事本写入，另存为，文件名为`.htaccess`，文件类型为所有文件。  
![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 5]  
然后先上传这个`.htaccess`文件，再去上传一个php脚本（重新修改文件名为`1.jpg`）

这个时候我去访问`http://localhost/upload-labs/upload/1.jpg`即我上传的jpg时，jpg依旧没有解析成php。  
原因是在Windows系统中，apache是默认不去执行.htaccess文件的，如果是在Linux系统中就没有问题了。

我们去修改一下apache的配置文件：  
![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 6]  
这个None改为All就行。  
重新执行可以访问。但是结果依旧是失败，无法访问，所有先放着，解决了再说。

# Pass-05（失败） #

查看提示：`上传目录存在php文件（readme.php）`  
基本是什么信息都没有  
查看源码：

$is_upload = false;
    $msg = null;
    if (isset($_POST['submit'])) { 
        if (file_exists(UPLOAD_PATH)) { 
            $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
            $file_name = trim($_FILES['upload_file']['name']);
            $file_name = deldot($file_name);//删除文件名末尾的点
            $file_ext = strrchr($file_name, '.');
            $file_ext = strtolower($file_ext); //转换为小写
            $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
            $file_ext = trim($file_ext); //首尾去空
            
            if (!in_array($file_ext, $deny_ext)) { 
                $temp_file = $_FILES['upload_file']['tmp_name'];
                $img_path = UPLOAD_PATH.'/'.$file_name;
                if (move_uploaded_file($temp_file, $img_path)) { 
                    $is_upload = true;
                } else { 
                    $msg = '上传出错！';
                }
            } else { 
                $msg = '此文件类型不允许上传！';
            }
        } else { 
            $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
        }
    }

做了一个黑名单，禁止了`htaccess`和常见的php，我在其他博客上看到是用大小写绕过，但是我的靶场是搭建在Windows系统上，Windows系统上对大小写不敏感，所以没有办法去进行绕过。

## 自己的一些尝试： ##

我们可以把文件后缀名加空格去绕过，例如`1.ph p`，结果是`ph p`无法访问，我想到可以抓包后通过修改hex编码去进行绕过。php的连接符是"."，hex编码是%2e，但是上传之后是一个`1.ph.p`的文件，我又尝试把文件名修改为：3.ph".“p，但是上传的依旧是"3.ph”。失败。

## 后续： ##

在我做到第十题的时候，感觉跟第五题一样，是提交一个`1.php. .`的文件就可以去访问`1.php.`了。这样可以通过

# Pass-06 #

$is_upload = false;
    $msg = null;
    if (isset($_POST['submit'])) { 
        if (file_exists(UPLOAD_PATH)) { 
            $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
            $file_name = trim($_FILES['upload_file']['name']);
            $file_name = deldot($file_name);//删除文件名末尾的点
            $file_ext = strrchr($file_name, '.');
            $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
            $file_ext = trim($file_ext); //首尾去空
    
            if (!in_array($file_ext, $deny_ext)) { 
                $temp_file = $_FILES['upload_file']['tmp_name'];
                $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
                if (move_uploaded_file($temp_file, $img_path)) { 
                    $is_upload = true;
                } else { 
                    $msg = '上传出错！';
                }
            } else { 
                $msg = '此文件类型不允许上传！';
            }
        } else { 
            $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
        }
    }

可以看到，他没有一个`$file_ext = strtolower($file_ext); //转换为小写`的函数，这代表我们可以去进行一个大小写绕过，上传一个`3.pHP`,即可去进行访问。

# Pass-07 #

$is_upload = false;
    $msg = null;
    if (isset($_POST['submit'])) { 
        if (file_exists(UPLOAD_PATH)) { 
            $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
            $file_name = $_FILES['upload_file']['name'];
            $file_name = deldot($file_name);//删除文件名末尾的点
            $file_ext = strrchr($file_name, '.');
            $file_ext = strtolower($file_ext); //转换为小写
            $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
            
            if (!in_array($file_ext, $deny_ext)) { 
                $temp_file = $_FILES['upload_file']['tmp_name'];
                $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
                if (move_uploaded_file($temp_file,$img_path)) { 
                    $is_upload = true;
                } else { 
                    $msg = '上传出错！';
                }
            } else { 
                $msg = '此文件不允许上传';
            }
        } else { 
            $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
        }
    }

