文件上傳漏洞靶場分析 UPLOAD_LABS

文件上傳漏洞靶場（作者前言）

文件上傳漏洞

產生原理

`PASS 1)`

function checkFile() {
  var file = document.getElementsByName('upload_file')[0].value;
  if (file == null || file == "") {
    alert("請選擇要上傳的文件!");
    return false;
  }
  //定義允許上傳的文件類型
  var allow_ext = ".jpg|.png|.gif";
  //提取上傳文件的類型
  var ext_name = file.substring(file.lastIndexOf("."));
  //判斷上傳文件類型是否允許上傳
  if (allow_ext.indexOf(ext_name + "|") == -1) {
    var errMsg = "該文件不允許上傳，請上傳" + allow_ext + "類型的文件,當前文件類型為：" + ext_name;
    alert(errMsg);
    return false;
  }
}

源碼分析

這是一串JS前端語言編寫的文件上傳這邊限制上傳的文件類型為JPG;PNG;GIF三種
通過file.substring（file.lastIndexof(".")); #獲取文件後綴名並判斷文件的後綴名是否等於允許的文件類型
沒有對文件名後綴做過濾限制

繞過方法

*JS是前端開發語言
1.更改php文件後綴名，上傳圖片文件時可以通過Burpsuite 進行攔截請求數據包並更改文件後綴名
2.F12查看前端程式碼並複製程式執行的過濾，按需求對其進行刪改操作
3.修改form表單定義action 進行直接上傳的操作

防禦方法

驗證文件真實性

過濾空格、點、大小寫、雙寫、流文件

`PASS 2）`

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
  if (file_exists(UPLOAD_PATH)) {
    if (($_FILES['upload_file']['type'] == 'image/jpeg') || ($_FILES['upload_file']['type'] == 'image/png') || ($_FILES['upload_file']['type'] == 'image/gif')) {
      $temp_file = $_FILES['upload_file']['tmp_name'];
      $img_path = UPLOAD_PATH . '/' . $_FILES['upload_file']['name']            
        if (move_uploaded_file($temp_file, $img_path)) {
          $is_upload = true;
        } else {
          $msg = '上傳出錯！';
        }
    } else {
      $msg = '文件類型不正確，請重新上傳！';
    }
  } else {
    $msg = UPLOAD_PATH.'文件夾不存在,請手工創建！';
  }
}

源碼分析

if
(($_FILES['upload_file']['type'] == 'image/jpeg') ||
($_FILES['upload_file']['type'] == 'image/png') ||
($_FILES['upload_file']['type'] == 'image/gif'))
這邊僅對上傳的文件類型做了過濾沒有對上傳的文件後綴做過濾且請求方式為POST

繞過方法

上傳php文件時使用Burpsuite 更改請求頭中的內容類型（content-type:image/jpeg:png:gif）任意一種允許的文件類型。
上傳轉格式的包含php執行程式的圖片文件，使用Burpsuite 更改後綴名

防禦方法

1.驗證圖片文件的真實性
2.過濾上傳文件的後綴名

`PASS 3）`


$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
  if (file_exists(UPLOAD_PATH)) {
    $deny_ext = array('.asp','.aspx','.php','.jsp');
    $file_name = trim($_FILES['upload_file']['name']);
    $file_name = deldot($file_name);//刪除文件名末尾的點
    $file_ext = strrchr($file_name, '.');
    $file_ext = strtolower($file_ext); //轉換為小寫
    $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字元串::$DATA
    $file_ext = trim($file_ext); //收尾去空
    
    if(!in_array($file_ext, $deny_ext)) {
      $temp_file = $_FILES['upload_file']['tmp_name'];
      $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;            
      if (move_uploaded_file($temp_file,$img_path)) {
        $is_upload = true;
      } else {
        $msg = '上傳出錯！';
      }
    } else {
      $msg = '不允許上傳.asp,.aspx,.php,.jsp後綴文件！';
    }
  } else {
    $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
  }
}

