upload-labs-pass-08-14

Pass-08 后缀名末尾加点绕过$is_upload false; $msg null; if (isset($_POST[submit])) { if (file_exists(UPLOAD_PATH)) { $deny_ext array(.php,.php5,.php4,.php3,.php2,.html,.htm,.phtml,.pht,.pHp,.pHp5,.pHp4,.pHp3,.pHp2,.Html,.Htm,.pHtml,.jsp,.jspa,.jspx,.jsw,.jsv,.jspf,.jtml,.jSp,.jSpx,.jSpa,.jSw,.jSv,.jSpf,.jHtml,.asp,.aspx,.asa,.asax,.ascx,.ashx,.asmx,.cer,.aSp,.aSpx,.aSa,.aSax,.aScx,.aShx,.aSmx,.cEr,.sWf,.swf,.htaccess,.ini); $file_name trim($_FILES[upload_file][name]); $file_ext strrchr($file_name, .); $file_ext strtolower($file_ext); //转换为小写 $file_ext str_ireplace(::$DATA, , $file_ext);//去除字符串::$DATA $file_ext trim($file_ext); //首尾去空 if (!in_array($file_ext, $deny_ext)) { $temp_file $_FILES[upload_file][tmp_name]; $img_path UPLOAD_PATH./.$file_name; if (move_uploaded_file($temp_file, $img_path)) { $is_upload true; } else { $msg 上传出错; } } else { $msg 此文件类型不允许上传; } } else { $msg UPLOAD_PATH . 文件夹不存在,请手工创建; } }这一关没有删除文件名末尾的点访问8.php. 出现空白上传webshell成功Pass-09 Windows ::$DATA 绕过$is_upload false; $msg null; if (isset($_POST[submit])) { if (file_exists(UPLOAD_PATH)) { $deny_ext array(.php,.php5,.php4,.php3,.php2,.html,.htm,.phtml,.pht,.pHp,.pHp5,.pHp4,.pHp3,.pHp2,.Html,.Htm,.pHtml,.jsp,.jspa,.jspx,.jsw,.jsv,.jspf,.jtml,.jSp,.jSpx,.jSpa,.jSw,.jSv,.jSpf,.jHtml,.asp,.aspx,.asa,.asax,.ascx,.ashx,.asmx,.cer,.aSp,.aSpx,.aSa,.aSax,.aScx,.aShx,.aSmx,.cEr,.sWf,.swf,.htaccess,.ini); $file_name trim($_FILES[upload_file][name]); $file_name deldot($file_name);//删除文件名末尾的点 $file_ext strrchr($file_name, .); $file_ext strtolower($file_ext); //转换为小写 $file_ext trim($file_ext); //首尾去空 if (!in_array($file_ext, $deny_ext)) { $temp_file $_FILES[upload_file][tmp_name]; $img_path UPLOAD_PATH./.date(YmdHis).rand(1000,9999).$file_ext; if (move_uploaded_file($temp_file, $img_path)) { $is_upload true; } else { $msg 上传出错; } } else { $msg 此文件类型不允许上传; } } else { $msg UPLOAD_PATH . 文件夹不存在,请手工创建; } }这一关没有去除字符串::$DATA访问http://upload:8012/upload/202608171824215102.phpPass-10 点空格点 绕过deldot 只删一次$is_upload false; $msg null; if (isset($_POST[submit])) { if (file_exists(UPLOAD_PATH)) { $deny_ext array(.php,.php5,.php4,.php3,.php2,.html,.htm,.phtml,.pht,.pHp,.pHp5,.pHp4,.pHp3,.pHp2,.Html,.Htm,.pHtml,.jsp,.jspa,.jspx,.jsw,.jsv,.jspf,.jtml,.jSp,.jSpx,.jSpa,.jSw,.jSv,.jSpf,.jHtml,.asp,.aspx,.asa,.asax,.ascx,.ashx,.asmx,.cer,.aSp,.aSpx,.aSa,.aSax,.aScx,.aShx,.aSmx,.cEr,.sWf,.swf,.htaccess,.ini); $file_name trim($_FILES[upload_file][name]); $file_name deldot($file_name);//删除文件名末尾的点 $file_ext strrchr($file_name, .); $file_ext strtolower($file_ext); //转换为小写 $file_ext str_ireplace(::$DATA, , $file_ext);//去除字符串::$DATA $file_ext trim($file_ext); //首尾去空 if (!in_array($file_ext, $deny_ext)) { $temp_file $_FILES[upload_file][tmp_name]; $img_path UPLOAD_PATH./.