[ACTF2020 新生赛]Upload – buu刷题笔记

[ACTF2020 新生赛]Upload

• 考点 前端后缀名绕过的方式 php可执行文件后缀名的种类主界面 有一个灯泡，提示你上传文件，前端有验证，只能上传 jpg|png|gif

这个时候我们有两种方式绕过前端验证

直接在源码里把验证函数删掉

先把文件改成jpg格式，然后上传，用burp拦截，再改成原来的格式

我们选择第一种方式，试着上传一下php文件，内容可以先用phpinfo() 测试一下能不能成功

页面提示nonono bad file!，看来后端也对后缀名进行了检查，那么我们就用phtml试试，常用的php后缀名绕过见[极客大挑战 2019]Upload 成功上传

[极客大挑战 2019]Upload – buu刷题笔记

2022年4月14日 19:28

012711

打开后，成功获得执行了phpinfo()

接下来只要编写简单的php一句话木马就行！后端没有对文件内容进行任何检查。用蚁剑连接后成功在根目录得到flag。

<FilesMatch \\.phtml$>
  SetHandler application/x-httpd-php
</FilesMatch>
<FilesMatch \\.phtml$>
  SetHandler application/x-httpd-php
</FilesMatch>
<FilesMatch \\.phtml$>
	SetHandler application/x-httpd-php
</FilesMatch>

<?php
  error_reporting(0);
  //设置上传目录
  define(\"UPLOAD_PATH\", \"./uplo4d\");
  $msg = \"Upload Success!\";
  if (isset($_POST[\'submit\'])) {
        $temp_file = $_FILES[\'upload_file\'][\'tmp_name\'];
        $file_name = $_FILES[\'upload_file\'][\'name\'];
        $ext = pathinfo($file_name,PATHINFO_EXTENSION);
        if(in_array($ext, [\'php\', \'php3\', \'php4\', \'php5\'])) {
          exit(\'nonono~ Bad file！\');
      }
        $new_file_name = md5($file_name).\".\".$ext;
        $img_path = UPLOAD_PATH . \'/\' . $new_file_name;
        if (move_uploaded_file($temp_file, $img_path)){
            $is_upload = true;
        } else {
            $msg = \'Upload Failed!\';
        }
        echo \'<div style=\"color:#F00\">\'.$msg.\" Look here~ \".$img_path.\"</div>\";
    }
?>
<?php
  error_reporting(0);
  //设置上传目录
  define(\"UPLOAD_PATH\", \"./uplo4d\");
  $msg = \"Upload Success!\";
  if (isset($_POST[\'submit\'])) {
        $temp_file = $_FILES[\'upload_file\'][\'tmp_name\'];
        $file_name = $_FILES[\'upload_file\'][\'name\'];
        $ext = pathinfo($file_name,PATHINFO_EXTENSION);
        if(in_array($ext, [\'php\', \'php3\', \'php4\', \'php5\'])) {
          exit(\'nonono~ Bad file！\');
      }
        $new_file_name = md5($file_name).\".\".$ext;
        $img_path = UPLOAD_PATH . \'/\' . $new_file_name;
        if (move_uploaded_file($temp_file, $img_path)){
            $is_upload = true;
        } else {
            $msg = \'Upload Failed!\';
        }
        echo \'<div style=\"color:#F00\">\'.$msg.\" Look here~ \".$img_path.\"</div>\";
    }
?>
<?php
	error_reporting(0);
	//设置上传目录
	define(\"UPLOAD_PATH\", \"./uplo4d\");
	$msg = \"Upload Success!\";
	if (isset($_POST[\'submit\'])) {
        $temp_file = $_FILES[\'upload_file\'][\'tmp_name\'];
        $file_name = $_FILES[\'upload_file\'][\'name\'];
        $ext = pathinfo($file_name,PATHINFO_EXTENSION);
        if(in_array($ext, [\'php\', \'php3\', \'php4\', \'php5\'])) {
	        exit(\'nonono~ Bad file！\');
    	}
        $new_file_name = md5($file_name).\".\".$ext;
        $img_path = UPLOAD_PATH . \'/\' . $new_file_name;
        if (move_uploaded_file($temp_file, $img_path)){
            $is_upload = true;
        } else {
            $msg = \'Upload Failed!\';
        }
        echo \'<div style=\"color:#F00\">\'.$msg.\" Look here~ \".$img_path.\"</div>\";
    }
?>

所以最终flag为flag{1313cb3a-42f4-4b6d-8633-fd9209f9b775}