源碼分析

$deny_ext = array('.asp','.aspx','.php','.jsp');
這邊使用黑名單防禦方法不允許後綴為.asp ; .aspx ; .php ; .jsp 的後端語言文件
if(!in_array($file_ext, $deny_ext))
取出用戶後綴名，如果不存在限制的後綴名則執行接下來的操作

繞過方法

使用php文件時可以使用其他的php語言支援的後綴名比如php3 phtml

通過查閱apache配置文件 httpd.conf中的 AddType application/x-httpd-php .php .php3 .phtml
這是phpstudy（PHP 5.2.17） apache配置文件中默認配置支援的文件.php .php3 .phtml

application/x-httpd-php ：指定應用程式php的可用後綴名
原理：Addtype 添加類型 可以手動指定任意後綴名讓apache服務解析至PHP文件認定位php程式並執行
···比如： AddType application/x-httpd-php .abc 這裡以.abc為後綴的文件將被認為是php執行文件

使用.htaccess 分散式配置文件將上傳目錄的中的所有文件的執行策略更改為php執行程式

防禦方法

過濾完整的後端執行後綴名
過濾分散式配置文件.htaccess
使用白名單防禦方法（只允許）

`PASS 4）`

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2","php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2","pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//刪除文件名末尾的點
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //轉換為小寫
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字元串::$DATA
        $file_ext = trim($file_ext); //收尾去空

        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '此文件不允許上傳!';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
    }
}

源碼分析

$deny_ext = array
(".php",".php5",".php4",".php3",".php2","php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2","pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf");
以上源碼沒有對.htaccess配置文件進行限制

$file_name = trim($_FILES['upload_file']['name']);
$file_name = deldot($file_name);//刪除文件名末尾的點
$file_ext = strrchr($file_name, '.');
$file_ext = strtolower($file_ext); //轉換為小寫
$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字元串::$DATA
$file_ext = trim($file_ext); //收尾去空
以上源碼 trim函數使用兩次

繞過方法

上傳.htaccess 分散式配置文件修改文件執行策略針對目錄改變配置的方法
SetHandle application/x-httpd-php
告訴apache 當前目錄下的所有後綴名解析為php

<FilesMatch "file_name.png">
SetHandler application/x-httpd-php

告訴apache，只對當前目錄下 file_name.png 文件當作php程式碼執行，其他文件照常不變

上傳文件時使用BP攔截請求消息包更改後綴名為.php. .繞過

程式執行時從上至下執行首先對文件名進行首尾清除空格
接著刪除文件末尾的.
最後刪除文件末尾的空格

即file.php. . 上傳時
執行deldot($file_name)>
file.php.$nbsp 上傳中執行trim($file_ext)>
留下file.php.

防禦方法

過濾htaccess 限制上傳此文件
使用白名單防禦方法只允許想要上傳的格式（白名單和黑名單防禦方法根據需求定）

`PASS 5）`

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
  if (file_exists(UPLOAD_PATH)) {
    $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
    $file_name = trim($_FILES['upload_file']['name']);
    $file_name = deldot($file_name);//刪除文件名末尾的點
    $file_ext = strrchr($file_name, '.');
    $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字元串::$DATA
    $file_ext = trim($file_ext); //首尾去空
    
    if (!in_array($file_ext, $deny_ext)) {
      $temp_file = $_FILES['upload_file']['tmp_name'];
      $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
      if (move_uploaded_file($temp_file, $img_path)) {
        $is_upload = true;
      } else {
        $msg = '上傳出錯！';
      }
    } else {
      $msg = '此文件類型不允許上傳！';
    }
  } else {
    $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
  }
}

源碼分析

if (file_exists(UPLOAD_PATH)) {
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
$file_name = trim($_FILES['upload_file']['name']);
$file_name = deldot($file_name);//刪除文件名末尾的點
$file_ext = strrchr($file_name, '.');
$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字元串::$DATA
$file_ext = trim($file_ext); //首尾去空
以上源碼 trim函數使用兩次，且沒有對後綴名的大小寫進行過濾 —— strtolower() 將字元轉為小寫

繞過方法

利用win系統的特性因為大小寫不敏感可以使用大小寫繞過的方法繞過即.PHp 這一特性不適用Linux系統
雙寫後綴名格式

上傳文件時使用BP攔截請求消息包更改後綴名為.php. .繞過
即file.php. . 上傳時
執行deldot($file_name)>
file.php.$nbsp 上傳中執行trim($file_ext)>
留下file.php.