$file_name; if (move_uploaded_file($temp_file, $img_path)) { $is_upload true; } else { $msg 上传出错; } } else { $msg 此文件类型不允许上传; } } else { $msg UPLOAD_PATH . 文件夹不存在,请手工创建; } }源码中删除点和空格只删除了一次我们使用点空格点进行绕过出现空白上传成功Pass-11 双写后缀绕过str_ireplace 替换为空$is_upload false; $msg null; if (isset($_POST[submit])) { if (file_exists(UPLOAD_PATH)) { $deny_ext array(php,php5,php4,php3,php2,html,htm,phtml,pht,jsp,jspa,jspx,jsw,jsv,jspf,jtml,asp,aspx,asa,asax,ascx,ashx,asmx,cer,swf,htaccess,ini); $file_name trim($_FILES[upload_file][name]); $file_name str_ireplace($deny_ext,, $file_name); $temp_file $_FILES[upload_file][tmp_name]; $img_path UPLOAD_PATH./.$file_name; if (move_uploaded_file($temp_file, $img_path)) { $is_upload true; } else { $msg 上传出错; } } else { $msg UPLOAD_PATH . 文件夹不存在,请手工创建; } }这一关的漏洞点在$file_name str_ireplace($deny_ext,, $file_name);使用str_ireplace()不区分大小写把黑名单后缀字符串替换为空字符串。所以这一关可以使用双写php进行绕过例如写成pphphp将黑名单后缀替换为空字符串之后pphphp就会变成php了出现空白上传成功Pass-12 %00 截断绕过GET$is_upload false; $msg null; if(isset($_POST[submit])){ $ext_arr array(jpg,png,gif); $file_ext substr($_FILES[upload_file][name],strrpos($_FILES[upload_file][name],.)1); if(in_array($file_ext,$ext_arr)){ $temp_file $_FILES[upload_file][tmp_name]; $img_path $_GET[save_path]./.rand(10, 99).date(YmdHis)...$file_ext; if(move_uploaded_file($temp_file,$img_path)){ $is_upload true; } else { $msg 上传出错; } } else{ $msg 只允许上传.jpg|.png|.gif类型文件; } }本关卡可以使用%00截断绕过更改magic_quotes_gpc配置D:\software\phpstudy\phpstudy_pro\Extensions\php\php5.2.17nts这个目录下的php.ini文件中更改PHP 5.2.x 版本默认开启magic_quotes_gpc该配置会自动转义 GET/POST/COOKIE 中的特殊字符空字节%00会被转义为字面量\0反斜杠 数字 0不再是空字节无法触发截断。POST /Pass-12/index.php?save_path../upload/12.php%00 HTTP/1.1访问此路径http://upload:8012/upload/12.php 出现空白上传webshell成功Pass-13 %00 截断绕过POST第十三关和第十二关是差不多的只不过是接受值变成了post,她两的差别呢就是get会自行解码post不会自行解码我们需要对%00进行编码,选中%00右键按下图操作来编码好我们就可以上传了访问此路径http://upload:8012/upload/13.php 出现空白上传webshell成功Pass-14 图片马 文件包含漏洞制作图片马在图片码的末端加一行一句话木马或者在终端执行命令copy /b cat.jpg shell.php shell.jpg # Windows 正常图片 木马文件 输出文件任务里面说明了这关是有一个文件包含漏洞的就是include.php我们直接利用这个文件包含漏洞连接一下蚁剑测试到成功上传webshell