文件上传漏洞 · PHP笔记

审计函数：move_uploaded_file 超全局变量$_FILES 可能造成漏洞的原因：一：后缀名是图片格式二：前缀名不能是外部提交的三：上传的目录不可以是获取外部提交的路径 1.asp;/1213.asp.jpg 防御 1. 使用白名单方式检测文件后缀 2. 上传之后按时间能算法生成文件名称 3. 上传目录脚本文件不可执行 4. 注意%00 截 5. Content-Type 验证 ``` <form action="" method="post" autocomplete="off" enctype="multipart/form-data"> <input type="file" name="uploadfile"> <input type="submit" name="upload" value="确定上传"> </form> <?php var_export($_FILES); //结果： array ( 'uploadfile' => array ( 'name' => 'favicon.ico', 'type' => 'image/x-icon', 'tmp_name' => 'C:\\Windows\\phpD9D.tmp', 'error' => 0, 'size' => 16958, ), ) array ( 'uploadfile' => array ( 'name' => '哈哈哈.jpeg', 'type' => 'image/jpeg', 'tmp_name' => 'C:\\Windows\\php881B.tmp', 'error' => 0, 'size' => 39521, ), ) //.php后缀时 array ( 'uploadfile' => array ( 'name' => 'test.php', 'type' => 'application/octet-stream',//Content-type 'tmp_name' => 'C:\\Windows\\php3452.tmp', 'error' => 0, 'size' => 1225, ), ) //可以使用抓包软件（fiddle、wireshark、burpLoader）拦截请求修改Content-type逮到绕过Content-type的限制 ``` [telnet模拟get、post请求](telnet%E6%A8%A1%E6%8B%9Fget%E3%80%81post%E8%AF%B7%E6%B1%82.md) 上传漏洞绕过Content-type ``` <?php header("Content-type: text/html; charset=utf-8"); if (isset($_POST['upload'])&&!empty($_POST['upload'])) { if ($_FILES['uploadfile']['type']!='image/jpeg') { //这里时可以串改的 exit('error:上传文件不是正确图像'); }else{ $filename=iconv('utf-8','gb2312',$_FILES['uploadfile']['name']); $upfile="./upfile".'/'.rand(1,5).$filename; if (is_uploaded_file($_FILES['uploadfile']['tmp_name'])) { if (!move_uploaded_file($_FILES['uploadfile']['tmp_name'],$upfile)) { exit('移动文件失败'); }else{ echo '上传成功，路径是：'.$upfile; } } } } ?> <!DOCTYPE html> <html lang="zh-cn"> <head> <meta charset="utf-8"> <title>服务端验证绕过(Content-Type绕过)</title>  <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> </head> <body> <form action="" method="post" autocomplete="off" enctype="multipart/form-data"> <input type="file" name="uploadfile"> <input type="submit" name="upload" value="确定上传"> </form> </body> </html> ```