{"id":195,"date":"2021-06-19T21:12:56","date_gmt":"2021-06-19T13:12:56","guid":{"rendered":"http:\/\/101.34.19.194\/?p=195"},"modified":"2021-07-05T07:05:33","modified_gmt":"2021-07-04T23:05:33","slug":"upload-labs","status":"publish","type":"post","link":"http:\/\/101.34.19.194\/?p=195","title":{"rendered":"upload-labs"},"content":{"rendered":"\n

pass01<\/h3>\n\n\n\n

\u524d\u7aef\u9a8c\u8bc1<\/strong><\/p>\n\n\n\n

\u53ef\u4ee5\u7981\u7528js\u6216\u8005\u5c06\u4e00\u53e5\u8bdd\u6728\u9a6c\u6587\u4ef6\u6539\u540e\u7f00\u4e3ajpg\u518d\u6293\u5305\u6539\u540e\u7f00<\/p>\n\n\n\n

pass02<\/h3>\n\n\n\n

MIME\u9a8c\u8bc1<\/strong><\/p>\n\n\n\n

\"image-20210619161803643\"\/<\/div><\/figure>\n\n\n\n

\u6293\u5305\u6539Content-Type\u4e3aimage\/jpeg<\/p>\n\n\n\n

\"image-20210619162026833\"\/<\/div><\/figure>\n\n\n\n

pass03<\/h3>\n\n\n\n

\u9ed1\u540d\u5355\u9a8c\u8bc1<\/strong>(\u540e\u7f00\u540d\u7ed5\u8fc7)<\/p>\n\n\n\n

\"image-20210619162226054\"\/<\/div><\/figure>\n\n\n\n

\u53ea\u8981\u540e\u7f00\u4e0d\u4e3a\u56fe\u4e2d\u7684\u9ed1\u540d\u5355\u540e\u7f00\u5373\u53ef\u7ed5\u8fc7<\/p>\n\n\n\n

\"image-20210619162400853\"\/<\/div><\/figure>\n\n\n\n

\u5e38\u7528\u7ed5\u8fc7\u540e\u7f00\u540d<\/p>\n\n\n\n

php,php3,php4,php5,phtml.pht<\/p><\/blockquote>\n\n\n\n

pass04<\/h3>\n\n\n\n

\u9ed1\u540d\u5355\u9a8c\u8bc1<\/strong>(.htaccess\u653b\u51fb)<\/p>\n\n\n\n

\"image-20210619162931274\"\/<\/div><\/figure>\n\n\n\n

\u6e90\u7801\u4e2d\u9ed1\u540d\u5355\u540e\u7f00\u591a\u4e86\uff0c\u57fa\u672c\u6ca1\u529e\u6cd5\u4ece\u540e\u7f00\u540d\u7ed5\u8fc7<\/p>\n\n\n\n

\u8fd9\u65f6\u53ef\u4ee5\u5229\u7528.htaccess\u6587\u4ef6\u8fdb\u884c\u653b\u51fb<\/p>\n\n\n\n

\u5148\u4e0a\u4f20\u4e00\u4e2a.htaccess\u6587\u4ef6\uff0c\u5185\u5bb9\u5982\u4e0b<\/p>\n\n\n\n

\"image-20210619164809827\"\/<\/div><\/figure>\n\n\n\n

\u518d\u4e0a\u4f20\u5bf9\u5e94.htaccess\u6587\u4ef6\u5185\u5bb9\u7684\u6587\u4ef6\u540d\u6587\u4ef6\uff0c\u542b\u6709\u4e00\u53e5\u8bdd\u6728\u9a6c<\/p>\n\n\n\n

\"image-20210619165204772\"\/<\/div><\/figure>\n\n\n\n

.htaccess\u6587\u4ef6\uff0c\u5b83\u5c06\u8be5\u76ee\u5f55\u4e0b\u5339\u914d\u7684\u5bf9\u5e94\u6587\u4ef6\u89e3\u6790\u4e3aphp\u6267\u884c<\/p><\/blockquote>\n\n\n\n

pass05<\/h3>\n\n\n\n

\u70b9\u7a7a\u683c\u70b9\u7ed5\u8fc7<\/strong><\/p>\n\n\n\n

\"image-20210619172038981\"\/<\/div><\/figure>\n\n\n\n

\u65b0\u589e\u7684\u4e00\u5173 \u524d\u4e09\u5173\u7684\u7ed3\u5408\u4f53<\/p>\n\n\n\n

