• Upload-labs（1-21关详细教程）【简单易懂】【万字教程】

    目录

    思维导图

    练习网站：

    注意：

    知识点

    Pass-01

    代码：

    提示：

    解题思路：

    Pass-02

    知识点：

    代码：

    提示： 

    解题思路：

    Pass-03(本关需要使用自己搭建upload-labs)

    代码：

    提示：

    解题思路：

    Pass-04

    代码：

    提示：

    解题思路：

    Pass-05(建议使用本机搭建的Upload-labs)

    代码：

    提示：

    解题思路：

    先上传.user.ini

    再上传phpinfo.jpg

    查看readme.php文件

    Pass-06

    代码：

    提示：

    解题思路：

    Pass-07

    代码：

    提示：

    解题思路：

    Pass-08

    代码：

    提示：

    解题思路：

    Pass-09

    代码：

    提示：

    解题思路：

    Pass-10 

    代码：

     提示：

    解题思路：

    Pass-11

    代码：

    提示：

    解题思路：

    Pass-12

    代码：

     提示：

    解题思路：

    Pass-13

    代码：

    提示：

    解题思路：

    Pass-14

    代码：

    提示： 

    解题思路：

    Pass-15-17

    代码：

    提示：

    解题思路：

    Pass-18

    代码：

    提示：

    解题思路：

    Pass-19

    代码：

    提示：

    解题思路：

    Pass-20

    代码：

    提示：

    Pass-21

    代码：

    提示：

    解题思路：

    思维导图

    思维导图分享

    链接：https://pan.baidu.com/s/1N4mvnQhawhYKRHNwJDEAMw 
    提取码：iu9g 

    练习网站：

    upload-labs(旧靶场20关)1-2关使用了旧靶场

    upload-labs(新靶场21关)3-21关使用了新靶场

    ​

    注意：

    能运行phpinfo();?>

    就能运行一句话木马

    本文使用主要是为了简便

    知识点

    $_FILES[表单提交过来的name]

    [name]:获取到的文件名

    [type]: 获取到的文件类型(MIMETYPE)

    [tmp_name]:文件临时存放的路径

    [error]: 上传文件报错信息(为空则上传成功)

    [size]:上传文件的大小

    Move_uploaded_file(需要移动的文件,要移动到的位置)

    Strrchr(指定字符串,匹配的字符) --指针指到指定的字符的位置，取之后的值

    Trim() --去除字符串中的前后空格

    Rtrim() --去除右空格

    Ltrim() --去除左空格

    Strtolower() --将字符串转为小写

    Str_ireplace --(被转换的字符串，替换成的字符串，需要查找的字符串)

    在需要查找的字符串中查找需要被替换的字符串，替换为指定的字符串

    Pass-01

    代码：

    1. function checkFile() {
    2.     var file = document.getElementsByName('upload_file')[0].value;
    3.     if (file == null || file == "") {
    4.         alert("请选择要上传的文件!");
    5.         return false;
    6.     }
    7.     //定义允许上传的文件类型
    8.     var allow_ext = ".jpg|.png|.gif";
    9.     //提取上传文件的类型
    10.     var ext_name = file.substring(file.lastIndexOf("."));
    11.     //判断上传文件类型是否允许上传
    12.     if (allow_ext.indexOf(ext_name + "|") == -1) {
    13.         var errMsg = "该文件不允许上传，请上传" + allow_ext + "类型的文件,当前文件类型为：" + ext_name;
    14.         alert(errMsg);
    15.         return false;
    16.     }
    17. }

    提示：

    本pass在客户端使用js对不合法图片进行检查！

    解题思路：

    安装插件disable javascript

    ​

    编写一句话木马文件shell.php

    ​

    根据提示关闭js上传文件，查看上传文件是否成功

    ​

    使用蚁剑通过密码连接

    ​

    ​

    Pass-02

    知识点：

    MIME TYPE常见分类

    ​

    代码：

    1. $is_upload = false;
    2. $msg = null;
    3. if (isset($_POST['submit'])) {
    4.     if (file_exists(UPLOAD_PATH)) {
    5.         if (($_FILES['upload_file']['type'] == 'image/jpeg') || ($_FILES['upload_file']['type'] == 'image/png') || ($_FILES['upload_file']['type'] == 'image/gif')) {
    6.             $temp_file = $_FILES['upload_file']['tmp_name'];
    7.             $img_path = UPLOAD_PATH . '/' . $_FILES['upload_file']['name']            
    8.             if (move_uploaded_file($temp_file, $img_path)) {
    9.                 $is_upload = true;
    10.             } else {
    11.                 $msg = '上传出错！';
    12.             }
    13.         } else {
    14.             $msg = '文件类型不正确，请重新上传！';
    15.         }
    16.     } else {
    17.         $msg = UPLOAD_PATH.'文件夹不存在,请手工创建！';
    18.     }
    19. }

