uploads-labs文件上传漏洞通关记录

最新推荐文章于 2025-11-11 13:06:42 发布

原创

最新推荐文章于 2025-11-11 13:06:42 发布 · 1.1k 阅读

3 ·

CC 4.0 BY-SA版权

文章标签：

#文件上传漏洞 #upload-labs

本文详细记录了在upload-labs平台中通过20个关卡的文件上传漏洞利用过程，包括js检测、content-type绕过、后缀名绕过、.htaccess配置修改等各种方法，揭示了文件上传漏洞的常见检测与绕过手段，涉及php、asp、jsp等不同类型的站点。

文件上传主要看的是代码对文件各种属性的检测，说到底还是寻找代码和服务器中不严谨的地方。
对于php站来说，如果服务器的配置文件只对php后缀文件进行解析，那么我们对后缀名的修改就失效了，这也是一种加固的方法。对于asp、jsp的站也是如此。

Pass-01(js检测绕过)

js检测
1）抓包改名直接绕过。
2）控制台找到检测代码进行修改

Pass-02(content-type绕过)

后台对MIME进行检测，上传php文件，然后把content-type改为image/jpeg，然后发包马就传上去了。
在这里插入图片描述
然后使用终端工具连接就行了。

Pass-03(后缀名绕过)

对文件后缀进行了简单的过滤：

$deny_ext = array('.asp','.aspx','.php','.jsp');
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //收尾去空

抓包修改后缀为php5、php3、phtml、pht等可解析的文件后缀即可。

Pass-04(.htaccess上传修改解析配置)

.htaccess是服务器的文件解析的配置文件，如果没有过滤该后缀，那么可以上传一个.htaccess文件来修改服务器配置。
创建一个.htaccess文件，内容为SetHandler application/x-httpd-php，就是把所有的文件都当成php文件进行解析。

上传这个.htaccess文件之后，直接上传一个图片马，这个图片就可以直接被解析。

Pass-05(后缀名大小写绕过)

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
   
   
    if (file_exists(UPLOAD_PATH)) {
   
   
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空

        if (!in_array($file_ext, $deny_ext)) {
   
   
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file, $img_path)) {
   
   
                $is_upload = true;
            } else {
   
   
                $msg = '上传出错！';
            }
        } else {
   
   
            $msg = '此文件类型不允许上传！';
        }
    } else {
   
   
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

相比于上一关，对.htaccess后缀进行了过滤，但是没有对文件后缀进行大小写转换，所以可以修改大小写进行绕过。
上传木马文件，修改文件后缀为Php、PTtml等即可。

Pass-06(后缀名添加空格绕过)

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
   
   
    if (file_exists(UPLOAD_PATH)) {
   
   
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = $_FILES['upload_file']['name'];
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        
        if (!in_array($file_ext, $deny_ext)) {
   
   
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
            if (move_uploaded_file($temp_file,$img_path)) {
   
   
                $is_upload = true;
            } else {
   
   
                $msg = '上传出错！';
            }
        } else {
   
   
            $msg = '此文件不允许上传';
        }
    } else {
   
   
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}

本关没有去掉后缀名的空格，抓包改为php后缀之后再加个空格即可绕过。

Pass-07(后缀名加点绕过)

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
   
   
    if (file_exists(UPLOAD_PATH)) {
   
   
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp"

最低0.47元/天解锁文章