upload -labs | Pass-04

upload -labs | Pass-04

Pass-04：.htaccess 文件攻击
关卡提示： 本pass禁止上传.asp|.aspx|.php|.jsp|.php5|.php4|.php3|.phtml等后缀文件！

---

核心思路： 黑名单更加全面，几乎覆盖了所有常见的 PHP 可执行后缀。此时可以利用 Apache 的 .htaccess 文件。 脚本语言

绕过方法：

第一步： 准备一个 .htaccess 文件，内容如下：

<FilesMatch "shell.jpg">
SetHandler application/x-httpd-php
</FilesMatch>

这段代码的意思是，让 Apache 将名为 shell.jpg 的文件当作 PHP 脚本来解析。

先上传这个 .htaccess 文件。

第二步： 准备一个包含 PHP 代码的图片马，文件名为 shell.jpg。 脚本语言

上传 shell.jpg。

访问 http://your-upload-labs-path/upload/shell.jpg ，你会发现其中的 PHP 代码已被当作PHP文件执行。

---

后端源码：

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array(".php",".php5",".php4",".php3",".php2","php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2","pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //收尾去空

        if (!in_array($file_ext, $deny_ext)) {
            $temp_file = $_FILES['upload_file']['tmp_name'];
            $img_path = UPLOAD_PATH.'/'.$file_name;
            if (move_uploaded_file($temp_file, $img_path)) {
                $is_upload = true;
            } else {
                $msg = '上传出错！';
            }
        } else {
            $msg = '此文件不允许上传!';
        }
    } else {
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}