题目

源码

<?php
$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess","ini");

        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = str_ireplace($deny_ext,"", $file_name);
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = UPLOAD_PATH.'/'.$file_name;    
        if (move_uploaded_file($temp_file, $img_path)) {
            $is_upload = true;
        } else {
            $msg = '上传出错！';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}
?>

基本过滤语法

<?php
$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
$file_name = deldot($file_name);//删除文件名末尾的点
$file_ext = strrchr($file_name, '.');//取文件后缀
$file_ext = strtolower($file_ext); //转换为小写
$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
$file_ext = trim($file_ext); //收尾去空
$file_name = str_ireplace($deny_ext,"", $file_name);//将字符串里面的黑名单后缀过滤成空

过滤代码分析

定义一个数组存放黑名单后缀于$deny_ext变量中

trim()函数：移除文件名中的空白字符shell.php

str_ireplace()函数：把文件名中存在于后缀黑名单的字符替换成空

str_ireplace($deny_ext,"", $file_name);将字符串里面的黑名单后缀过滤成空

可用22.pphphp过滤，

00截断要求：%00 or 0x00

php版本小于5.3.29
magic_quotes_gpc = Off

题目

代码

<?php
$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    $ext_arr = array('jpg','png','gif');
    $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
    if(in_array($file_ext,$ext_arr)){
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = $_GET['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;

        if(move_uploaded_file($temp_file,$img_path)){
            $is_upload = true;
        } else {
            $msg = '上传出错！';
        }
    } else{
        $msg = "只允许上传.jpg|.png|.gif类型文件！";
    }
}

分析

此处抓包分析

构造payload

$_GET['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;
../upload/时间戳.后缀
../upload/22005165.php%00  使用%00截断
上传png并在save_path后修改文件使用%00截断

POST00截断

POST需要解码，

因为在服务器中GET方式会自动解码，%00是url编码后，所以可以直接使用。

如果是POST方式，服务器不会解码，需要手动解码然后传入。

可以在后缀后面加个=替换成16进制的00