文件上传漏洞攻击与防御

 1 POST /DVWA/vulnerabilities/upload/ HTTP/1.1
 2 Host: 127.0.0.1
 3 Content-Length: 5108
 4 Cache-Control: max-age=0
 5 Origin: http://127.0.0.1
 6 Upgrade-Insecure-Requests: 1
 7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
 8 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryJUcYpiAjyVAzt5yA
 9 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
10 Referer: http://127.0.0.1/DVWA/vulnerabilities/upload/
11 Accept-Encoding: gzip, deflate, br
12 Accept-Language: zh-CN,zh;q=0.8
13 Cookie: security=low; PHPSESSID=plp6nm81is9eotcvfo3td8thp4
14 Connection: close
15 
16 ------WebKitFormBoundaryJUcYpiAjyVAzt5yA
17 Content-Disposition: form-data; name="MAX_FILE_SIZE"
18 
19 100000
20 ------WebKitFormBoundaryJUcYpiAjyVAzt5yA
21 Content-Disposition: form-data; name="uploaded"; filename="timg.jpg"
22 Content-Type: image/jpeg
23 
24 ?? JFIF 


 H H  ? C         
25 
26     
27 
28 
29  "" $(4,$&1‘-=-157:::#+?D?8C49:7? C

30 
31 
32 
33 
34 7%%77777777777777777777777777777777777777777777777777?  ? ?
" 

?   



           
? < 


   
 !1A"Qa?25Tqs惭#B伇%3R懥$b?? 