可以看到，少了一个首尾去空的函数`trim($file_ext)`我们可以发包的时候在后缀名后加空格，如图：  
![在这里插入图片描述][e018c87b495a4943907db7bec19c7332.png]  
然后就可以访问了。

# Pass-08 #

查看提示：`本pass禁止上传所有可以解析的后缀！`  
查看源码：

$is_upload = false;
    $msg = null;
    if (isset($_POST['submit'])) { 
        if (file_exists(UPLOAD_PATH)) { 
            $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
            $file_name = trim($_FILES['upload_file']['name']);
            $file_ext = strrchr($file_name, '.');
            $file_ext = strtolower($file_ext); //转换为小写
            $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
            $file_ext = trim($file_ext); //首尾去空
            
            if (!in_array($file_ext, $deny_ext)) { 
                $temp_file = $_FILES['upload_file']['tmp_name'];
                $img_path = UPLOAD_PATH.'/'.$file_name;
                if (move_uploaded_file($temp_file, $img_path)) { 
                    $is_upload = true;
                } else { 
                    $msg = '上传出错！';
                }
            } else { 
                $msg = '此文件类型不允许上传！';
            }
        } else { 
            $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
        }
    }

相比之前的，少了一个`$file_name = deldot($file_name);`我们可以在上传文件的时候，在文件名后加一个点。如图：  
![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 7]  
然后可以正常访问上传的php

# Pass-09 #

$is_upload = false;
    $msg = null;
    if (isset($_POST['submit'])) { 
        if (file_exists(UPLOAD_PATH)) { 
            $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
            $file_name = trim($_FILES['upload_file']['name']);
            $file_name = deldot($file_name);//删除文件名末尾的点
            $file_ext = strrchr($file_name, '.');
            $file_ext = strtolower($file_ext); //转换为小写
            $file_ext = trim($file_ext); //首尾去空
            
            if (!in_array($file_ext, $deny_ext)) { 
                $temp_file = $_FILES['upload_file']['tmp_name'];
                $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
                if (move_uploaded_file($temp_file, $img_path)) { 
                    $is_upload = true;
                } else { 
                    $msg = '上传出错！';
                }
            } else { 
                $msg = '此文件类型不允许上传！';
            }
        } else { 
            $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
        }
    }

对比发现，少了`$file_ext = str_ireplace('::$DATA', '', $file_ext);`我们可以进行文件名加::$DATA绕过。  
![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 8]

然后我们去访问返回成功的地址即可，但是访问的时候要去掉`::$DATA`  
![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 9]

[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16]: /images/20220828/c0fd534eb623473fa808e81a13741fe9.png
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 1]: /images/20220828/b86d402e25dc4bb093a594d492ec67db.png
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 2]: /images/20220828/5209304b6489450ba71f1e0ce605334a.png
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 3]: /images/20220828/c5d4fde8c5e84a0ea3ee9f1667cfec7a.png
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 4]: /images/20220828/664dd13790244138897635c64a03147c.png
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 5]: /images/20220828/fc8d0b24b8304b1198ffa211628c9264.png
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 6]: /images/20220828/75cd53252cab4b9183673e0a01685406.png
[e018c87b495a4943907db7bec19c7332.png]: /images/20220828/62e21a1351a04732871821c63e04cec9.png
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 7]: /images/20220828/773f19dd4c7d4efe9e8b674b4ed88d8e.png
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 8]: /images/20220828/1ceb7a078a8c4dd18b96d14f8e46a586.png
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 9]: /images/20220828/95b61e8d559748a4836142ae697a68bf.png