CTF记录 Upload Labs Linux记录

发表于： 2023-04-28 分类于：

字数：1811 阅读：≈ 4分钟浏览：

CTF-Upload-Labs-Linux记录

Pass-01 前端JS校验

解决方案：直接运行checkFile=()=>{return true}修改checkFile函数即可

Pass-02 后台MIME检查

解决方案：修改POST数据包 Content-Type：image/jpeg 或者image/png 或 image/gif

Pass-03 后台后缀判定

解决方案： php修改为phtml后缀上传。

Pass-04 黑名单验证 .htaccess绕过

Pass-03的进阶！后台禁止上传.php|.php5|.php4|.php3|.php2|php1|.html|.htm|.phtml|.pHp|.pHp5|.pHp4|.pHp3|.pHp2|pHp1|.Html|.Htm|.pHtml|.jsp|.jspa|.jspx|.jsw|.jsv|.jspf|.jtml|.jSp|.jSpx|.jSpa|.jSw|.jSv|.jSpf|.jHtml|.asp|.aspx|.asa|.asax|.ascx|.ashx|.asmx|.cer|.aSp|.aSpx|.aSa|.aSax|.aScx|.aShx|.aSmx|.cEr|.sWf|.swf后缀文件！

  $deny_ext = array(".php",".php5",".php4",".php3",".php2","php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2","pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf");
  $file_name = trim($_FILES['upload_file']['name']);
  $file_name = deldot($file_name);//删除文件名末尾的点
  $file_ext = strrchr($file_name, '.');
  $file_ext = strtolower($file_ext); //转换为小写
  $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
  $file_ext = trim($file_ext); //收尾去空

解决方案：基本方法：上传.htaccess,将jpg作为php解析

AddHandler application/x-httpd-php .php5 .php3 .pht .phtml .phps .jpg

然后上传jpg一句话

Pass-05 黑名单验证，大小写绕过

  $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
  $file_name = trim($_FILES['upload_file']['name']);
  $file_name = deldot($file_name);//删除文件名末尾的点
  $file_ext = strrchr($file_name, '.');
  $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
  $file_ext = trim($file_ext); //首尾去空

解决方案：上传大写文件名

Pass-06 黑名单验证，空格绕过

  $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
  $file_name = $_FILES['upload_file']['name'];
  $file_name = deldot($file_name);//删除文件名末尾的点
  $file_ext = strrchr($file_name, '.');
  $file_ext = strtolower($file_ext); //转换为小写
  $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA

解决方案：上传文件名加空格

Pass-07 黑名单验证，点号绕过

  $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
  $file_name = $_FILES['upload_file']['name'];
  $file_ext = strrchr($file_name, '.');
  $file_ext = strtolower($file_ext); //转换为小写
  $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
  $file_ext = trim($file_ext); //收尾去空

解决方案：上传文件名尾加.

Pass-08 黑名单验证，$DATA绕过

  $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
  $file_name = trim($_FILES['upload_file']['name']);
  $file_name = deldot($file_name);//删除文件名末尾的点
  $file_ext = strrchr($file_name, '.');
  $file_ext = strtolower($file_ext); //转换为小写
  $file_ext = trim($file_ext); //首尾去空

解决方案： windows环境下有效，buuoj.cn提供环境无效。

php在window的时候如果文件名+"::$DATA"会把::$DATA之后的数据当成文件流处理,不会检测后缀名，且保持"::$DATA"之前的文件名他的目的就是不检查后缀名。

Pass-09 黑名单验证点+空格+点绕过

  $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
  $file_name = trim($_FILES['upload_file']['name']);
  $file_name = deldot($file_name);//删除文件名末尾的点
  $file_ext = strrchr($file_name, '.');
  $file_ext = strtolower($file_ext); //转换为小写
  $file_ext = trim($file_ext); //首尾去空

解决方案：上传文件名改为2.php. . deldot方法下 “. .“会变成”. " windows环境下直接访问2.php LINUX环境下访问2.php.%20

Pass-10 黑名单验证双写绕过

  $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");
  $file_name = trim($_FILES['upload_file']['name']);
  $file_name = str_ireplace($deny_ext,"", $file_name);

解决方案：上传文件名改为2.pphphp

Pass-11 白名单验证（GET型0x00截断）

  $ext_arr = array('jpg','png','gif');
  $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
  if(in_array($file_ext,$ext_arr)){
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $img_path = $_GET['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;

线上实验不成功，因为PHP版本号为7.2.21。设置上传路径为upload/2.php%00 ,2.php%00内容为了控制路径，上传文件后缀为白名单即可例:test.jpg，保存后为/upload/2.php%00test.jpg，但服务端读取到%00时会自动结束，将文件内容保存至2.php中 ? PS:需要php的版本号低于5.3.29，且magic_quotes_gpc为关闭状态

Pass-12 白名单校验（POST型0x00截断）

同Pass-11 ，save_path改为POST数据

Pass-13 文件包含漏洞图片马1

本题已经提示使用

header("Content-Type:text/html;charset=utf-8");
$file = $_GET['file'];
if(isset($file)){
    include $file;
}else{
    show_source(__file__);
}
?>

直接上传图片马后，用include.php?file=upload/5020230428025600.jpg即可

Pass-14 文件包含漏洞图片马2

同 Pass-13，区别在于图片马的判断不一样

Pass-15 文件包含漏洞图片马3

同 Pass-13，区别在于图片马的判断不一样

Pass-16 文件包含漏洞二次渲染

上传大图片，然后一句话换位置区块，直接二次渲染不删除一句话

Pass-17 条件竞争

需要爆破