                ? 
                ? 
  ? 騦O?昘?     無舧??X讃鞳氾簂O跁? QC +琸仅w?碑髭?遲    ???X?園gX讃鞳氾篯c]锏>k捐F溵t€灡跓5遲齝]锏>k捐[‘?:驶?|讅吁峸驹瑨浩贿*<讅觰峸驹瑸??飣]鱇琸仅w?d諤OX鞳氾篯c]锏>k捐k‘?#]锏>k鹃浩贿j|讅婿J??飣]鱉?摞S婊顔I
=c_味w?X鞳氾?2浩贿j|讅?F贿j|讅兄J?? }]鱅
35 ?qC筷(v洟1OjU鼸4@VI^?pwk?枂箥-惮B薫!闻椄輐-?3樒?TS?ィ挩c兙+nH蚥34?溒0椓‘ON苎籖?+€Od??虹?l晽VJ?Od鯧K 嫔?Σ钌瑏瑲刷汥Bg7N鉧~h?5勈骽歧??Ml-偐癯`嚥)桰?I$?妠R崇筷(TV)鞪蠟 ā怹p?臋藩F玗$A?肴,n[謕弟輊縨媩B
36 w瑘t叜m??H檌钜?? "﹖r熪~h%闕荛cs咁"綆Зtn得?镺╩<O#V?挒j陂r鬁?(28?涫 ?zoE旒W I胰"s躻qM核猋s辙踃?Um眯AW7Ｔ7T牞l哒J协}oG杵Zk?興*?k贓宦\nS
37 @罔S硙Jb々??k-m!Ζd鄈n鬾"n岚粀顶I
38 8?jび+I笰嚹塽t? u惻M;篒d{嵥嵲Z?n檞k悋t?貗爲%薧??妠N崇筷(dV)鞪繛 ā~$呮)Y#t-7^烝X蕣H?n追_婒展郱?$匆礀Fn譡duY頇幐(H箰{味V36<位芠sY蘘⊿f|n称??璓?FK劝?<q脜P^F丳鞟? ?d?隊:(郯鎁f)\旯?nX涟?*$t?杠炩爗A7貶軤Z鸀錇?? ("腬)┾闈?┹D頫? 
39 P><嵏挖縭︶z散特?  H? ?徟id宲7頭艈狁GN茊 2?Y癶K標;?蠺P狴镃^.\p煡鎠澦虚﹔45胑难4:?>x母v畷?7冚{
40 埍_FW岚蛖被jl紱?q粢毆F鎬炑@P胾o|b<e?舢8G厛?/ |V3濘?琶]徽?Xj?op诌魽Q禁?侧們懜锖馕?Ym鮍N朔8?H,盿lR筷(0嵟渐W筮?惨?K⒛e?    #逾iOG;楠c?鏇鑳驯    Dwq遁羉bj肤G? 娪?<Mk..諞愱I軤)祍:€>褍蘭N忥s$F踢揁塽瞇 嬷m儡)轸lG{黼-5PP郸0\l@??猼峽佧_f嫄?劙zz‘-$|J储帓?? 愣b?Y^pe谾?h|\Q紴雛?C{rTmoL?籎驻lm蝅???PuP掴缘M灖餧v夼M屇铓??d挚#}応车帋HK3磦-蒣諺2zV?伝N儝梧?濬毖?w[1鏳E?觔6?~歳]t欈E鬦镡J]閿Vsy栮
41 爬騈街@A泘狢东?寢鞖倭??蹭鑰"?D袟<工k瓛@^)?繛 庤蘐 3嵇?關 澁焙骈酪?朅#E厤愪荜様VF咶锈(笰>冋?蟻梎袥璿留緵1悒n薣刟懶al崙唨蹫騏?硬★杅]逯?姑(汳N蒯vX€癿瑒??佈?3&疰c媆玉
42 頕1戜gg?@芜?锚k陉kz0‘I踼H‘焸紜崛?|糌?2?0s%臂??娪栖条_桻<o
V姄H?;饭`|uQI1?x倥?┡?·閐依诹e遴y"宒s?p?捳p? 簴U梴仟轆
<-V?c*~椬u赌OG隯肀%
[侭)廌:9 ?    k汮鴊戾鳡腷竻F
43 ji?輲練? 脝bN姃z‘M<靮妯粌橃妻逗-_a?尰;H繆筲1|9覥IQ408枑#???槙4??)s?@貄V~
44 e?u嗎c
45 ?鉺+c:灋荩?N嫆?O 櫬? λΛ緄澂? 揓[-J:熾?姛鎢= QB⒈Oi拯鼾Et`BO衁 W/拮?cng 絆? 姙92鹡F??t筤姑韉4La芽涽AkP蝮殉?麜?;存 ;E_oi蜙.w$e瞯ZE佌櫎<kc!軍歛狡毁X敉teθ"|Ls3Xh袙K浌袿滈縡昝A{怗+???呡虜|q
d?8闕豯妳蝧A(#滈`/嗒j)櫥q銾雬e崅啟&=弓n?D碞sA
46 轿攂s裈懭;絣闤?0=窥瞲?0傋7此鳡閎妳攽桤飊彗`卩rW钙 fO3籥筞掊煆A?/{?蹭裖PG}l摴4$Gv雮l蟀@骝??$蘌3??0踕F)?繛 ā?pu]懅睿貸涡?A>閼憓%滕 qfe燹芟舮?F鱑0啋{伈?"D\嬢敖伕鏆0cy衱?#癴?樘f遣-餈?祷惰豮E??T>8吵Kk⑩灡畞?5T挵A)MXE?石〃鏩蘾vm@; 7嵂麵3^琺m?獙"燢H写
`? i篙莮H"栁$8?|祦慸絹6nm?A娏僡s衷藭?釵p颺/嬹?堅=厅8蛋‘Rz?Le@.x$蚝姶CR?貌??u庋?%古A醵贽泿+c襜逛[ˋ?酭SM#匾c#q穪Yh豌爹杲+琱8??郿菶箓贾P蔳?8胐汯釘澬帺`貟竨Q (    s璻嚚?3鮌簑涥＝?I$€躎幋嵇?j壟-謺= QP7O?v摄qt?me
47 o致&lO硑?誾?-鑉匕誼4蝹V溅膕银W?tq腎镠禍冄醏;报?d_L屎帹J纚裭炵D忠?g`-餢焊烠\??幵w栀膽?嵯
48 椤ip悅7讱f魄8?式砇鰑.YF:B摚攲靘阇倪A ，?熼?7?    ?CT鴫?盳蔿[?詘+ 疋嫲T革V隆睬?犲籓"y 駫季:h捺?鬼鍉_韞孯本粶F郫H??榌[b? 9w蚞@粄@崏@}<s猕7a)Is.?€乁7膀|?韢??7[给 &偤\6?樜R
49 ??涪艑JX郲 9??绠瓓枬畉?<?|??rFGl北栋A濰??扞 I$?1MqJ蠟 è『#???阱p醕e覿m呌蓃
(8罬KS%<蹵???荡騖ギ稵胀xk?€S跳?崽/@?l?G+铈巊R冇ⅹ檫Sv?]?ㄓr?{%??v)丟(t?坖-俣硒? N偾燽戶UL滹镶<敌冗P肀氦?V壹蕉潬鋹n
50 
51 ?姮ET鉛D蜽?|ys婇鴟??&?歳?押?9幁qv桿8??[赕.iK奝鷝?"7cu伃?牁9僛;B<<Qt曺溋V3
?{^(姪0?,O姞?乵
52 颾?I%KL苡6‘J蟪.IWT?R蠽2纸溵兖沧`盧S4??oZ繻N
吇奓F靛抎??勰琭!T晔瑟惠u┿m暪椹?b钞込 ?q@譒扝I$?扝臡盳繛 è/{YK婝V崇筷*炇?)狣躧儧w$騆伮2偖JY矰lPK爗衵??籧uウ锦^S脫=礩鹲[闖溊1W欅罡?屬
爈y5???姼t蹄QL挢?y??殙聼彞壓Y肞?G?*?俩+s? ?日酺U氓玛?覑賄ME婤逩?懘?{M坠hめP菗??#A钁鲫?胡?3贬昦涝>:fZ盼:劾(?坈sa蘭轿涨歭B澩AWK鄡溮)扏扞$    $扏扞$b驹嵇?N+鞪蠟 āv@?偏涃t?m?€繹惊0磾?I
?侚豯U?幦??€喑K?F?巑C乂尐格+藀犄A%舜裭0蘒???‘H]适7蒩t1?hE鶢鄥拍dVU6&]伟裁阖￥樓軪宑2T?兖T图??遰u篻?Rhm?巋#ItB?I$?扞I$?姏鈺= QB騃$S穞扐+禘?s?€c,:?II$?lQt祇侤AI$?&邯贶NJ摡庸$怶扟.?H亿$?d7q!q狪 k慾I b?d扏埐d扏扞$?
53 ------WebKitFormBoundaryJUcYpiAjyVAzt5yA
54 Content-Disposition: form-data; name="Upload"
55 
56 Upload
57 ------WebKitFormBoundaryJUcYpiAjyVAzt5yA--

