WEB常见漏洞之文件上传（靶场篇）2-阿里云开发者社区

WEB常见漏洞之文件上传（靶场篇）2

2023-05-21 106

版权

本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。

本文涉及的产品

云解析 DNS，旗舰版 1个月

云解析DNS，个人版 1个月

全局流量管理 GTM，标准版 1个月

简介： WEB常见漏洞之文件上传（靶场篇）

Pass-06

场景分析

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

这是一个后端校验的 PHP 代码，从上可知其中定义了文件后缀名黑名单，黑名单里几乎包含了所有可解析的后缀名、.htaccess以及.ini。与此同时脚本还会对上传文件名进行过滤，包括删除文件名末尾的点、首尾去空、去除字符串::$DATA等。但由于定义的黑名单并不完整并且没有强制大小写转换。因此我们可通过大小写转换的方式绕过限制

大小写转换

将 php 文件后缀名修改为.Php并上传

但无法访问上传文件，界面显示500。这是由于当前的 Windows 系统对文件名中的大小写不敏感，而 Linux 系统对文件名中的大小写敏感

我们将环境通过 Docker 切换为 Linux 平台再次测试

cd upload-labs/docker
docker build -t upload-labs .
docker run -d -p 80:80 upload-labs:latest

环境搭建完成后上传文件

成功访问上传文件

Pass-07

场景分析

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = $_FILES['upload_file']['name'];
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file,$img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件不允许上传';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

这是一个后端校验的 PHP 代码，从上可知其中定义了文件后缀名黑名单，黑名单里几乎包含了所有可解析的后缀名、.htaccess以及.ini。与此同时脚本还会对上传文件名进行过滤，包括删除文件名末尾的点、去除字符串::$DATA、将字符转换为小写等。但由于没有强制首尾去空。我们可以在文件名后加空格绕过限制，利用 Windows 系统特性完成上传。

文件名加空格

上传 php 文件并在文件后缀名后加上空格，上传后系统会自动将空格清除以完成正常解析

成功访问上传文件

Pass-08

场景分析

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

这是一个后端校验的 PHP 代码，从上可知其中定义了文件后缀名黑名单，黑名单里几乎包含了所有可解析的后缀名、.htaccess以及.ini，与此同时脚本还会对上传文件名进行过滤，包括首尾去空、去除字符串::$DATA、将字符转换为小写等。但由于没有删除文件名末尾的点。我们可以在文件名后加点绕过限制，利用 Windows 系统特性完成上传。

文件名加.

上传 php 文件并在文件后缀名后加上符号点，上传后系统会自动将点清除以完成正常解析

成功访问上传文件

Pass-09

场景分析

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = trim($file_ext); //首尾去空
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

这是一个后端校验的 PHP 代码，从上可知其中定义了文件后缀名黑名单，黑名单里几乎包含了所有可解析的后缀名、.htaccess以及.ini，与此同时脚本还会对上传文件名进行过滤，包括首尾去空、删除文件名末尾的点、将字符转换为小写等。但它并没有过滤::$DATA。

那什么是::$DATA呢？

这其实是 Windows 系统中 NTFS 文件系统的特性，::$DATA是 NTFS 存储数据流的一个属性，当我们访问mac.php::$DATA时就是请求mac.php本身，如果它还包含了其他数据流，如mac.php:mac2.php::$DATA就会请求mac2.php中的数据流。因此我们可以在文件名后加::$DATA绕过限制，利用 Windows 系统特性完成上传

文件名加::$DATA

上传 php 文件并在文件后缀名后加上::$DATA，上传后系统会自动将::$DATA清除以完成正常解析

成功访问上传文件

Pass-10

场景分析

查看提示信息本题只允许上传图片后缀的文件

校验源代码如下：

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

这是一个后端校验的 PHP 代码，从上可知其中定义了文件后缀名黑名单，黑名单里几乎包含了所有可解析的后缀名、.htaccess以及.ini，与此同时脚本还会对上传文件名进行过滤，包括首尾去空、删除文件名末尾的点、将字符转换为小写、去除字符串::$DATA等。但由于只对点进行了单次过滤，因此如果我们上传mac.php. .最终会过滤为mac.php.，这样也就演变成了第八题。虽然以上几题都能通过这种方式绕过限制，但是这并不意味着我们要“一招鲜，吃遍天”，而学习多种绕过姿势才是我们的目的。

文件名加. .

上传 php 文件并在文件后缀名后加上. .，上传后脚本会去除 .，同时系统会自动将.清除以完成正常解析

成功访问上传文件

WEB常见漏洞之文件上传（靶场篇）2

Pass-06

Pass-07

场景分析

文件名加空格

Pass-08

场景分析

Pass-09

场景分析

热门文章

最新文章

相关课程

相关电子书

相关实验场景