    提示： 

    本pass在服务端对数据包的MIME进行检查！

    解题思路：

    编写木马

    ​

    上传PHP文件

    绕过MIMETYPE

    burpsuite抓包修改类型

    ​

    forward释放数据包

    ​

    打开图片链接

    ​

    发现能够执行上传的php文件

    ​

    Pass-03(本关需要使用自己搭建upload-labs)

    upload-labs资源

    链接：https://pan.baidu.com/s/1uOM7sSAFusLk-973SkZlCw 
    提取码：ctyl 

    代码：

    1. $is_upload = false;
    2. $msg = null;
    3. if (isset($_POST['submit'])) {
    4.     if (file_exists(UPLOAD_PATH)) {
    5.         $deny_ext = array('.asp','.aspx','.php','.jsp');
    6.         $file_name = trim($_FILES['upload_file']['name']);
    7.         $file_name = deldot($file_name);//删除文件名末尾的点
    8.         $file_ext = strrchr($file_name, '.');
    9.         $file_ext = strtolower($file_ext); //转换为小写
    10.         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
    11.         $file_ext = trim($file_ext); //收尾去空
    12.  
    13.         if(!in_array($file_ext, $deny_ext)) {
    14.             $temp_file = $_FILES['upload_file']['tmp_name'];
    15.             $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;            
    16.             if (move_uploaded_file($temp_file,$img_path)) {
    17.                  $is_upload = true;
    18.             } else {
    19.                 $msg = '上传出错！';
    20.             }
    21.         } else {
    22.             $msg = '不允许上传.asp,.aspx,.php,.jsp后缀文件！';
    23.         }
    24.     } else {
    25.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    26.     }
    27. }

    提示：

    本pass禁止上传.asp|.aspx|.php|.jsp后缀文件！

    解题思路：

    httpd.conf文件下添加代码

    AddType application/x-httpd-php .php .phtml .php3 .php4

    该句代码的意思是将.php、.php3、.php4当作php文件

    上传phpinfo.php4

    打开图片链接

    就能查看运行的PHP文件

    Pass-04

    代码：

    1. $is_upload = false;
    2. $msg = null;
    3. if (isset($_POST['submit'])) {
    4.     if (file_exists(UPLOAD_PATH)) {
    5.         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".ini");
    6.         $file_name = trim($_FILES['upload_file']['name']);
    7.         $file_name = deldot($file_name);//删除文件名末尾的点
    8.         $file_ext = strrchr($file_name, '.');
    9.         $file_ext = strtolower($file_ext); //转换为小写
    10.         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
    11.         $file_ext = trim($file_ext); //收尾去空
    12.  
    13.         if (!in_array($file_ext, $deny_ext)) {
    14.             $temp_file = $_FILES['upload_file']['tmp_name'];
    15.             $img_path = UPLOAD_PATH.'/'.$file_name;
    16.             if (move_uploaded_file($temp_file, $img_path)) {
    17.                 $is_upload = true;
    18.             } else {
    19.                 $msg = '上传出错！';
    20.             }
    21.         } else {
    22.             $msg = '此文件不允许上传!';
    23.         }
    24.     } else {
    25.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    26.     }
    27. }

    提示：

    本pass禁止上传.php|.php5|.php4|.php3|.php2|php1|.html|.htm|.phtml|.pHp|.pHp5|.pHp4|.pHp3|.pHp2|pHp1|.Html|.Htm|.pHtml|.jsp|.jspa|.jspx|.jsw|.jsv|.jspf|.jtml|.jSp|.jSpx|.jSpa|.jSw|.jSv|.jSpf|.jHtml|.asp|.aspx|.asa|.asax|.ascx|.ashx|.asmx|.cer|.aSp|.aSpx|.aSa|.aSax|.aScx|.aShx|.aSmx|.cEr|.sWf|.swf后缀文件！

    解题思路：

    上传.htaccess文件

    将jpg文件当作php文件执行

    1. <FilesMatch 'phpinfo.jpg'>
    2. SetHandler application/x-httpd-php
    3. </FilesMatch>

