文件上傳漏洞 · PHP筆記

審計函數：move_uploaded_file 超全局變量$_FILES 可能造成漏洞的原因：一：后綴名是圖片格式二：前綴名不能是外部提交的三：上傳的目錄不可以是獲取外部提交的路徑 1.asp;/1213.asp.jpg 防御 1. 使用白名單方式檢測文件后綴 2. 上傳之后按時間能算法生成文件名稱 3. 上傳目錄腳本文件不可執行 4. 注意%00 截 5. Content-Type 驗證 ``` <form action="" method="post" autocomplete="off" enctype="multipart/form-data"> <input type="file" name="uploadfile"> <input type="submit" name="upload" value="確定上傳"> </form> <?php var_export($_FILES); //結果： array ( 'uploadfile' => array ( 'name' => 'favicon.ico', 'type' => 'image/x-icon', 'tmp_name' => 'C:\\Windows\\phpD9D.tmp', 'error' => 0, 'size' => 16958, ), ) array ( 'uploadfile' => array ( 'name' => '哈哈哈.jpeg', 'type' => 'image/jpeg', 'tmp_name' => 'C:\\Windows\\php881B.tmp', 'error' => 0, 'size' => 39521, ), ) //.php后綴時 array ( 'uploadfile' => array ( 'name' => 'test.php', 'type' => 'application/octet-stream',//Content-type 'tmp_name' => 'C:\\Windows\\php3452.tmp', 'error' => 0, 'size' => 1225, ), ) //可以使用抓包軟件（fiddle、wireshark、burpLoader）攔截請求修改Content-type逮到繞過Content-type的限制 ``` [telnet模擬get、post請求](telnet%E6%A8%A1%E6%8B%9Fget%E3%80%81post%E8%AF%B7%E6%B1%82.md) 上傳漏洞繞過Content-type ``` <?php header("Content-type: text/html; charset=utf-8"); if (isset($_POST['upload'])&&!empty($_POST['upload'])) { if ($_FILES['uploadfile']['type']!='image/jpeg') { //這里時可以串改的 exit('error:上傳文件不是正確圖像'); }else{ $filename=iconv('utf-8','gb2312',$_FILES['uploadfile']['name']); $upfile="./upfile".'/'.rand(1,5).$filename; if (is_uploaded_file($_FILES['uploadfile']['tmp_name'])) { if (!move_uploaded_file($_FILES['uploadfile']['tmp_name'],$upfile)) { exit('移動文件失敗'); }else{ echo '上傳成功，路徑是：'.$upfile; } } } } ?> <!DOCTYPE html> <html lang="zh-cn"> <head> <meta charset="utf-8"> <title>服務端驗證繞過(Content-Type繞過)</title>  <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> </head> <body> <form action="" method="post" autocomplete="off" enctype="multipart/form-data"> <input type="file" name="uploadfile"> <input type="submit" name="upload" value="確定上傳"> </form> </body> </html> ```