防禦方法

白名單防禦方法只允許上傳圖片格式的文件（白名單和黑名單防禦方法根據需求定）
限制大小寫轉換為小寫

`PASS 6）`

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
  if (file_exists(UPLOAD_PATH)) {
    $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
    $file_name = $_FILES['upload_file']['name'];
    $file_name = deldot($file_name);//刪除文件名末尾的點
    $file_ext = strrchr($file_name, '.');
    $file_ext = strtolower($file_ext); //轉換為小寫
    $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字元串::$DATA
    
    if (!in_array($file_ext, $deny_ext)) {
      $temp_file = $_FILES['upload_file']['tmp_name'];
      $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
      if (move_uploaded_file($temp_file,$img_path)) {
        $is_upload = true;
      } else {
        $msg = '上傳出錯！';
      }
    } else {
      $msg = '此文件不允許上傳';
    }
  } else {
    $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
  }
}

源碼分析

if (isset($_POST['submit'])) {
if (file_exists(UPLOAD_PATH)) {
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
$file_name = $_FILES['upload_file']['name'];
$file_name = deldot($file_name);//刪除文件名末尾的點
$file_ext = strrchr($file_name, '.');
$file_ext = strtolower($file_ext); //轉換為小寫
$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字元串::$DATA

這裡沒有使用trim() 清除字元首尾空格函數可以利用系統特性後綴名末尾為空格即為空這一文件

繞過方法

使用BP攔截請求消息更改後綴名+空格即.php+%20

防禦方法

白名單防禦法只允許想要上傳進入的文件格式
使用trim函數

`PASS 7）`

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //轉換為小寫
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字元串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上傳出錯！';
            }
        } else {
            $msg = '此文件類型不允許上傳！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
    }
}

源碼分析

$file_name = trim($_FILES['upload_file']['name']);
$file_ext = trim($file_ext); //首尾去空
# trim() 函數移除字元串兩側的空白字元或其他預定義字元
沒有使用deldot函數
# deldot($file_name) 刪除文件名末尾的點

繞過方法

使用Burpsuite 攔截請求數據包更改後綴名末尾處添加「.」 (這也是利用win系統的命名規則特性「.」或空格即為空)
使用Burpsuite 攔截請求數據包更改後綴名為.php. . （程式執行邏輯時會執行兩次移除字元串兩側的空白字元，但程式只執行一次，執行一次後留下的後綴名即為.php.）

以上兩種方法僅適用於windows系統下 Linux系統不支援

防禦方法

只執行一次trim函數只清除一次空格
添加deldot函數刪除文件末尾的點
白名單防禦方法

`PASS 8）`

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
  if (file_exists(UPLOAD_PATH)) {
    $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
    $file_name = trim($_FILES['upload_file']['name']);
    $file_name = deldot($file_name);//刪除文件名末尾的點
    $file_ext = strrchr($file_name, '.');
    $file_ext = strtolower($file_ext); //轉換為小寫
    $file_ext = trim($file_ext); //首尾去空
    
    if (!in_array($file_ext, $deny_ext)) {
      $temp_file = $_FILES['upload_file']['tmp_name'];
      $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
      if (move_uploaded_file($temp_file, $img_path)) {
        $is_upload = true;
      } else {
        $msg = '上傳出錯！';
      }
    } else {
      $msg = '此文件類型不允許上傳！';
    }
  } else {
    $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
  }
}

源碼分析

$file_name = trim($_FILES['upload_file']['name']);
$file_ext = trim($file_ext); //首尾去空
執行了兩次首尾去空
沒有對流文件::$DATA進行過濾