 1 <?php
 2 
 3 if( isset( $_POST[ ‘Upload‘ ] ) ) {
 4     // Where are we going to be writing to?
 5     $target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
 6     $target_path .= basename( $_FILES[ ‘uploaded‘ ][ ‘name‘ ] );
 7 
 8     // Can we move the file to the upload folder?
 9     if( !move_uploaded_file( $_FILES[ ‘uploaded‘ ][ ‘tmp_name‘ ], $target_path ) ) {
10         // No
11         $html .= ‘<pre>Your image was not uploaded.</pre>‘;
12     }
13     else {
14         // Yes!
15         $html .= "<pre>{$target_path} succesfully uploaded!</pre>";
16     }
17 }
18 
19 ?>

 1 <?php
 2 
 3 if( isset( $_POST[ ‘Upload‘ ] ) ) {
 4     // Where are we going to be writing to?
 5     $target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
 6     $target_path .= basename( $_FILES[ ‘uploaded‘ ][ ‘name‘ ] );
 7 
 8     // File information
 9     $uploaded_name = $_FILES[ ‘uploaded‘ ][ ‘name‘ ];
10     $uploaded_type = $_FILES[ ‘uploaded‘ ][ ‘type‘ ];
11     $uploaded_size = $_FILES[ ‘uploaded‘ ][ ‘size‘ ];
12 
13     // Is it an image?
14     if( ( $uploaded_type == "image/jpeg" || $uploaded_type == "image/png" ) &&
15         ( $uploaded_size < 100000 ) ) {
16 
17         // Can we move the file to the upload folder?
18         if( !move_uploaded_file( $_FILES[ ‘uploaded‘ ][ ‘tmp_name‘ ], $target_path ) ) {
19             // No
20             $html .= ‘<pre>Your image was not uploaded.</pre>‘;
21         }
22         else {
23             // Yes!
24             $html .= "<pre>{$target_path} succesfully uploaded!</pre>";
25         }
26     }
27     else {
28         // Invalid file
29         $html .= ‘<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>‘;
30     }
31 }
32 
33 ?>

