专栏首页HACKWAYUpload-labs通关笔记(二)

Upload-labs通关笔记(二)

Upload-labs 是一个帮你总结所有类型的上传漏洞的靶场 项目地址:https://github.com/Tj1ngwe1/upload-labs

环境要求

若要自己亲自搭建环境,请按照以下配置环境,方可正常运行每个 Pass。

配置项

配置

描述

操作系统

Window or Linux

推荐使用 Windows,除了 Pass-19 必须在 linux 下,其余 Pass 都可以在 Windows 上运行

PHP 版本

推荐 5.2.17

其他版本可能会导致部分 Pass 无法突破

PHP 组件

php_gd2,php_exif

部分 Pass 依赖这两个组件

中间件

设置 Apache

以 moudel 方式连接

第六关

源码解读

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists($UPLOAD_ADDR)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA

        if (!in_array($file_ext, $deny_ext)) {
            if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {
                $img_path = $UPLOAD_ADDR . '/' . $file_name;
                $is_upload = true;
            }
        } else {
            $msg = '此文件不允许上传';
        }
    } else {
        $msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建!';
    }
}
  • PHP $_FILES 是一个预定义的数组,用来获取通过 POST 方法上传文件的相关信息。如果为单个文件上传,那么
_FILES 为二维数组;如果为多个文件上传,那么

_FILES 为三维数组

Array
(
    [userfile] => Array
    (
        [name] => Screen Shot 2016-05-12 at 18.13.24.png
        [type] => image/png
        [tmp_name] => /private/var/tmp/phplVHp3W
        [error] => 0
        [size] => 344925
    )
)
  • 是后缀名黑名单,少了这段代码
file_ext = trim(

file_ext); //首尾去空

bypass

可以进行空格绕过,直接抓包修改文件名,再文件名末尾添加空格,成功上传

  1. 直接可上传 php 文件成功

第七关

源码解读

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists($UPLOAD_ADDR)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空

        if (!in_array($file_ext, $deny_ext)) {
            if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {
                $img_path = $UPLOAD_ADDR . '/' . $file_name;
                $is_upload = true;
            }
        } else {
            $msg = '此文件不允许上传';
        }
    } else {
        $msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建!';
    }
}
  • 没有对后缀名进行去”.”处理,只是截取.后面的后缀名。利用windows特性,会自动去掉后缀名中最后的”.”,可在后缀名中加”.”绕过。少了代码 deldot(\file_name);//删除文件名末尾的点

bypass

查看源码还是黑名单没有对后缀名进行去.操作利用 Windows 特性会自动去掉后缀名中最后的.可在后缀名中加 . 绕过

第八关

源码解读

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists($UPLOAD_ADDR)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = trim($file_ext); //首尾去空

        if (!in_array($file_ext, $deny_ext)) {
            if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {
                $img_path = $UPLOAD_ADDR . '/' . $file_name;
                $is_upload = true;
            }
        } else {
            $msg = '此文件不允许上传';
        }
    } else {
        $msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建!';
    }
}
  • 逻辑大致是识别上传文件的类型 并查看是否是'.asp','.aspx','.php','.jsp'中的一个,否则不允许上传,少了代码 $file_ext = str_ireplace('::DATA', '', file_ext);//去除字符串

bypass

  • NTFS 文件系统包括对备用数据流的支持,主要包括提供与 Macintosh 文件系统中的文件的兼容性。备用数据流允许文件包含多个数据流。每个文件至少有一个数据流。在 Windows 中,此默认数据流称为:
DATA。上传.php::

DATA 绕过。(仅限 windows)

第九关

源码解读

 $is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists($UPLOAD_ADDR)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空

        if (!in_array($file_ext, $deny_ext)) {
            if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {
                $img_path = $UPLOAD_ADDR . '/' . $file_name;
                $is_upload = true;
            }
        } else {
            $msg = '此文件不允许上传';
        }
    } else {
        $msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建!';
    }
}
  • 查看源码,这里只过滤了一次,所以直接构造 .php. . 绕过

bypass

直接构造点加空格加点 .php. . 绕过

可通过https://localhost/upload-labs/upload/shell1.php访问mm

第十关

源码解读

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists($UPLOAD_ADDR)) {
        $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");

        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = str_ireplace($deny_ext,"", $file_name);
        if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $file_name)) {
            $img_path = $UPLOAD_ADDR . '/' .$file_name;
            $is_upload = true;
        }
    } else {
        $msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建!';
    }
}
  • file_name = str_ireplace($deny_ext,"", file_name)将符合后缀名进行替换

bypass

1.双写绕过

本文分享自微信公众号 - HACKWAY(gh_7a5a315cde00),作者:HACKWAY

原文出处及转载信息见文内详细说明,如有侵权,请联系 yunjia_community@tencent.com 删除。

原始发表时间:2020-04-16

本文参与腾讯云自媒体分享计划,欢迎正在阅读的你也加入,一起分享。

我来说两句

0 条评论
登录 后参与评论

相关文章

  • Upload-labs通关笔记(一)

    Upload-labs是一个帮你总结所有类型的上传漏洞的靶场 项目地址:https://github.com/c0ny1/upload-labs

    轩辕小子
  • Upload-labs通关笔记(三)

    轩辕小子
  • Upload-labs通关笔记(四)

    首先在burp中不断发送上传webshell的数据包,然后不断在浏览器中访问,发现通过竞争可以访问到。

    轩辕小子
  • Upload-labs 通关学习笔记

    使用障眼法,将PHP文件修改图像格式后直接上传;使用burp拦截该数据包,修改文件格式(后缀名)

    Mirror王宇阳
  • Upload-labs(1-15)详解

    想到这也就知道是绕过方法中的黑名单绕过了,上面的不让上传,想到了可以上传.php5的文件,除了这个还有.phtml.phps .pht 但是要想上传后能执行,要...

    ly0n
  • 目录穿越漏洞修复之后再利用

    前段时间看到安全狗海青实验室发的一篇关于压缩文件解压导致 getshell 的文章。其中一个漏洞是在 zzzcms1.73 版本。而这款 CMS 自己也算是审过...

    信安之路
  • 研究人员如何使用Shhgit搜索GitHub中的敏感数据

    Shhgit能够帮助广大研究人员以近乎实时的方式寻找GitHub(包括Gists)、GitLab和BitBucket提交代码中的敏感数据和敏感文件。实际上,在G...

    FB客服
  • Uploads-labs上传绕过(上)

    链接:https://pan.baidu.com/s/1lMRBVdQyFuKOgNlWPUoSSQ

    字节脉搏实验室
  • python3第七天(输入和输出)

    输出值的方式:1,表达式。2,print()函数。3,文件对象的write()函数

    py3study
  • 前端零基础入门:页面结构层HTML(2)

    达达前端

扫码关注云+社区

领取腾讯云代金券