繞過方法

為文件後綴名添加::$DATA
改變後綴名格式讓程式執行邏輯時對.和空格做一次移除操作保留下來的即為可用執行文件

防禦方法

只使用一次trim移除函數
限制過濾流文件::$DATA
限制上傳文件格式（白名單防禦方法）

`PASS 9）`

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
  if (file_exists(UPLOAD_PATH)) {
    $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
    $file_name = trim($_FILES['upload_file']['name']);
    $file_name = deldot($file_name);//刪除文件名末尾的點
    $file_ext = strrchr($file_name, '.');
    $file_ext = strtolower($file_ext); //轉換為小寫
    $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字元串::$DATA
    $file_ext = trim($file_ext); //首尾去空
    
    if (!in_array($file_ext, $deny_ext)) {
      $temp_file = $_FILES['upload_file']['tmp_name'];
      $img_path = UPLOAD_PATH.'/'.$file_name;
      if (move_uploaded_file($temp_file, $img_path)) {
        $is_upload = true;
      } else {
        $msg = '上傳出錯！';
      }
    } else {
      $msg = '此文件類型不允許上傳！';
    }
  } else {
    $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
  }
}

源碼分析

$file_name = trim($_FILES['upload_file']['name']);
$file_ext = trim($file_ext); //首尾去空
執行了兩次首尾去空

繞過方法

改變後綴名格式讓程式執行邏輯時對.和空格做一次移除操作保留下來的即為可用執行文件
1. 即xx.php. . ---> xx.php.

防禦方法

只使用一次trim移除函數
限制上傳文件格式（白名單防禦方法）

`PASS 10）`

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
  if (file_exists(UPLOAD_PATH)) {
    $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");
    
    $file_name = trim($_FILES['upload_file']['name']);
    $file_name = str_ireplace($deny_ext,"", $file_name);
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $img_path = UPLOAD_PATH.'/'.$file_name;        
    if (move_uploaded_file($temp_file, $img_path)) {
      $is_upload = true;
    } else {
      $msg = '上傳出錯！';
    }
  } else {
    $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
  }
}

源碼分析

$file_name = str_ireplace($deny_ext,"", $file_name);
這裡將上傳的文件名中包含不允許的後綴名替換為空得到$file_name
如果上傳的文件名中一旦包含php asp jsp 等字元都會被替換為空達到不能正常執行shell程式的作用

繞過方法

雙寫繞過 BP攔截更改後綴名為.pphphp
1. 即xx.pphpphp --識別到php 替換為空-> xx.php

防禦方法

使用完整的黑名單過濾方法過濾點、空格、大小寫、流文件、htaccess分散式配置文件
使用白名單防禦方法只允許想要進入的文件格式

`⭐PASS1-10 總結過濾後綴名`

if (file_exists(UPLOAD_PATH)) {
    $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
    $file_name = $_FILES['upload_file']['name'];//獲取文件名
    $file_name = deldot($file_name);//刪除文件名末尾的點 【沒有利用在後綴名添加.】
    $file_ext = strrchr($file_name, '.');//獲取後綴名	
    $file_ext = strtolower($file_ext); //轉換為小寫	【沒有利用 大小寫繞過】
    $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字元串::$DATA 【沒有利用在後綴名添加::4DATA】
     $file_ext = trim($file_ext); //首尾去空【沒有利用在後綴名添加空格】

`PASS 11）`

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
  $ext_arr = array('jpg','png','gif');
  $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
  if(in_array($file_ext,$ext_arr)){
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $img_path = $_GET['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;
    
    if(move_uploaded_file($temp_file,$img_path)){
      $is_upload = true;
    } else {
      $msg = '上傳出錯！';
    }
  } else{
    $msg = "只允許上傳.jpg|.png|.gif類型文件！";
  }
}

源碼分析

$img_path = $_GET['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;
通過get傳入的參數拼接至url中

繞過方法

GET %00截斷（通過burpsuite 實現）

防禦方法

1.驗證圖片文件真實性
2.不使用請求方式接收參數方式將其拼接至url

`PASS 12）`

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
  $ext_arr = array('jpg','png','gif');
  $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
  if(in_array($file_ext,$ext_arr)){
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $img_path = $_POST['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;
    
    if(move_uploaded_file($temp_file,$img_path)){
      $is_upload = true;
    } else {
      $msg = "上傳失敗";
    }
  } else {
    $msg = "只允許上傳.jpg|.png|.gif類型文件！";
  }
}