    再上传phpinfo.jpg(是由phpinfo.php改后缀成phpinfo.jpg)

    打开链接

    Pass-05(建议使用本机搭建的Upload-labs)

    upload-labs资源

    链接：https://pan.baidu.com/s/1uOM7sSAFusLk-973SkZlCw 
    提取码：ctyl 

    代码：

    1. $is_upload = false;
    2. $msg = null;
    3. if (isset($_POST['submit'])) {
    4.     if (file_exists(UPLOAD_PATH)) {
    5.         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
    6.         $file_name = trim($_FILES['upload_file']['name']);
    7.         $file_name = deldot($file_name);//删除文件名末尾的点
    8.         $file_ext = strrchr($file_name, '.');
    9.         $file_ext = strtolower($file_ext); //转换为小写
    10.         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
    11.         $file_ext = trim($file_ext); //首尾去空
    12.         
    13.         if (!in_array($file_ext, $deny_ext)) {
    14.             $temp_file = $_FILES['upload_file']['tmp_name'];
    15.             $img_path = UPLOAD_PATH.'/'.$file_name;
    16.             if (move_uploaded_file($temp_file, $img_path)) {
    17.                 $is_upload = true;
    18.             } else {
    19.                 $msg = '上传出错！';
    20.             }
    21.         } else {
    22.             $msg = '此文件类型不允许上传！';
    23.         }
    24.     } else {
    25.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    26.     }
    27. }

    提示：

    上传目录存在php文件(readme.php)

    解题思路：

    先上传.user.ini

    作用域是当前文件夹和当前文件夹中的子文件;包含指定的文件，显示在页面上

    .user.ini内容

    1. Auto_prepend_file=phpinfo.jpg //在页面上部显示
    2.  
    3. Auto_prepend_file=phpinfo.jpg //在页面底部部显示

    再上传phpinfo.jpg

    查看readme.php文件

    Pass-06

    代码：

    1. $is_upload = false;
    2. $msg = null;
    3. if (isset($_POST['submit'])) {
    4.     if (file_exists(UPLOAD_PATH)) {
    5.         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
    6.         $file_name = trim($_FILES['upload_file']['name']);
    7.         $file_name = deldot($file_name);//删除文件名末尾的点
    8.         $file_ext = strrchr($file_name, '.');
    9.         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
    10.         $file_ext = trim($file_ext); //首尾去空
    11.  
    12.         if (!in_array($file_ext, $deny_ext)) {
    13.             $temp_file = $_FILES['upload_file']['tmp_name'];
    14.             $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
    15.             if (move_uploaded_file($temp_file, $img_path)) {
    16.                 $is_upload = true;
    17.             } else {
    18.                 $msg = '上传出错！';
    19.             }
    20.         } else {
    21.             $msg = '此文件类型不允许上传！';
    22.         }
    23.     } else {
    24.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    25.     }
    26. }

    提示：

    本pass禁止上传.php|.php5|.php4|.php3|.php2|php1|.html|.htm|.phtml|.pHp|.pHp5|.pHp4|.pHp3|.pHp2|pHp1|.Html|.Htm|.pHtml|.jsp|.jspa|.jspx|.jsw|.jsv|.jspf|.jtml|.jSp|.jSpx|.jSpa|.jSw|.jSv|.jSpf|.jHtml|.asp|.aspx|.asa|.asax|.ascx|.ashx|.asmx|.cer|.aSp|.aSpx|.aSa|.aSax|.aScx|.aShx|.aSmx|.cEr|.sWf|.swf|.htaccess后缀文件！

    解题思路：

    经过与第五关对比我们发现没有过滤大小写

    缺少代码

    $file_ext = strtolower($file_ext); //转换为小写

    所以我们修改上传文件后缀名phpinfo.Php

    上传phpinfo.Php

    右键打开链接

    Pass-07

    代码：

    1. $is_upload = false;
    2. $msg = null;
    3. if (isset($_POST['submit'])) {
    4.     if (file_exists(UPLOAD_PATH)) {
    5.         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
    6.         $file_name = $_FILES['upload_file']['name'];
    7.         $file_name = deldot($file_name);//删除文件名末尾的点
    8.         $file_ext = strrchr($file_name, '.');
    9.         $file_ext = strtolower($file_ext); //转换为小写
    10.         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
    11.         
    12.         if (!in_array($file_ext, $deny_ext)) {
    13.             $temp_file = $_FILES['upload_file']['tmp_name'];
    14.             $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
    15.             if (move_uploaded_file($temp_file,$img_path)) {
    16.                 $is_upload = true;
    17.             } else {
    18.                 $msg = '上传出错！';
    19.             }
    20.         } else {
    21.             $msg = '此文件不允许上传';
    22.         }
    23.     } else {
    24.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    25.     }
    26. }