\u5bf9\u7167\u6e90\u7801\u5206\u6790<\/p>\n\n\n\n

\u5047\u8bbe\u4e0a\u4f20\u4e00\u4e2a\u6587\u4ef6 \u4e3axx.php. .<\/p>\n\n\n\n

$file_name = deldot($file_name);\/\/\u5220\u9664\u6587\u4ef6\u540d\u672b\u5c3e\u7684\u70b9
\u200b
\u8fd9\u65f6\u6587\u4ef6\u540d\u4e3axx.php. 
\u200b
$file_ext = strrchr($file_name, '.');
\u200b
strrchr \u5339\u914d\u6587\u4ef6\u540d\u6700\u540e\u51fa\u73b0\u70b9\u7684\u4f4d\u7f6e \u8fd9\u65f6\u4fee\u6539\u6587\u4ef6\u4e3a. 
    
\u200b
$file_ext = trim($file_ext); \/\/\u9996\u5c3e\u53bb\u7a7a
\u200b
\u8fd9\u65f6\u6587\u4ef6\u540d\u4e3a.
\u200b
\u200b<\/pre>\n\n\n\n
\u6839\u636eWindows\u7279\u6027\uff0c\u4f1a\u5220\u9664\u6587\u4ef6\u540d\u6700\u540e\u7684\u70b9<\/p>\n\n\n\n
\u56e0\u6b64\u6700\u540e\u4e0a\u4f20\u4e0a\u53bb\u7684\u6587\u4ef6\u540d\u4e3axx.php<\/p>\n\n\n\n
pass06<\/h3>\n\n\n\n
\u5927\u5c0f\u5199\u7ed5\u8fc7<\/strong><\/p>\n\n\n\n
\"image-20210619165400798\"\/<\/div><\/figure>\n\n\n\n
\u67e5\u770b\u6e90\u7801\uff0c\u53d1\u73b0\u5c11\u4e86\u8f6c\u6362\u6210\u5c0f\u5199\u7684\u51fd\u6570<\/p>\n\n\n\n
\u5bf9\u6b64\u53ef\u4ee5\u91c7\u7528\u5927\u5c0f\u5199\u7ed5\u8fc7\u9ed1\u540d\u5355\u65b9\u5f0f<\/p>\n\n\n\n
\"image-20210619165514067\"\/<\/div><\/figure>\n\n\n\n
pass07<\/h3>\n\n\n\n
\u7a7a\u683c\u7ed5\u8fc7<\/strong><\/p>\n\n\n\n
\"image-20210619172830083\"\/<\/div><\/figure>\n\n\n\n
\u5bf9\u6bd4\u524d\u9762\u7684\u5173\u5361\uff0c\u6e90\u7801\u5c11\u4e86\u9996\u5c3e\u53bb\u7a7a<\/p>\n\n\n\n
\u6587\u4ef6\u540d\u540e\u7f00\u52a0\u4e2a\u7a7a\u683c\u5c31\u53ef<\/p>\n\n\n\n
pass08<\/h3>\n\n\n\n
\u70b9\u7ed5\u8fc7<\/strong><\/p>\n\n\n\n
\"image-20210619173756507\"\/<\/div><\/figure>\n\n\n\n
\u67e5\u770b\u6e90\u7801\uff0c\u53d1\u73b0\u5c11\u4e86\u5220\u9664\u672b\u5c3e\u70b9<\/p>\n\n\n\n
\u5728\u540e\u7f00\u540d\u4e0a\u52a0\u4e0a\u70b9\u5373\u53ef\u7ed5\u8fc7<\/p>\n\n\n\n
pass09<\/h3>\n\n\n\n
::$DATA\u7ed5\u8fc7<\/strong><\/p>\n\n\n\n
\"image-20210619173852108\"\/<\/div><\/figure>\n\n\n\n
\u5bf9\u6bd4\u6e90\u7801\uff0c\u5c11\u4e86::$DATA\uff0c\u5728\u540e\u7f00\u540d\u52a0\u4e0a\uff0cWindows\u7279\u6027\u4e0d\u4f1a\u89e3\u6790::$DATA<\/p>\n\n\n\n
pass10<\/h3>\n\n\n\n
\u70b9\u7a7a\u683c\u70b9\u7ed5\u8fc7<\/strong><\/p>\n\n\n\n
\u8ddf\u7b2c\u4e94\u5173\u4e00\u6837<\/p>\n\n\n\n
pass11<\/h3>\n\n\n\n
\u53cc\u5199\u7ed5\u8fc7<\/strong><\/p>\n\n\n\n
\"image-20210619174201914\"\/<\/div><\/figure>\n\n\n\n
$file_name = str_ireplace($deny_ext,\"\", $file_name);<\/pre>\n\n\n\n
\u5c06\u9ed1\u540d\u5355\u4e2d\u7684\u540e\u7f00\u540d\u66ff\u6362\u6210\u7a7a<\/p>\n\n\n\n