源碼分析

$img_path = $_POST['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;
通過POST傳入的參數拼接至url中

繞過方法

POST 00截斷（通過burpsuite 實現）

防禦方法

1.驗證圖片文件真實性
2.不使用請求方式接收參數方式將其拼接至url

`PASS 13）`

function getReailFileType($filename){
  $file = fopen($filename, "rb");
  $bin = fread($file, 2); //只讀2位元組
  fclose($file);
  $strInfo = @unpack("C2chars", $bin);    
  $typeCode = intval($strInfo['chars1'].$strInfo['chars2']);    
  $fileType = '';    
  switch($typeCode){      
    case 255216:            
      $fileType = 'jpg';
      break;
    case 13780:            
      $fileType = 'png';
      break;        
    case 7173:            
      $fileType = 'gif';
      break;
    default:            
      $fileType = 'unknown';
  }    
  return $fileType;
}

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
  $temp_file = $_FILES['upload_file']['tmp_name'];
  $file_type = getReailFileType($temp_file);
  
  if($file_type == 'unknown'){
    $msg = "文件未知，上傳失敗！";
  }else{
    $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").".".$file_type;
    if(move_uploaded_file($temp_file,$img_path)){
      $is_upload = true;
    } else {
      $msg = "上傳出錯！";
    }
  }
}

源碼分析

通過觀察源碼

可知文件被打開時被驗證了文件頭2個位元組（16位）
使用 switch……case……語句判斷文件頭16位編號以驗證圖片文件的真實性
1. 常用文件的文件頭如下(16進位)：

jpg文件頭：FFD8FFE0或FFD8FFE1或FFD8FFE8
gif文件頭：47494638PNG
png文件頭：89504E47

繞過方法

使用文件包含漏洞解析製作的圖片馬中包含的php執行的webshell語句
圖片馬製作方法：
copy 1.png/b + 2.php/a 3.png
以二進位bin打開1.png（真實圖片）用ascii編碼打開2.php（webshell.php）
把兩者相加，獲得3.png

防禦方法

防禦其他漏洞

`PASS 14）`

function isImage($filename){
    $types = '.jpeg|.png|.gif';
    if(file_exists($filename)){
        $info = getimagesize($filename);
        $ext = image_type_to_extension($info[2]);
        if(stripos($types,$ext)>=0){
            return $ext;
        }else{
            return false;
        }
    }else{
        return false;
    }
}

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $res = isImage($temp_file);
    if(!$res){
        $msg = "文件未知，上傳失敗！";
    }else{
        $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").$res;
        if(move_uploaded_file($temp_file,$img_path)){
            $is_upload = true;
        } else {
            $msg = "上傳出錯！";
        }
    }
}

源碼分析

$info = getimagesize($filename); //獲取圖片的真實大小和資訊
image_type_to_extension（$info[2]） //獲取文件的文件頭

驗證文件的真實類型
如果傳入的不是圖片就會報錯

繞過方法

使用圖片馬+文件包含漏洞

防禦方法

`PASS 15）`

function isImage($filename){
  //需要開啟php_exif模組
  $image_type = exif_imagetype($filename);
  switch ($image_type) {
    case IMAGETYPE_GIF:
      return "gif";
      break;
    case IMAGETYPE_JPEG:
      return "jpg";
      break;
    case IMAGETYPE_PNG:
      return "png";
      break;    
    default:
      return false;
      break;
  }
}

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
  $temp_file = $_FILES['upload_file']['tmp_name'];
  $res = isImage($temp_file);
  if(!$res){
    $msg = "文件未知，上傳失敗！";
  }else{
    $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").".".$res;
    if(move_uploaded_file($temp_file,$img_path)){
      $is_upload = true;
    } else {
      $msg = "上傳出錯！";
    }
  }
}