    提示：

    没有进行首尾去空

    缺少代码

    $file_ext = trim($file_ext); //首尾去空

    我们可以进行空格绕过

    解题思路：

    上传phpinfo.php进行BP抓包

    上传成功后右键打开链接

    Pass-08

    代码：

    1. $is_upload = false;
    2. $msg = null;
    3. if (isset($_POST['submit'])) {
    4.     if (file_exists(UPLOAD_PATH)) {
    5.         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
    6.         $file_name = trim($_FILES['upload_file']['name']);
    7.         $file_ext = strrchr($file_name, '.');
    8.         $file_ext = strtolower($file_ext); //转换为小写
    9.         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
    10.         $file_ext = trim($file_ext); //首尾去空
    11.         
    12.         if (!in_array($file_ext, $deny_ext)) {
    13.             $temp_file = $_FILES['upload_file']['tmp_name'];
    14.             $img_path = UPLOAD_PATH.'/'.$file_name;
    15.             if (move_uploaded_file($temp_file, $img_path)) {
    16.                 $is_upload = true;
    17.             } else {
    18.                 $msg = '上传出错！';
    19.             }
    20.         } else {
    21.             $msg = '此文件类型不允许上传！';
    22.         }
    23.     } else {
    24.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    25.     }
    26. }

    提示：

    缺少代码

    $file_name = deldot($file_name)

     没有删除文件名末尾后的点

    所以进行点绕过

    解题思路：

    上传phpinfo.php文件进行BP抓包

    上传成功后右键打开链接

    Pass-09

    代码：

    1. $is_upload = false;
    2. $msg = null;
    3. if (isset($_POST['submit'])) {
    4.     if (file_exists(UPLOAD_PATH)) {
    5.         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
    6.         $file_name = trim($_FILES['upload_file']['name']);
    7.         $file_name = deldot($file_name);//删除文件名末尾的点
    8.         $file_ext = strrchr($file_name, '.');
    9.         $file_ext = strtolower($file_ext); //转换为小写
    10.         $file_ext = trim($file_ext); //首尾去空
    11.         
    12.         if (!in_array($file_ext, $deny_ext)) {
    13.             $temp_file = $_FILES['upload_file']['tmp_name'];
    14.             $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
    15.             if (move_uploaded_file($temp_file, $img_path)) {
    16.                 $is_upload = true;
    17.             } else {
    18.                 $msg = '上传出错！';
    19.             }
    20.         } else {
    21.             $msg = '此文件类型不允许上传！';
    22.         }
    23.     } else {
    24.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    25.     }
    26. }

    提示：

    缺少代码

    $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA

    上传后缀名添加::$DATA

    ::$DATA是一个流传输,可以把后面的数据当成流处理和.空格类似

    解题思路：

    上传phpinfo.php进行BP抓包，修改数据

    右键打开链接

    去掉URL中的::$DATA

    Pass-10 

    代码：

    1. $is_upload = false;
    2. $msg = null;
    3. if (isset($_POST['submit'])) {
    4.     if (file_exists(UPLOAD_PATH)) {
    5.         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
    6.         $file_name = trim($_FILES['upload_file']['name']);
    7.         $file_name = deldot($file_name);//删除文件名末尾的点
    8.         $file_ext = strrchr($file_name, '.');
    9.         $file_ext = strtolower($file_ext); //转换为小写
    10.         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
    11.         $file_ext = trim($file_ext); //首尾去空
    12.         
    13.         if (!in_array($file_ext, $deny_ext)) {
    14.             $temp_file = $_FILES['upload_file']['tmp_name'];
    15.             $img_path = UPLOAD_PATH.'/'.$file_name;
    16.             if (move_uploaded_file($temp_file, $img_path)) {
    17.                 $is_upload = true;
    18.             } else {
    19.                 $msg = '上传出错！';
    20.             }
    21.         } else {
    22.             $msg = '此文件类型不允许上传！';
    23.         }
    24.     } else {
    25.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    26.     }
    27. }

