[Network Security] Upload-labs Pass-21 Detailed Analysis of Problem Solving

Readers can refer to and subscribe to the column: Upload-Labs shooting range offensive and defensive combat

Antsword Ant Sword

The use of Ant Sword tool can refer to:

[Network Security] AntSword (ant sword) actual combat problem solving detailed analysis (entry)

[Network Security] DVWA's File Upload—AntSword (Ant Sword) attack posture and detailed analysis of problem solving collection

posture

Backend logic code:

<?php
include '../config.php';
include '../common.php';
include '../head.php';
include '../menu.php';


if (isset($_POST['submit'])) {
    
    
    if (file_exists(UPLOAD_PATH)) {
    
    

        $is_upload = false;
        $msg = null;
        if(!empty($_FILES['upload_file'])){
    
    
            //mime check
            $allow_type = array('image/jpeg','image/png','image/gif');
            if(!in_array($_FILES['upload_file']['type'],$allow_type)){
    
    
                $msg = "禁止上传该类型文件!";
            }else{
    
    
                //check filename
                $file = empty($_POST['save_name']) ? $_FILES['upload_file']['name'] : $_POST['save_name'];
                if (!is_array($file)) {
    
    
                    $file = explode('.', strtolower($file));
                }

                $ext = end($file);
                $allow_suffix = array('jpg','png','gif');
                if (!in_array($ext, $allow_suffix)) {
    
    
                    $msg = "禁止上传该后缀文件!";
                }else{
    
    
                    $file_name = reset($file) . '.' . $file[count($file) - 1];
                    $temp_file = $_FILES['upload_file']['tmp_name'];
                    $img_path = UPLOAD_PATH . '/' .$file_name;
                    if (move_uploaded_file($temp_file, $img_path)) {
    
    
                        $msg = "文件上传成功！";
                        $is_upload = true;
                    } else {
    
    
                        $msg = "文件上传失败！";
                    }
                }
            }
        }else{
    
    
            $msg = "请选择要上传的文件！";
        }
        
    } else {
    
    
        $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
    }
}



?>

<div id="upload_panel">
    <ol>
        <li>
            <h3>任务</h3>
            <p>上传一个<code>webshell</code>到服务器。</p>
        </li>
        <li>
            <h3>上传区</h3>
            <form enctype="multipart/form-data" method="post">
                <p>请选择要上传的图片：<p>
                <input class="input_file" type="file" name="upload_file"/>
                <p>保存名称:<p>
                <input class="input_text" type="text" name="save_name" value="upload-20.jpg" /><br/>
                <input class="button" type="submit" name="submit" value="上传"/>
            </form>
            <div id="msg">
                <?php 
                    if($msg != null){
    
    
                        echo "提示：".$msg;
                    }
                ?>
            </div>
            <div id="img">
                <?php
                    if($is_upload){
    
    
                        echo '<img src="'.$img_path.'" width="250px" />';
                    }
                ?>
            </div>
        </li>
        <?php 
            if($_GET['action'] == "show_code"){
    
    
                include 'show_code.php';
            }
        ?>
    </ol>
</div>

<?php
include '../footer.php';
?>

!is_array($file)Determine $filewhether the variable is an array type. If it is not an array type, use explode('.', strtolower($file))to split the file name according to the dot. The split result is an array containing the filename and file suffix.

Finally, strtolower()the file suffix is converted to lowercase by a function.

Capture packets:

insert image description here

From the code audit, change the package:

insert image description here

Packing:

insert image description here

The path is:

insert image description here

Connect Ant Sword:

insert image description here

Summarize

The above is a detailed analysis of [Network Security] upload-labs Pass-21 problem solving. So far, the problem solving of upload-labs shooting range has been completed.

I am Qiu said , see you next time.