upload(Pass-10~Pass-)

拼搏现实的明天。 2022-09-12 15:53 199阅读 0赞

### 文章目录 ###

*  Pass-10
 *  Pass-11
 *  Pass-12（失败）

# Pass-10 #

查看提示：`本pass只允许上传.jpg|.png|.gif后缀的文件！`  
有预感是白名单，再查看源码

is_upload = false;
    $msg = null;
    if (isset($_POST['submit'])) { 
        if (file_exists(UPLOAD_PATH)) { 
            $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
            $file_name = trim($_FILES['upload_file']['name']);
            $file_name = deldot($file_name);//删除文件名末尾的点
            $file_ext = strrchr($file_name, '.');
            $file_ext = strtolower($file_ext); //转换为小写
            $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
            $file_ext = trim($file_ext); //首尾去空
            
            if (!in_array($file_ext, $deny_ext)) { 
                $temp_file = $_FILES['upload_file']['tmp_name'];
                $img_path = UPLOAD_PATH.'/'.$file_name;
                if (move_uploaded_file($temp_file, $img_path)) { 
                    $is_upload = true;
                } else { 
                    $msg = '上传出错！';
                }
            } else { 
                $msg = '此文件类型不允许上传！';
            }
        } else { 
            $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
        }
    }

看样子并不是白名单,他对文件的处理是先去空，再去点，之后后缀名变小写，去字符串`::$data`然后再进行去空。可以把文件变成`1.php. .`的样式传入，这让我想到了Pass-05，然后重新修改了一下，通过。

# Pass-11 #

提示跟以前一样，直接看源码：

$is_upload = false;
    $msg = null;
    if (isset($_POST['submit'])) { 
        if (file_exists(UPLOAD_PATH)) { 
            $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess","ini");
    
            $file_name = trim($_FILES['upload_file']['name']);
            $file_name = str_ireplace($deny_ext,"", $file_name);
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;        
            if (move_uploaded_file($temp_file, $img_path)) { 
                $is_upload = true;
            } else { 
                $msg = '上传出错！';
            }
        } else { 
            $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
        }
    }

跟之前的相比，感觉很多方法都可以通过，但是直觉告诉我没那么简单，然后我简单的测试了一下，上传jpg可以正常访问，但是上传php文件文件后缀名就没了。这关起作用的PHP语句是`str_ireplace($deny_ext,"", $file_name);`这是把`$deny_ext`里出现的后缀都过滤了，这里使用双写的规则就可以绕过，如图：  
![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16]  
最后成功

# Pass-12（失败） #

查看提示：`本pass上传路径可控！`  
这个提示让我想起是不是存在隐藏域传参来控制路径，查看源码

$is_upload = false;
    $msg = null;
    if(isset($_POST['submit'])){ 
        $ext_arr = array('jpg','png','gif');
        $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
        if(in_array($file_ext,$ext_arr)){ 
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = $_GET['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;
    
            if(move_uploaded_file($temp_file,$img_path)){ 
                $is_upload = true;
            } else { 
                $msg = '上传出错！';
            }
        } else{ 
            $msg = "只允许上传.jpg|.png|.gif类型文件！";
        }
    }

可以看到，`save_path`是通过get方式提交上去的。然后去进行一个字符串拼接。  
捋一下这个php的逻辑，这是先去获取文件后缀名，进行一个白名单的判断，然后跟savapath进行一个字符串的拼接。如果在savapath中传入hex编码，让后面的全部注释掉，这样img\_path就是我们传入的路径和保存路径了。  
![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 1]  
没有必要去进行抓包，这样就可以了，但是提示上传出错…  
抓包之后再去进行修改提交，依旧是上传出错…  
上传的文件是jpg文件，`$temp_file`应该是正确的，那么错误的就是`img_path`  
但是参阅了众多资料，依旧无法知道错误原因，暂时搁置…

--------------------

未完待续...

[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16]: /images/20220828/eceb4e7a4137485fbe10905ccf752cf9.png
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Zyj6buY_size_20_color_FFFFFF_t_70_g_se_x_16 1]: /images/20220828/43780a9ba2ca4262a83bc398a1c3afad.png