\u56e0\u6b64\u53ef\u4ee5\u91c7\u7528\u53cc\u5199\u8fdb\u884c\u7ed5\u8fc7<\/p>\n\n\n\n
\"image-20210619174426093\"\/<\/div><\/figure>\n\n\n\n
pass12<\/h3>\n\n\n\n
%00\u622a\u65ad\uff08get\u65b9\u5f0f\uff09<\/strong><\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u7b2c\u4e00\u4e2a\u65b9\u5757\uff0c\u662f\u767d\u540d\u5355\u9a8c\u8bc1\uff0c\u6240\u4ee5\u4e0a\u4f20\u65f6\u9996\u5148\u9700\u8981\u5c06php\u6728\u9a6c\u6587\u4ef6\u6539\u6210jpg\u683c\u5f0f<\/p>\n\n\n\n
\u7b2c\u4e8c\u4e2a\u65b9\u5757\uff0c\u662f\u8bf4\u660e\u7528\u62fc\u63a5\u8def\u5f84get\u65b9\u5f0f\u63a5\u6536\uff0c\u6240\u4ee5%00\u622a\u65ad\u65b9\u5f0f\u5728url\u4e0a\u622a\u65ad<\/p>\n\n\n\n
\"image-20210619175055044\"\/<\/div><\/figure>\n\n\n\n
\u56e0\u4e3a\u5728url\u5904\u8fdb\u884c\u4e86\u622a\u65ad\uff0c\u6240\u4ee5\u6700\u7ec8\u4fdd\u5b58\u7684\u540e\u7f00\u540d\u4e3aurl\u5904\u7684php<\/p>\n\n\n\n
pass13<\/h3>\n\n\n\n
%00\u622a\u65ad\uff08POST\u65b9\u5f0f\uff09<\/strong><\/p>\n\n\n\n
\"image-20210619175249256\"\/<\/div><\/figure>\n\n\n\n
\u7b2c\u4e00\u4e2a\u65b9\u5757\uff0c\u662f\u767d\u540d\u5355\u9a8c\u8bc1\uff0c\u6240\u4ee5\u4e0a\u4f20\u65f6\u9996\u5148\u9700\u8981\u5c06php\u6728\u9a6c\u6587\u4ef6\u6539\u6210jpg\u683c\u5f0f<\/p>\n\n\n\n
\u7b2c\u4e8c\u4e2a\u65b9\u5757\uff0c\u662f\u8bf4\u660e\u7528\u62fc\u63a5\u8def\u5f84post\u65b9\u5f0f\u63a5\u6536\uff0c\u6240\u4ee5%00\u622a\u65ad\u65b9\u5f0f\u5728bp\u4e0a\u4fee\u6539\uff0c\u7531\u4e8epost\u4e0d\u4f1a\u5bf9%00\u8fdb\u884c\u7f16\u7801\uff0c\u6240\u4ee5\u9700\u8981\u5728bp\u4e0a\u8fdb\u884c\u7f16\u7801<\/p>\n\n\n\n
\"img\"\/<\/div><\/figure>\n\n\n\n
pass14<\/h3>\n\n\n\n
\u56fe\u7247\u9a6c\u7ed5\u8fc7<\/strong><\/p>\n\n\n\n
\"image-20210619175839452\"\/<\/div><\/figure>\n\n\n\n
\u9898\u76ee\u63d0\u793a\u4f7f\u7528\u56fe\u7247\u9a6c\uff0c\u5229\u7528\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e<\/p>\n\n\n\n
\u4e0b\u65b9\u6e90\u7801\u4e3a\u7528\u51fd\u6570\u4e8c\u8fdb\u5236\u8bfb\u53d6\u6587\u4ef6\uff0c\u5224\u65ad\u4e3a\u56fe\u7247\u624d\u80fd\u901a\u8fc7\uff0c\u56e0\u6b64\u65e0\u6cd5\u7b80\u5355\u7684\u6539\u540e\u7f00\u7ed5\u8fc7<\/p>\n\n\n\n
\u56fe\u7247\u9a6c\u5236\u4f5c\u65b9\u6cd5<\/p>\n\n\n\n
copy a.jpg \/b + shell.php \/a shell.jpg
\/b \u8868\u793a\u4e00\u4e2a\u4e8c\u8fdb\u5236\u6587\u4ef6
+ \u8868\u793a\u5c06\u591a\u4e2a\u6587\u4ef6\u5408\u5e76\u6210\u4e00\u4e2a\u6587\u4ef6
\/a \u8868\u793a\u4e00\u4e2aASCII\u6587\u672c\u6587\u4ef6<\/pre>\n\n\n\n
\u5148\u4e0a\u4f20\u4e00\u4e2a\u56fe\u7247\u9a6c\uff0c\u5e76\u590d\u5236\u4e0a\u4f20\u6210\u529f\u540e\u7684\u56fe\u50cf\u94fe\u63a5<\/p>\n\n\n\n
\"image-20210619180437960\"\/<\/div><\/figure>\n\n\n\n
