something about DVWA - File Upload
DVWA
File Upload(文件上传)
Low
手动测试
手动上传恶意文件
上传
bad.php。访问恶意文件
1
http://train.com/dvwa/vulnerabilities/upload/../../hackable/uploads/bad.php
源码分析
从
request中获取上传的文件1
2
3// Where are we going to be writing to?
$target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
$target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );将文件移动至指定目录
1
2
3
4
5
6// Can we move the file to the upload folder?
if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) {
// failure
} else {
// success
}
Medium
手动测试
将恶意文件扩展名更改为
.png,上传使用
burpsuite拦截上传请求，将文件扩展名更改回.php这样，上传请求的
Content-Type为image/png，文件却为php。
源码分析
从
request中获取上传的文件与
Low级别相同。获取文件上传信息
1
2
3
4// File information
$uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
$uploaded_type = $_FILES[ 'uploaded' ][ 'type' ];
$uploaded_size = $_FILES[ 'uploaded' ][ 'size' ];判断
HTTP的Content-Type属性1
2
3
4
5// Is it an image?
if( ( $uploaded_type == "image/jpeg" ||$uploaded_type == "image/png" ) &&
( $uploaded_size < 100000 ) ) {
// yes
}将文件移动至指定目录
与
Low级别相同。
High
手动测试
将恶意文件扩展名更改为
.png,并在文件头处添加文件头信息1
2
3
4
5
6
7GIF98
// 将文件头设置为`GIF98`
phpinfo();上传后使用
File Inclusion漏洞包含此文件1
2# File Inclusion High
http://train.com/dvwa/vulnerabilities/fi/?page=file://C:\xampp\htdocs\DVWA\hackable\uploads/bad.png
源码分析
从
request中获取上传的文件与
Medium级别相同。获取
HTTP的Content-Type;文件信息1
2
3
4
5
6// File information
$uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
$uploaded_ext = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1);
$uploaded_size = $_FILES[ 'uploaded' ][ 'size' ];
$uploaded_type = $_FILES[ 'uploaded' ][ 'type' ];
$uploaded_tmp = $_FILES[ 'uploaded' ][ 'tmp_name' ];判断
HTTP的Content-Type;文件类型为image;文件头检测1
2
3
4
5
6
7
8
9
10// 判断文件扩展名
// Is it an image?
if( ( strtolower( $uploaded_ext ) == 'jpg' || strtolower( $uploaded_ext ) == 'jpeg' || strtolower( $uploaded_ext ) == 'png' ) &&
( $uploaded_size < 100000 ) &&
( $uploaded_type == 'image/jpeg' || $uploaded_type == 'image/png' ) &&
getimagesize( $uploaded_tmp ) ) {
// getimagesize(file) 限制文件大小，并通过文件头判断文件类型
}将文件移动至指定目录
与
Medium级别相同。
Impossible
源码分析
使用
token验证身份1
2// Check Anti-CSRF token
checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );获取
HTTP的Content-Type与文件信息与
High级别相同。将文件 重命名 后移动至指定目录
1
2
3// 使用md5加密文件名
//$target_file = basename( $uploaded_name, '.' . $uploaded_ext ) . '-';
$target_file = md5( uniqid() . $uploaded_name ) . '.' . $uploaded_ext;1
2
3
4// Can we move the file to the web root from the temp folder?
if( rename( $temp_file, ( getcwd() . DIRECTORY_SEPARATOR . $target_path . $target_file ) ) ) {
// yes
}
文件头
常见文件头
type header bmp 424D gif GIF98 jpeg FF D8 FF jpg FF D8 FF png 89 50 4E 47 0D 0A zip 504B0304