源碼分析

exif_imagetype（） //獲取影像資訊和影像類型
驗證真實文件類型
如果傳入的不是真實圖片就會報錯

繞過方法

圖片馬+文件包含漏洞組合拳

防禦方法

`PASS 16）`

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])){
    // 獲得上傳文件的基本資訊，文件名，類型，大小，臨時文件路徑
    $filename = $_FILES['upload_file']['name'];
    $filetype = $_FILES['upload_file']['type'];
    $tmpname = $_FILES['upload_file']['tmp_name'];

    $target_path=UPLOAD_PATH.'/'.basename($filename);

    // 獲得上傳文件的擴展名
    $fileext= substr(strrchr($filename,"."),1);

    //判斷文件後綴與類型，合法才進行上傳操作
    if(($fileext == "jpg") && ($filetype=="image/jpeg")){
        if(move_uploaded_file($tmpname,$target_path)){
            //使用上傳的圖片生成新的圖片
            $im = imagecreatefromjpeg($target_path);

            if($im == false){
                $msg = "該文件不是jpg格式的圖片！";
                @unlink($target_path);
            }else{
                //給新圖片指定文件名
                srand(time());
                $newfilename = strval(rand()).".jpg";
                //顯示二次渲染後的圖片（使用用戶上傳圖片生成的新圖片）
                $img_path = UPLOAD_PATH.'/'.$newfilename;
                imagejpeg($im,$img_path);
                @unlink($target_path);
                $is_upload = true;
            }
        } else {
            $msg = "上傳出錯！";
        }

    }else if(($fileext == "png") && ($filetype=="image/png")){
        if(move_uploaded_file($tmpname,$target_path)){
            //使用上傳的圖片生成新的圖片
            $im = imagecreatefrompng($target_path);

            if($im == false){
                $msg = "該文件不是png格式的圖片！";
                @unlink($target_path);
            }else{
                 //給新圖片指定文件名
                srand(time());
                $newfilename = strval(rand()).".png";
                //顯示二次渲染後的圖片（使用用戶上傳圖片生成的新圖片）
                $img_path = UPLOAD_PATH.'/'.$newfilename;
                imagepng($im,$img_path);

                @unlink($target_path);
                $is_upload = true;               
            }
        } else {
            $msg = "上傳出錯！";
        }

    }else if(($fileext == "gif") && ($filetype=="image/gif")){
        if(move_uploaded_file($tmpname,$target_path)){
            //使用上傳的圖片生成新的圖片
            $im = imagecreatefromgif($target_path);
            if($im == false){
                $msg = "該文件不是gif格式的圖片！";
                @unlink($target_path);
            }else{
                //給新圖片指定文件名
                srand(time());
                $newfilename = strval(rand()).".gif";
                //顯示二次渲染後的圖片（使用用戶上傳圖片生成的新圖片）
                $img_path = UPLOAD_PATH.'/'.$newfilename;
                imagegif($im,$img_path);

                @unlink($target_path);
                $is_upload = true;
            }
        } else {
            $msg = "上傳出錯！";
        }
    }else{
        $msg = "只允許上傳後綴為.jpg|.png|.gif的圖片文件！";
    }
}

源碼分析

imagecreatefromjpeg() 二次渲染圖片將上傳的圖片渲染生成新的圖片壓縮處理渲染處理，導致用戶上傳的圖片馬被改變，無法使用
（類似微信朋友圈會對圖片進行壓縮）
在壓縮的時候執行半壓縮只執行了壓縮清晰圖
微信QQ微博是全壓縮