\u67e5\u770b\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e\uff0c\u8df3\u8f6c\u5230\u8be5\u94fe\u63a5<\/p>\n\n\n\n
\u7136\u540e\u5728\u8be5\u94fe\u63a5\u540e\u62fc\u63a5\u4fdd\u5b58\u597d\u7684\u56fe\u50cf\u8def\u5f84\u5730\u5740<\/p>\n\n\n\n
http:\/\/192.168.184.103\/upload-labs\/include.php?file=upload\/6420210619180100.jpg<\/pre>\n\n\n\n
\u6210\u529f\u6267\u884cphp<\/p>\n\n\n\n
pass15<\/h3>\n\n\n\n
\u56fe\u7247\u9a6c\u7ed5\u8fc7<\/strong><\/p>\n\n\n\n
\"image-20210619181454008\"\/<\/div><\/figure>\n\n\n\n
\u7ed5\u8fc7\u65b9\u6cd5\u8ddf14\u5173\u4e00\u6837\uff0c\u53ea\u662f\u83b7\u53d6\u56fe\u7247\u4fe1\u606f\u4ece\u4e8c\u8fdb\u5236\u8bfb\u53d6\u5230getimagesize\u51fd\u6570\u8bfb\u53d6<\/p>\n\n\n\n
getimagesize() \u51fd\u6570\u7528\u4e8e\u83b7\u53d6\u56fe\u50cf\u5927\u5c0f\u53ca\u76f8\u5173\u4fe1\u606f\uff0c\u6210\u529f\u8fd4\u56de\u4e00\u4e2a\u6570\u7ec4\uff0c\u5931\u8d25\u5219\u8fd4\u56de FALSE \u5e76\u4ea7\u751f\u4e00\u6761 E_WARNING \u7ea7\u7684\u9519\u8bef\u4fe1\u606f\u3002<\/p><\/blockquote>\n\n\n\n
pass16<\/h3>\n\n\n\n
\u56fe\u7247\u9a6c\u7ed5\u8fc7<\/p>\n\n\n\n
\"image-20210619182441425\"\/<\/div><\/figure>\n\n\n\n
\u7ed5\u8fc7\u65b9\u6cd5\u4e00\u6837\uff0c\u53ea\u662f\u7528php\u81ea\u5e26\u6a21\u5757\u5bf9\u56fe\u7247\u8fdb\u884c\u68c0\u9a8c<\/p>\n\n\n\n
\u9700\u8981\u5f00\u542fphp\u6269\u5c55<\/p>\n","protected":false},"excerpt":{"rendered":"
pass01 \u524d\u7aef\u9a8c\u8bc1 \u53ef\u4ee5\u7981\u7528js\u6216\u8005\u5c06\u4e00\u53e5\u8bdd\u6728\u9a6c\u6587\u4ef6\u6539\u540e\u7f00\u4e3ajpg\u518d\u6293\u5305\u6539\u540e\u7f00 pass02 MIME\u9a8c\u8bc1 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[17],"tags":[10],"_links":{"self":[{"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/posts\/195"}],"collection":[{"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/101.34.19.194\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=195"}],"version-history":[{"count":1,"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/posts\/195\/revisions"}],"predecessor-version":[{"id":196,"href":"http:\/\/101.34.19.194\/index.php?rest_route=\/wp\/v2\/posts\/195\/revisions\/196"}],"wp:attachment":[{"href":"http:\/\/101.34.19.194\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=195"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/101.34.19.194\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=195"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/101.34.19.194\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=195"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}