Upload-labs通關筆記(更新中)

upload-labs包含漏洞類型分類

如何判斷上傳漏洞類型?

上傳的過程

Pass-01（前端JS繞過）

function checkFile() {
    var file = document.getElementsByName('upload_file')[0].value;
    if (file == null || file == "") {
        alert("請選擇要上傳的文件!");
        return false;
    }
    //定義允許上傳的文件類型
    var allow_ext = ".jpg|.png|.gif";
    //提取上傳文件的類型
    var ext_name = file.substring(file.lastIndexOf("."));
    //判斷上傳文件類型是否允許上傳
    if (allow_ext.indexOf(ext_name + "|") == -1) {
        var errMsg = "該文件不允許上傳，請上傳" + allow_ext + "類型的文件,當前文件類型爲：" + ext_name;
        alert(errMsg);
        return false;
    }
}

方法一：前端檢測。js的檢測只能位於client，可以禁用js,在瀏覽器設置中修改。或者直接改掉這裏的 checkFile()

修改之後就可以直接上傳.php文件,上傳之後複製圖像地址就可以得到上傳路徑了

方法二：上傳1.png直接抓包，修改後綴爲php就可以繞過上傳

得到路徑/upload/1.php,連接菜刀，得到shell

Pass-02（MIME繞過）

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        if (($_FILES['upload_file']['type'] == 'image/jpeg') || ($_FILES['upload_file']['type'] == 'image/png') || ($_FILES['upload_file']['type'] == 'image/gif')) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH . '/' . $_FILES['upload_file']['name']            
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '文件類型不正確，請重新上傳！';
        }
    } else {
        $msg = UPLOAD_PATH.'文件夾不存在,請手工創建！';
    }
}

本節對數據包的MIME（content-type）進行了限定，只允許 image/jpeg、image/png、image/gif 圖片內容數據傳輸。操作和第一節方法二一樣。

上傳1.png直接抓包，修改後綴爲php就可以繞過上傳

得到路徑/upload/1.php,連接菜刀，得到shell

Pass-03（上傳特殊可解析後綴繞過php4、phtml）

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array('.asp','.aspx','.php','.jsp');
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//刪除文件名末尾的點
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //轉換爲小寫
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //收尾去空

        if(!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;            
            if (move_uploaded_file($temp_file,$img_path)) {
                 $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '不允許上傳.asp,.aspx,.php,.jsp後綴文件！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
    }
}

查看源碼，發現是設置了文件後綴名黑名單，禁止上傳後綴名爲.php文件，這裏利用php2、php3、php4、php5、phps、phtml一樣會解析，直接修改後綴名爲phps上傳。
複製圖像地址

得到上傳路徑

常見擴展名繞過：

asp:asa,cer,cdx
aspx:ashx,asmx,ascx
php:php2、php3、php4、php5、phps、phtml
jsp:jspx,jspf

Pass-04（上傳 .htaccess）

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2","php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2","pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//刪除文件名末尾的點
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //轉換爲小寫
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //收尾去空

        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '此文件不允許上傳!';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
    }
}

比剛纔的黑名單多了不少，但是.htaccess還是沒有過濾，可以重寫文件解析規則繞過，上傳一個.htaccess，文件內容如下，意思就是在upload目錄下匹配1.jpg的文件並以php文件執行

<FilesMatch "1.jpg">
SetHandler application/x-httpd-php
</FilesMatch>

上傳一個.htaccess

上傳1.jpg,應爲重寫了文件解析規則，1.jpg將會被以php文件執行

然後直接連接菜刀

getshell

.htaccess攻擊總結
有的時候由於各種名單的原因，可能我們不能上傳任何php文件，而且還沒有其他地方來解析成php，咋辦？如果你能上傳.htaccess文件的話，那麼就很好辦了。
建一個.htaccess 文件，裏面的內容如下

<FilesMatch "1.jpg">
SetHandler application/x-httpd-php
</FilesMatch>

這個時候就上傳一個文件名字是1.jpg的文件，然後裏面是一句話木馬，1.jpg就會被當成1.php執行，就能成功連接菜刀

Pass-05（後綴大小寫繞過）

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//刪除文件名末尾的點
        $file_ext = strrchr($file_name, '.');
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空

        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '此文件類型不允許上傳！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
    }
}

Pass-04與Pass-05代碼對比

對比之後發現黑名單多了一個.htaccess
並且沒有將文件後綴轉小寫的代碼了
於是這裏顯然可以用大小寫繞過，例如 .Php .phP

Pass-06（後綴末尾加空格繞過）

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = $_FILES['upload_file']['name'];
        $file_name = deldot($file_name);//刪除文件名末尾的點
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //轉換爲小寫
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file,$img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '此文件不允許上傳';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
    }
}

Pass-05與Pass-06代碼對比

發現刪去了將文件名前後去空格的操作所以可以利用6.php(空格)

Pass-07（後綴末尾加點繞過）

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //轉換爲小寫
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '此文件類型不允許上傳！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
    }
}

Pass-06與Pass-07代碼對比

對比發現沒有去處文件末尾的點的操作了
於是利用7.php.

Pass-08（ ::$DATA 繞過）

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//刪除文件名末尾的點
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //轉換爲小寫
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '此文件類型不允許上傳！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
    }
}

[圖片上傳失敗...(image-b1aca6-1562811998688)]
對比發現這裏刪掉了::$DATA的限制
:: $DATA備用流存在於每個文件，因此它可以是訪問任何文件的替代方法所以使用`8.php::$ DATA`

Windows :: DATA備用數據流漏洞：
https://www.owasp.org/index.php/Windows_::DATA_alternate_data_stream

Pass-09（加點空格配合繞過）

參考：
https://cloud.tencent.com/developer/article/1377897
http://www.bubuko.com/infodetail-2944836.html
https://blog.csdn.net/u011377996/article/details/86776198
http://www.she1don.cn/index.php/archives/38.html

Upload-labs通關筆記(更新中)

Pass-01（前端JS繞過）

Pass-02（MIME繞過）

Pass-03（上傳特殊可解析後綴繞過php4、phtml）

Pass-04（上傳 .htaccess）

Pass-05（後綴大小寫繞過）

Pass-06（後綴末尾加空格繞過）

Pass-07（後綴末尾加點繞過）

Pass-08（ ::$DATA 繞過）

Pass-09（加點空格配合繞過）

基於Django的多功能Web應用滲透測試系統開發

一文學會Docker使用

淺談XSS 前言

Vulnhub靶機：DC-9

哀悼--CSS-filter-網頁變灰

Mac下配置sublime實現LaTeX

https://yachay.unat.edu.pe/blog/index.php?comment_area=format_blog&comment_component=blog&comment_co

linux以太網驅動總結

Upload-labs通關筆記(更新中)

Pass-01（前端JS繞過）

Pass-02（MIME繞過）

Pass-03（上傳特殊可解析後綴繞過php4、phtml）

Pass-04（上傳 .htaccess）

Pass-05（後綴大小寫繞過）

Pass-06（後綴末尾 加空格 繞過）

Pass-07（後綴末尾 加點 繞過）

Pass-08（ ::$DATA 繞過 ）

Pass-09（ 加點 空格 配合繞過）

Pass-06（後綴末尾加空格繞過）

Pass-07（後綴末尾加點繞過）

Pass-08（ ::$DATA 繞過）

Pass-09（加點空格配合繞過）