upload -labs | Pass-09 ~ 10（Windows环境)

Pass-09：后缀名大小写绕过

Pass-09：路径拼接绕过
关卡提示： 本pass查看的配置文件是黑名单，但是禁止上传.php|.php5|.php4|.php3|.phtml等后缀！同时将上传的文件重新重命名！

核心思路： 虽然代码进行了重命名，但在重命名前，有一个 str_ireplace 操作，试图删除文件名中的 ::$DATA。

绕过方法：

在 Windows 系统中，::$DATA 是 NTFS 文件系统的 数据流特性，在保存文件时会被忽略。

我们可以构造文件名：shell.php::$DATA。

服务端代码 str_ireplace(‘::$DATA', “”, \(fileName) 会将其中的 ::\)DATA 删除，文件名变为 shell.php，从而通过后续的黑名单检查。

文件最终被保存时，::$DATA 被 Windows 系统忽略，于是成功写入 shell.php。

---

Pass-10：(点+php+点+空格+点)绕过

---

题目源码：

$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);//删除文件名末尾的点
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); //转换为小写
        $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
        $file_ext = trim($file_ext); //首尾去空
       #将文件名进行过滤操作后，将文件名拼接在路径后面，所以需要绕过前面的首尾去空以及去点。