--》low imagecreatefromjpeg
--》high Google的影像壓縮演算法

繞過方法

上傳圖片馬
下載圖片馬鏈接

//wwe.lanzoui.com/iFSwwn53jaf
使用特殊的gif，找到在渲染前後不會改變的文件位置，使用webshell鏈接

防禦方法

`PASS 17）`

$is_upload = false;
$msg = null;

if(isset($_POST['submit'])){
  $ext_arr = array('jpg','png','gif');
  $file_name = $_FILES['upload_file']['name'];
  $temp_file = $_FILES['upload_file']['tmp_name'];
  $file_ext = substr($file_name,strrpos($file_name,".")+1);
  $upload_file = UPLOAD_PATH . '/' . $file_name;
  
  if(move_uploaded_file($temp_file, $upload_file)){
    if(in_array($file_ext,$ext_arr)){
      $img_path = UPLOAD_PATH . '/'. rand(10, 99).date("YmdHis").".".$file_ext;
      rename($upload_file, $img_path);
      $is_upload = true;
    }else{
      $msg = "只允許上傳.jpg|.png|.gif類型文件！";
      unlink($upload_file);
    }
  }else{
    $msg = '上傳出錯！';
  }
}

源碼分析

strrpos（）獲取字元串最後一個位置
_substr_函數在oracle中使用表示被截取的字元串或字元串表達式

取出文件得後綴名1.png

$file_ext = substr($file_name,strrpos($file_name,".")+1);

上傳文件 1.png 傳到 upload/1.png

$upload_file = UPLOAD_PATH . '/' . $file_name;

if(in_array($file_ext,$ext_arr))

判斷後綴名
4.$img_path = UPLOAD_PATH . '/'. rand(10, 99).date("YmdHis").".".$file_ext;
如果是'jpg','png','gif' 文件則上傳成功反之則unlink刪除文件

總結上傳原理：
條件競爭漏洞
因為PASS17 是先上傳再判斷，所以加快上傳速度和訪問速度，進行競爭訪問，如果競爭訪問速度快過php刪除的速度，即可完成漏洞利用

繞過方法

BP爆破空爆破

使用burpsuite爆破模組高速上傳 webshell.php
使用burpsuite爆破模組快速訪問 webshell.php

webshell玩法

執行單一命令利用漏洞在路徑中生成新的webshell

<?php
    file_put_contents('a.php','eval($_REQUEST['kio'])',LOCK_EX);
  ?>

執行單一命令利用漏洞在路徑中執行命令

<?php system('whoami'); ?>

防禦方法

`PASS 18）`

//index.php
$is_upload = false;
$msg = null;
if (isset($_POST['submit']))
{
  require_once("./myupload.php");
  $imgFileName =time();
  $u = new MyUpload($_FILES['upload_file']['name'], $_FILES['upload_file']['tmp_name'], $_FILES['upload_file']['size'],$imgFileName);
  $status_code = $u->upload(UPLOAD_PATH);
  switch ($status_code) {
    case 1:
      $is_upload = true;
      $img_path = $u->cls_upload_dir . $u->cls_file_rename_to;
      break;
    case 2:
      $msg = '文件已經被上傳，但沒有重命名。';
      break; 
    case -1:
      $msg = '這個文件不能上傳到伺服器的臨時文件存儲目錄。';
      break; 
    case -2:
      $msg = '上傳失敗，上傳目錄不可寫。';
      break; 
    case -3:
      $msg = '上傳失敗，無法上傳該類型文件。';
      break; 
    case -4:
      $msg = '上傳失敗，上傳的文件過大。';
      break; 
    case -5:
      $msg = '上傳失敗，伺服器已經存在相同名稱文件。';
      break; 
    case -6:
      $msg = '文件無法上傳，文件不能複製到目標目錄。';
      break;      
    default:
      $msg = '未知錯誤！';
      break;
  }
}

//myupload.php
class MyUpload{
  ......
    ......
    ...... 
    var $cls_arr_ext_accepted = array(
    ".doc", ".xls", ".txt", ".pdf", ".gif", ".jpg", ".zip", ".rar", ".7z",".ppt",
    ".html", ".xml", ".tiff", ".jpeg", ".png" );
  
  ......
    ......
    ......  
    /** upload()
    **
    ** Method to upload the file.
    ** This is the only method to call outside the class.
    ** @para String name of directory we upload to
    ** @returns void
    **/
    function upload( $dir ){
    
    $ret = $this->isUploadedFile();
    
    if( $ret != 1 ){
      return $this->resultUpload( $ret );
    }
    
    $ret = $this->setDir( $dir );
    if( $ret != 1 ){
      return $this->resultUpload( $ret );
    }
    
