upload-lads 4，

最新推荐文章于 2024-08-06 16:03:23 发布

hint=flag

最新推荐文章于 2024-08-06 16:03:23 发布

阅读量204

点赞数

CC 4.0 BY-SA版权

分类专栏：文件上传

本文链接：https://blog.youkuaiyun.com/hintll/article/details/117966087

文件上传专栏收录该内容

9 篇文章

订阅专栏

博客探讨了PHP上传文件时遇到的限制，尤其是被过滤的多种文件格式。作者尝试使用.htaccess文件来绕过解析限制，但未成功。文章提到可能后端进行了文件头检测，并引用了相关文章进行进一步研究。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

upload-lads 4

在这里插入图片描述
php传不了
看源码

看到过滤了一大堆文件格式:
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".ini");
基本上能用的绕过解析文件格式都被过滤了
那就用它:.htaccess
这个文件的大概意思是将后面上传的所有文件都按php来解释：
在这里插入图片描述
上传后在上传一个图片格式的文件
然后打开：

还是把它当作图片来解析了
查一下.htaccess的配置：

然后去看了位置：
没错呀

猜测后端检测了文件头
那就用文件头幻术：