     提示：

    deldot()函数从后向前检测，当检测到末尾的第一个点时会继续它的检测，但是遇到空格会停下来

    解题思路：

    上传phpinfo.php文件，BP抓包，修改数据

    上传完文件邮件打开链接

    Pass-11

    代码：

    1. $is_upload = false;
    2. $msg = null;
    3. if (isset($_POST['submit'])) {
    4.     if (file_exists(UPLOAD_PATH)) {
    5.         $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess","ini");
    6.  
    7.         $file_name = trim($_FILES['upload_file']['name']);
    8.         $file_name = str_ireplace($deny_ext,"", $file_name);
    9.         $temp_file = $_FILES['upload_file']['tmp_name'];
    10.         $img_path = UPLOAD_PATH.'/'.$file_name;        
    11.         if (move_uploaded_file($temp_file, $img_path)) {
    12.             $is_upload = true;
    13.         } else {
    14.             $msg = '上传出错！';
    15.         }
    16.     } else {
    17.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    18.     }
    19. }

    提示：

    截取文件后缀名与上面禁用的后缀名匹配，如果想同，转化为空

    所有利用双写后缀名绕过

    解题思路：

    上传phpinfo.pphphp文件

    上传成功后右键打开链接

    Pass-12

    代码：

    1. $is_upload = false;
    2. $msg = null;
    3. if(isset($_POST['submit'])){
    4.     $ext_arr = array('jpg','png','gif');
    5.     $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
    6.     if(in_array($file_ext,$ext_arr)){
    7.         $temp_file = $_FILES['upload_file']['tmp_name'];
    8.         $img_path = $_GET['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;
    9.  
    10.         if(move_uploaded_file($temp_file,$img_path)){
    11.             $is_upload = true;
    12.         } else {
    13.             $msg = '上传出错！';
    14.         }
    15.     } else{
    16.         $msg = "只允许上传.jpg|.png|.gif类型文件！";
    17.     }
    18. }

     提示：

    在处理数据时，当处理到00，就当作处理完成

    PHP版本小于5.3

    Magic_quotes_gpc=Off

    解题思路：

    上传phpinfo.jpg文件，用BP抓包修改数据

    上传成功后右键打开链接

    Pass-13

    代码：

    1. $is_upload = false;
    2. $msg = null;
    3. if(isset($_POST['submit'])){
    4.     $ext_arr = array('jpg','png','gif');
    5.     $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
    6.     if(in_array($file_ext,$ext_arr)){
    7.         $temp_file = $_FILES['upload_file']['tmp_name'];
    8.         $img_path = $_POST['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;
    9.  
    10.         if(move_uploaded_file($temp_file,$img_path)){
    11.             $is_upload = true;
    12.         } else {
    13.             $msg = "上传失败";
    14.         }
    15.     } else {
    16.         $msg = "只允许上传.jpg|.png|.gif类型文件！";
    17.     }
    18. }

    提示：

    在处理数据时，当处理到00，就当作处理完成

    PHP版本小于5.3

    Magic_quotes_gpc=Off

    解题思路：

    上传phpinfo.jpg文件，用BP抓包修改数据

    将空格(20)改成(00)进行截断

     上传成功后右键打开链接

    Pass-14

    代码：

    1. function getReailFileType($filename){
    2.     $file = fopen($filename, "rb");
    3.     $bin = fread($file, 2); //只读2字节
    4.     fclose($file);
    5.     $strInfo = @unpack("C2chars", $bin);    
    6.     $typeCode = intval($strInfo['chars1'].$strInfo['chars2']);    
    7.     $fileType = '';    
    8.     switch($typeCode){      
    9.         case 255216:            
    10.             $fileType = 'jpg';
    11.             break;
    12.         case 13780:            
    13.             $fileType = 'png';
    14.             break;        
    15.         case 7173:            
    16.             $fileType = 'gif';
    17.             break;
    18.         default:            
    19.             $fileType = 'unknown';
    20.         }    
    21.         return $fileType;
    22. }
    23.  
    24. $is_upload = false;
    25. $msg = null;
    26. if(isset($_POST['submit'])){
    27.     $temp_file = $_FILES['upload_file']['tmp_name'];
    28.     $file_type = getReailFileType($temp_file);
    29.  
    30.     if($file_type == 'unknown'){
    31.         $msg = "文件未知，上传失败！";
    32.     }else{
    33.         $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").".".$file_type;
    34.         if(move_uploaded_file($temp_file,$img_path)){
    35.             $is_upload = true;
    36.         } else {
    37.             $msg = "上传出错！";
    38.         }
    39.     }
    40. }