    $ret = $this->checkExtension();
    if( $ret != 1 ){
      return $this->resultUpload( $ret );
    }
    
    $ret = $this->checkSize();
    if( $ret != 1 ){
      return $this->resultUpload( $ret );    
    }
    
    // if flag to check if the file exists is set to 1
    
    if( $this->cls_file_exists == 1 ){
      
      $ret = $this->checkFileExists();
      if( $ret != 1 ){
        return $this->resultUpload( $ret );    
      }
    }
    
    // if we are here, we are ready to move the file to destination
    
    $ret = $this->move();
    if( $ret != 1 ){
      return $this->resultUpload( $ret );    
    }
    
    // check if we need to rename the file
    
    if( $this->cls_rename_file == 1 ){
      $ret = $this->renameFile();
      if( $ret != 1 ){
        return $this->resultUpload( $ret );    
      }
    }
    
    // if we are here, everything worked as planned :)
    
    return $this->resultUpload( "SUCCESS" );
    
  }
  ......
    ......
    ...... 
};

源碼分析

對文件先上傳再重命名
如果上傳速度過快 php可能反應不過來

繞過方法

利用條件競爭漏洞批量上傳文件

防禦方法

`PASS 19）`

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
  if (file_exists(UPLOAD_PATH)) {
    $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");
    
    $file_name = $_POST['save_name'];
    $file_ext = pathinfo($file_name,PATHINFO_EXTENSION);
    
    if(!in_array($file_ext,$deny_ext)) {
      $temp_file = $_FILES['upload_file']['tmp_name'];
      $img_path = UPLOAD_PATH . '/' .$file_name;
      if (move_uploaded_file($temp_file, $img_path)) { 
        $is_upload = true;
      }else{
        $msg = '上傳出錯！';
      }
    }else{
      $msg = '禁止保存為該類型文件！';
    }
    
  } else {
    $msg = UPLOAD_PATH . '文件夾不存在,請手工創建！';
  }
}

源碼分析

CVE-2015-2348 00截斷

繞過方法

使用00截斷方法

防禦方法

`PASS 20）`

$is_upload = false;
$msg = null;
if(!empty($_FILES['upload_file'])){
  //檢查MIME
  $allow_type = array('image/jpeg','image/png','image/gif');
  if(!in_array($_FILES['upload_file']['type'],$allow_type)){
    $msg = "禁止上傳該類型文件!";
  }else{
    //檢查文件名
    $file = empty($_POST['save_name']) ? $_FILES['upload_file']['name'] : $_POST['save_name'];
    if (!is_array($file)) {
      $file = explode('.', strtolower($file));
    }
    
    $ext = end($file);
    $allow_suffix = array('jpg','png','gif');
    if (!in_array($ext, $allow_suffix)) {
      $msg = "禁止上傳該後綴文件!";
    }else{
      $file_name = reset($file) . '.' . $file[count($file) - 1];
      $temp_file = $_FILES['upload_file']['tmp_name'];
      $img_path = UPLOAD_PATH . '/' .$file_name;
      if (move_uploaded_file($temp_file, $img_path)) {
        $msg = "文件上傳成功！";
        $is_upload = true;
      } else {
        $msg = "文件上傳失敗！";
      }
    }
  }
}else{
  $msg = "請選擇要上傳的文件！";
}

源碼分析

繞過方法

防禦方法

總結防禦方法（不考慮文件包含的存在）：

對象存儲伺服器

（將用戶上傳的文件，放置專用的伺服器，和網站本身伺服器沒有任何關係大廠常用方法）

檢測content-type （如果是上傳圖片檢測是否為image/png;image/jpg;image/png）
檢測後綴名 (合規的後綴名檢測是無法繞過的)
二次渲染（對上傳的圖片進行壓縮或處理合規的渲染可以防禦）
內容檢測（獲取文件資訊，判斷目標不是允許的文件時會直接報錯）

Tags: Web安全文件上傳漏洞漏洞學習漏洞靶場