DVWA——File Upload(文件上传)
File Uplaod,即文件上传漏洞,通常是由于对上传文件的类型、内容没有进行严格的过滤、检查,使得攻击者可以通过上传木马获取服务器的Webshell权限,因此文件上传漏洞带来的危害常常是毁灭性的,Apache、Tomcat、Nginx等都曝出过文件上传漏洞。
LOW
源码
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | <?php if ( isset( $_POST [ 'Upload' ] ) ) { // Where are we going to be writing to? $target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/" ; //设置上传目录 $target_path .= basename ( $_FILES [ 'uploaded' ][ 'name' ] ); //上传目录加上‘uploaded’表单参数所提交的文件名 // Can we move the file to the upload folder? if ( !move_uploaded_file( $_FILES [ 'uploaded' ][ 'tmp_name' ], $target_path ) ) { //移动上传的文件到目标路径 // No echo '<pre>Your image was not uploaded.</pre>' ; } else { // Yes! echo "<pre>{$target_path} succesfully uploaded!</pre>" ; } } ?> |
可以看出,服务器对上传文件的类型、内容没有做任何的检查、过滤,存在明显的文件上传漏洞,生成上传路径后,服务器会检查是否上传成功并返回相应的提示信息。
漏洞利用
文件上传漏洞的利用是有条件限制的,首先当然是能够成功上传木马文件,其次上传文件必须能够被执行,最后就是上传文件的路径必须可知。
①上传一句话木马文件
②返回路径
③中国菜刀链接,获得权限
Medium
源码
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 | <?php if ( isset( $_POST [ 'Upload' ] ) ) { // Where are we going to be writing to? $target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/" ; $target_path .= basename ( $_FILES [ 'uploaded' ][ 'name' ] ); // File information $uploaded_name = $_FILES [ 'uploaded' ][ 'name' ]; $uploaded_type = $_FILES [ 'uploaded' ][ 'type' ]; $uploaded_size = $_FILES [ 'uploaded' ][ 'size' ]; // Is it an image? if ( ( $uploaded_type == "image/jpeg" || $uploaded_type == "image/png" ) && ( $uploaded_size < 100000 ) ) { // Can we move the file to the upload folder? if ( !move_uploaded_file( $_FILES [ 'uploaded' ][ 'tmp_name' ], $target_path ) ) { // No echo '<pre>Your image was not uploaded.</pre>' ; } else { // Yes! echo "<pre>{$target_path} succesfully uploaded!</pre>" ; } } else { // Invalid file echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>' ; } } ?> |
可以看出代码对于上传文件的类型、大小做了限制,要求文件类型必须是jepg或者png,大小不能超过100000B(约为97.6KB)
漏洞利用
我们通过burpsuite抓包并修改文件类型。
①上传test.png
修改完成之后店址Forward, Forward是发送这个包,drop是丢弃这个包,Action是发送这个包到其他模块。
上传成功!