    提示： 

    Jpg格式图片的文件头标识：FFD8开头FFD9结尾

    Png格式图片的文件头标识：89 20 4E 47 0D 0A

    Gif格式图片的文件头标识：GIF89a GIF87a

    本关存在文件包含漏洞，Incould可以将被包含的文件当PHP代码执行

    解题思路：

    上传phpinfo.gif，BP抓包修改数据

    文件上传成功后右键打开链接

    Pass-15-17

    15-17关都可以利用文件包含漏洞，上传图片码

    代码：

    1. function isImage($filename){
    2.     $types = '.jpeg|.png|.gif';
    3.     if(file_exists($filename)){
    4.         $info = getimagesize($filename);
    5.         $ext = image_type_to_extension($info[2]);
    6.         if(stripos($types,$ext)>=0){
    7.             return $ext;
    8.         }else{
    9.             return false;
    10.         }
    11.     }else{
    12.         return false;
    13.     }
    14. }
    15.  
    16. $is_upload = false;
    17. $msg = null;
    18. if(isset($_POST['submit'])){
    19.     $temp_file = $_FILES['upload_file']['tmp_name'];
    20.     $res = isImage($temp_file);
    21.     if(!$res){
    22.         $msg = "文件未知，上传失败！";
    23.     }else{
    24.         $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").$res;
    25.         if(move_uploaded_file($temp_file,$img_path)){
    26.             $is_upload = true;
    27.         } else {
    28.             $msg = "上传出错！";
    29.         }
    30.     }
    31. }

    提示：

    利用文件包含漏洞上传图片码

    解题思路：

    制作图片码

    上传生成的888.jpg图片码

    上传成功后右键打开链接

    Pass-18

    代码：

    1. //index.php
    2. $is_upload = false;
    3. $msg = null;
    4. if (isset($_POST['submit']))
    5. {
    6.     require_once("./myupload.php");
    7.     $imgFileName =time();
    8.     $u = new MyUpload($_FILES['upload_file']['name'], $_FILES['upload_file']['tmp_name'], $_FILES['upload_file']['size'],$imgFileName);
    9.     $status_code = $u->upload(UPLOAD_PATH);
    10.     switch ($status_code) {
    11.         case 1:
    12.             $is_upload = true;
    13.             $img_path = $u->cls_upload_dir . $u->cls_file_rename_to;
    14.             break;
    15.         case 2:
    16.             $msg = '文件已经被上传，但没有重命名。';
    17.             break; 
    18.         case -1:
    19.             $msg = '这个文件不能上传到服务器的临时文件存储目录。';
    20.             break; 
    21.         case -2:
    22.             $msg = '上传失败，上传目录不可写。';
    23.             break; 
    24.         case -3:
    25.             $msg = '上传失败，无法上传该类型文件。';
    26.             break; 
    27.         case -4:
    28.             $msg = '上传失败，上传的文件过大。';
    29.             break; 
    30.         case -5:
    31.             $msg = '上传失败，服务器已经存在相同名称文件。';
    32.             break; 
    33.         case -6:
    34.             $msg = '文件无法上传，文件不能复制到目标目录。';
    35.             break;      
    36.         default:
    37.             $msg = '未知错误！';
    38.             break;
    39.     }
    40. }
    41.  
    42. //myupload.php
    43. class MyUpload{
    44. ......
    45. ......
    46. ...... 
    47.   var $cls_arr_ext_accepted = array(
    48.       ".doc", ".xls", ".txt", ".pdf", ".gif", ".jpg", ".zip", ".rar", ".7z",".ppt",
    49.       ".html", ".xml", ".tiff", ".jpeg", ".png" );
    50.  
    51. ......
    52. ......
    53. ......  
    54.   /** upload()
    55.    **
    56.    ** Method to upload the file.
    57.    ** This is the only method to call outside the class.
    58.    ** @para String name of directory we upload to
    59.    ** @returns void
    60.   **/
    61.   function upload( $dir ){
    62.     
    63.     $ret = $this->isUploadedFile();
    64.     
    65.     if( $ret != 1 ){
    66.       return $this->resultUpload( $ret );
    67.     }
    68.  
    69.     $ret = $this->setDir( $dir );
    70.     if( $ret != 1 ){
    71.       return $this->resultUpload( $ret );
    72.     }
    73.  
    74.     $ret = $this->checkExtension();
    75.     if( $ret != 1 ){
    76.       return $this->resultUpload( $ret );
    77.     }
    78.  
    79.     $ret = $this->checkSize();
    80.     if( $ret != 1 ){
    81.       return $this->resultUpload( $ret );    
    82.     }
    83.     
    84.     // if flag to check if the file exists is set to 1
    85.     
    86.     if( $this->cls_file_exists == 1 ){
    87.       
    88.       $ret = $this->checkFileExists();
    89.       if( $ret != 1 ){
    90.         return $this->resultUpload( $ret );    
    91.       }
    92.     }
    93.  
    94.     // if we are here, we are ready to move the file to destination
    95.  
    96.     $ret = $this->move();
    97.     if( $ret != 1 ){
    98.       return $this->resultUpload( $ret );    
    99.     }
    100.  
    101.     // check if we need to rename the file
    102.  
    103.     if( $this->cls_rename_file == 1 ){
    104.       $ret = $this->renameFile();
    105.       if( $ret != 1 ){
    106.         return $this->resultUpload( $ret );    
    107.       }
    108.     }
    109.     
    110.     // if we are here, everything worked as planned :)
    111.  
    112.     return $this->resultUpload( "SUCCESS" );
    113.   
    114.   }
    115. ......
    116. ......
    117. ...... 
    118. };

