upload-labs通关（Pass-11~Pass-15）

最新推荐文章于 2025-06-30 10:25:03 发布

仙女象

最新推荐文章于 2025-06-30 10:25:03 发布

阅读量2.8k

点赞数 6

CC 4.0 BY-SA版权

分类专栏： upload-labs # 文件上传/下载/包含文章标签： php 网络安全文件上传漏洞 upload-labs web安全

本文链接：https://blog.csdn.net/elephantxiang/article/details/120660805

Pass-11

什么鬼，我都做好了上传不成功的准备，结果sh.php居然上传成功了。

一看Response报文，果然事情没有这么简单，后端自动把文件名中的php去掉了，文件名变成sh.了

这样的话，盲猜可以用双写绕过。这关直接在repeater中试一下，就不劳intruder大驾了。

果然，双写php之后，服务器上保存的文件名是sh.php，成功绕过黑名单过滤。

代码分析：

本关代码在文件名中出现黑名单中的字符串时，用str_ireplace()函数替换为啥也没有，但是这个替换它不迭代，所以采用套娃的方式双写敏感后缀就可以绕过了。

if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess","ini");

        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = str_ireplace($deny_ext,"", $file_name);
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = UPLOAD_PATH.'/'.$file_name;        
        if (move_uploaded_file($temp_file, $img_path)) {
            $is_upload = true;
        } else {
            $msg = '上传出错！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}