②中国菜刀链接(刚才我没有修改文件名,效果不太明显,我重新上传了czs.png查看一下。)
High
源码
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 | <?php if ( isset( $_POST [ 'Upload' ] ) ) { // Where are we going to be writing to? $target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/" ; $target_path .= basename ( $_FILES [ 'uploaded' ][ 'name' ] ); // File information $uploaded_name = $_FILES [ 'uploaded' ][ 'name' ]; $uploaded_ext = substr ( $uploaded_name , strrpos ( $uploaded_name , '.' ) + 1); $uploaded_size = $_FILES [ 'uploaded' ][ 'size' ]; $uploaded_tmp = $_FILES [ 'uploaded' ][ 'tmp_name' ]; // Is it an image? if ( ( strtolower ( $uploaded_ext ) == "jpg" || strtolower ( $uploaded_ext ) == "jpeg" || strtolower ( $uploaded_ext ) == "png" ) && ( $uploaded_size < 100000 ) && getimagesize ( $uploaded_tmp ) ) { // Can we move the file to the upload folder? if ( !move_uploaded_file( $uploaded_tmp , $target_path ) ) { // No echo '<pre>Your image was not uploaded.</pre>' ; } else { // Yes! echo "<pre>{$target_path} succesfully uploaded!</pre>" ; } } else { // Invalid file echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>' ; } } ?> |
strrpos(string,find,start)
函数返回字符串find在另一字符串string中最后一次出现的位置,如果没有找到字符串则返回false,可选参数start规定在何处开始搜索。
getimagesize(string filename)
函数会通过读取文件头,返回图片的长、宽等信息,如果没有相关的图片文件头,函数会报错。
可以看到,High级别的代码读取文件名中最后一个”.”后的字符串,期望通过文件名来限制文件类型,因此要求上传文件名形式必须是”.jpg”、”.jpeg” 、”*.png”之一。同时,getimagesize函数更是限制了上传文件的文件头必须为图像类型。
漏洞利用
首先,我们保存任何一张图片(jpg)文件,将其更改为txt文件类型,并在其中添加一句话木马。
http://localhost/DVWA-master/vulnerabilities/fi/?page=file:///C:/phpstudy/www/DVWA-master/hackable/uploads/123123.jpg
Impossible
源码
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 | <?php if ( isset( $_POST [ 'Upload' ] ) ) { // Check Anti-CSRF token checkToken( $_REQUEST [ 'user_token' ], $_SESSION [ 'session_token' ], 'index.php' ); // File information $uploaded_name = $_FILES [ 'uploaded' ][ 'name' ]; $uploaded_ext = substr ( $uploaded_name , strrpos ( $uploaded_name , '.' ) + 1); $uploaded_size = $_FILES [ 'uploaded' ][ 'size' ]; $uploaded_type = $_FILES [ 'uploaded' ][ 'type' ]; $uploaded_tmp = $_FILES [ 'uploaded' ][ 'tmp_name' ]; // Where are we going to be writing to? $target_path = DVWA_WEB_PAGE_TO_ROOT . 'hackable/uploads/' ; //$target_file = basename( $uploaded_name, '.' . $uploaded_ext ) . '-'; $target_file = md5( uniqid() . $uploaded_name ) . '.' . $uploaded_ext ; $temp_file = ( ( ini_get ( 'upload_tmp_dir' ) == '' ) ? ( sys_get_temp_dir() ) : ( ini_get ( 'upload_tmp_dir' ) ) ); $temp_file .= DIRECTORY_SEPARATOR . md5( uniqid() . $uploaded_name ) . '.' . $uploaded_ext ; // Is it an image? if ( ( strtolower ( $uploaded_ext ) == 'jpg' || strtolower ( $uploaded_ext ) == 'jpeg' || strtolower ( $uploaded_ext ) == 'png' ) && ( $uploaded_size < 100000 ) && ( $uploaded_type == 'image/jpeg' || $uploaded_type == 'image/png' ) && getimagesize ( $uploaded_tmp ) ) { // Strip any metadata, by re-encoding image (Note, using php-Imagick is recommended over php-GD) if ( $uploaded_type == 'image/jpeg' ) { $img = imagecreatefromjpeg( $uploaded_tmp ); imagejpeg( $img , $temp_file , 100); } else { $img = imagecreatefrompng( $uploaded_tmp ); imagepng( $img , $temp_file , 9); } imagedestroy( $img ); // Can we move the file to the web root from the temp folder? if ( rename( $temp_file , ( getcwd () . DIRECTORY_SEPARATOR . $target_path . $target_file ) ) ) { // Yes! echo "<pre><a href='${target_path}${target_file}'>${target_file}</a> succesfully uploaded!</pre>" ; } else { // No echo '<pre>Your image was not uploaded.</pre>' ; } // Delete any temp files if ( file_exists ( $temp_file ) ) unlink( $temp_file ); } else { // Invalid file echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>' ; } } // Generate Anti-CSRF token generateSessionToken(); ?> |
【推荐】编程新体验,更懂你的AI,立即体验豆包MarsCode编程助手
【推荐】凌霞软件回馈社区,博客园 & 1Panel & Halo 联合会员上线
【推荐】抖音旗下AI助手豆包,你的智能百科全书,全免费不限次数
【推荐】轻量又高性能的 SSH 工具 IShell:AI 加持,快人一步