    提示：

    上传文件后会判断后缀名，如果相同会进行重命名。我们可以进行条件竞争

    解题思路：

    上传文件，进行BP爆破

    出现上传的php文件但很快就消失了

    Pass-19

    代码：

    1. //index.php
    2. $is_upload = false;
    3. $msg = null;
    4. if (isset($_POST['submit']))
    5. {
    6.     require_once("./myupload.php");
    7.     $imgFileName =time();
    8.     $u = new MyUpload($_FILES['upload_file']['name'], $_FILES['upload_file']['tmp_name'], $_FILES['upload_file']['size'],$imgFileName);
    9.     $status_code = $u->upload(UPLOAD_PATH);
    10.     switch ($status_code) {
    11.         case 1:
    12.             $is_upload = true;
    13.             $img_path = $u->cls_upload_dir . $u->cls_file_rename_to;
    14.             break;
    15.         case 2:
    16.             $msg = '文件已经被上传，但没有重命名。';
    17.             break; 
    18.         case -1:
    19.             $msg = '这个文件不能上传到服务器的临时文件存储目录。';
    20.             break; 
    21.         case -2:
    22.             $msg = '上传失败，上传目录不可写。';
    23.             break; 
    24.         case -3:
    25.             $msg = '上传失败，无法上传该类型文件。';
    26.             break; 
    27.         case -4:
    28.             $msg = '上传失败，上传的文件过大。';
    29.             break; 
    30.         case -5:
    31.             $msg = '上传失败，服务器已经存在相同名称文件。';
    32.             break; 
    33.         case -6:
    34.             $msg = '文件无法上传，文件不能复制到目标目录。';
    35.             break;      
    36.         default:
    37.             $msg = '未知错误！';
    38.             break;
    39.     }
    40. }
    41.  
    42. //myupload.php
    43. class MyUpload{
    44. ......
    45. ......
    46. ...... 
    47.   var $cls_arr_ext_accepted = array(
    48.       ".doc", ".xls", ".txt", ".pdf", ".gif", ".jpg", ".zip", ".rar", ".7z",".ppt",
    49.       ".html", ".xml", ".tiff", ".jpeg", ".png" );
    50.  
    51. ......
    52. ......
    53. ......  
    54.   /** upload()
    55.    **
    56.    ** Method to upload the file.
    57.    ** This is the only method to call outside the class.
    58.    ** @para String name of directory we upload to
    59.    ** @returns void
    60.   **/
    61.   function upload( $dir ){
    62.     
    63.     $ret = $this->isUploadedFile();
    64.     
    65.     if( $ret != 1 ){
    66.       return $this->resultUpload( $ret );
    67.     }
    68.  
    69.     $ret = $this->setDir( $dir );
    70.     if( $ret != 1 ){
    71.       return $this->resultUpload( $ret );
    72.     }
    73.  
    74.     $ret = $this->checkExtension();
    75.     if( $ret != 1 ){
    76.       return $this->resultUpload( $ret );
    77.     }
    78.  
    79.     $ret = $this->checkSize();
    80.     if( $ret != 1 ){
    81.       return $this->resultUpload( $ret );    
    82.     }
    83.     
    84.     // if flag to check if the file exists is set to 1
    85.     
    86.     if( $this->cls_file_exists == 1 ){
    87.       
    88.       $ret = $this->checkFileExists();
    89.       if( $ret != 1 ){
    90.         return $this->resultUpload( $ret );    
    91.       }
    92.     }
    93.  
    94.     // if we are here, we are ready to move the file to destination
    95.  
    96.     $ret = $this->move();
    97.     if( $ret != 1 ){
    98.       return $this->resultUpload( $ret );    
    99.     }
    100.  
    101.     // check if we need to rename the file
    102.  
    103.     if( $this->cls_rename_file == 1 ){
    104.       $ret = $this->renameFile();
    105.       if( $ret != 1 ){
    106.         return $this->resultUpload( $ret );    
    107.       }
    108.     }
    109.     
    110.     // if we are here, everything worked as planned :)
    111.  
    112.     return $this->resultUpload( "SUCCESS" );
    113.   
    114.   }
    115. ......
    116. ......
    117. ...... 
    118. };