 1 <?php
 2 
 3 if( isset( $_POST[ ‘Upload‘ ] ) ) {
 4     // Where are we going to be writing to?
 5     $target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
 6     $target_path .= basename( $_FILES[ ‘uploaded‘ ][ ‘name‘ ] );
 7 
 8     // File information
 9     $uploaded_name = $_FILES[ ‘uploaded‘ ][ ‘name‘ ];
10     $uploaded_ext  = substr( $uploaded_name, strrpos( $uploaded_name, ‘.‘ ) + 1);
11     $uploaded_size = $_FILES[ ‘uploaded‘ ][ ‘size‘ ];
12     $uploaded_tmp  = $_FILES[ ‘uploaded‘ ][ ‘tmp_name‘ ];
13 
14     // Is it an image?
15     if( ( strtolower( $uploaded_ext ) == "jpg" || strtolower( $uploaded_ext ) == "jpeg" || strtolower( $uploaded_ext ) == "png" ) &&
16         ( $uploaded_size < 100000 ) &&
17         getimagesize( $uploaded_tmp ) ) {
18 
19         // Can we move the file to the upload folder?
20         if( !move_uploaded_file( $uploaded_tmp, $target_path ) ) {
21             // No
22             $html .= ‘<pre>Your image was not uploaded.</pre>‘;
23         }
24         else {
25             // Yes!
26             $html .= "<pre>{$target_path} succesfully uploaded!</pre>";
27         }
28     }
29     else {
30         // Invalid file
31         $html .= ‘<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>‘;
32     }
33 }
34 
35 ?>

 1 <?php
 2 
 3 if( isset( $_POST[ ‘Upload‘ ] ) ) {
 4     // Check Anti-CSRF token
 5     checkToken( $_REQUEST[ ‘user_token‘ ], $_SESSION[ ‘session_token‘ ], ‘index.php‘ );
 6 
 7 
 8     // File information
 9     $uploaded_name = $_FILES[ ‘uploaded‘ ][ ‘name‘ ];
10     $uploaded_ext  = substr( $uploaded_name, strrpos( $uploaded_name, ‘.‘ ) + 1);
11     $uploaded_size = $_FILES[ ‘uploaded‘ ][ ‘size‘ ];
12     $uploaded_type = $_FILES[ ‘uploaded‘ ][ ‘type‘ ];
13     $uploaded_tmp  = $_FILES[ ‘uploaded‘ ][ ‘tmp_name‘ ];
14 
15     // Where are we going to be writing to?
16     $target_path   = DVWA_WEB_PAGE_TO_ROOT . ‘hackable/uploads/‘;
17     //$target_file   = basename( $uploaded_name, ‘.‘ . $uploaded_ext ) . ‘-‘;
18     $target_file   =  md5( uniqid() . $uploaded_name ) . ‘.‘ . $uploaded_ext;
19     $temp_file     = ( ( ini_get( ‘upload_tmp_dir‘ ) == ‘‘ ) ? ( sys_get_temp_dir() ) : ( ini_get( ‘upload_tmp_dir‘ ) ) );
20     $temp_file    .= DIRECTORY_SEPARATOR . md5( uniqid() . $uploaded_name ) . ‘.‘ . $uploaded_ext;
21 
22     // Is it an image?
23     if( ( strtolower( $uploaded_ext ) == ‘jpg‘ || strtolower( $uploaded_ext ) == ‘jpeg‘ || strtolower( $uploaded_ext ) == ‘png‘ ) &&
24         ( $uploaded_size < 100000 ) &&
25         ( $uploaded_type == ‘image/jpeg‘ || $uploaded_type == ‘image/png‘ ) &&
26         getimagesize( $uploaded_tmp ) ) {
27 
28         // Strip any metadata, by re-encoding image (Note, using php-Imagick is recommended over php-GD)
29         if( $uploaded_type == ‘image/jpeg‘ ) {
30             $img = imagecreatefromjpeg( $uploaded_tmp );
31             imagejpeg( $img, $temp_file, 100);
32         }
33         else {
34             $img = imagecreatefrompng( $uploaded_tmp );
35             imagepng( $img, $temp_file, 9);
36         }
37         imagedestroy( $img );
38 
39         // Can we move the file to the web root from the temp folder?
40         if( rename( $temp_file, ( getcwd() . DIRECTORY_SEPARATOR . $target_path . $target_file ) ) ) {
41             // Yes!
42             $html .= "<pre><a href=‘${target_path}${target_file}‘>${target_file}</a> succesfully uploaded!</pre>";
43         }
44         else {
45             // No
46             $html .= ‘<pre>Your image was not uploaded.</pre>‘;
47         }
48 
49         // Delete any temp files
50         if( file_exists( $temp_file ) )
51             unlink( $temp_file );
52     }
53     else {
54         // Invalid file
55         $html .= ‘<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>‘;
56     }
57 }
58 
59 // Generate Anti-CSRF token
60 generateSessionToken();
61 
62 ?>