    提示：

    上传文件后，判断后缀名，移动文件进行重命名

    Apache解析漏洞

    1.php.zxc.zxc.zxc.zxc.zxc

    Apache从右往左解析，解析不了继续解析下一个

    上传phpinfo.php.7z

    解题思路：

    上传phpinfo.php.7z进行BP爆破

    文件已经被上传了

    Pass-20

    代码：

    1. $is_upload = false;
    2. $msg = null;
    3. if (isset($_POST['submit'])) {
    4.     if (file_exists(UPLOAD_PATH)) {
    5.         $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");
    6.  
    7.         $file_name = $_POST['save_name'];
    8.         $file_ext = pathinfo($file_name,PATHINFO_EXTENSION);
    9.  
    10.         if(!in_array($file_ext,$deny_ext)) {
    11.             $temp_file = $_FILES['upload_file']['tmp_name'];
    12.             $img_path = UPLOAD_PATH . '/' .$file_name;
    13.             if (move_uploaded_file($temp_file, $img_path)) { 
    14.                 $is_upload = true;
    15.             }else{
    16.                 $msg = '上传出错！';
    17.             }
    18.         }else{
    19.             $msg = '禁止保存为该类型文件！';
    20.         }
    21.  
    22.     } else {
    23.         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    24.     }
    25. }

    提示：

    上传文件直接空格绕过

    上传文件后直接右键打开链接

    Pass-21

    代码：

    1. $is_upload = false;
    2. $msg = null;
    3. if(!empty($_FILES['upload_file'])){
    4.     //检查MIME
    5.     $allow_type = array('image/jpeg','image/png','image/gif');
    6.     if(!in_array($_FILES['upload_file']['type'],$allow_type)){
    7.         $msg = "禁止上传该类型文件!";
    8.     }else{
    9.         //检查文件名
    10.         $file = empty($_POST['save_name']) ? $_FILES['upload_file']['name'] : $_POST['save_name'];
    11.         if (!is_array($file)) {
    12.             $file = explode('.', strtolower($file));
    13.         }
    14.  
    15.         $ext = end($file);
    16.         $allow_suffix = array('jpg','png','gif');
    17.         if (!in_array($ext, $allow_suffix)) {
    18.             $msg = "禁止上传该后缀文件!";
    19.         }else{
    20.             $file_name = reset($file) . '.' . $file[count($file) - 1];
    21.             $temp_file = $_FILES['upload_file']['tmp_name'];
    22.             $img_path = UPLOAD_PATH . '/' .$file_name;
    23.             if (move_uploaded_file($temp_file, $img_path)) {
    24.                 $msg = "文件上传成功！";
    25.                 $is_upload = true;
    26.             } else {
    27.                 $msg = "文件上传失败！";
    28.             }
    29.         }
    30.     }
    31. }else{
    32.     $msg = "请选择要上传的文件！";
    33. }

    提示：

    需要修改MIME TYPE类型，进行拼接

    解题思路：

    上传文件，BP抓包修改数据

    文件上传成功后右键打开链接

  • 相关阅读:
    Ubuntu编译安装colmap遇到的几个问题以及解决
    nginx升级
    Qt-使用QString输出数字上标（不要再用x2或x^2表示平方啦）
    Mockito的使用指南---最后也包括了在idea中创建基本junit test的方法
    内网-2（代理）
    USB设备的音频类UAC
    百度ERNIE系列预训练语言模型浅析(4)-总结篇
    基于交替迭代法的交直流混合系统潮流计算matlab程序iEEE9节点系统算例
    Kubernetes leader election 源码分析
    .net-----集合和数据结构
  • 原文地址：https://blog.csdn.net/lyshark_lyshark/article/details/126799187