奇安信攻防社区-记一次文件上传

记一次文件上传

0x00 挖Src遇到的一个小tips 记录一下。 0x01 前台注册用户登录后台上传头像的一个点正常上传jsp webshell + jpg 后缀 [![](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-283...

#### 0x00

挖Src遇到的一个小tips 记录一下。

#### 0x01

前台注册用户登录后台上传头像的一个点  
正常上传jsp webshell + jpg 后缀  
[![](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-28313a573d2b699600230a86e76107ab82b30a10.jpg)](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-28313a573d2b699600230a86e76107ab82b30a10.jpg)  
返回500  
我们更改jpg内容为正常jpg内容,可以看见成功上传  
[![](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-815586a12b5c00a6e7d9c5953f5261774688acdf.jpg)](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-815586a12b5c00a6e7d9c5953f5261774688acdf.jpg)  
这里的返回成功上传,是给了个跳转.  
将返回的url decode后.得到上传的图片url地址如下(网站域名用xxx代替了)  
[![](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-fe5e3c6936511cd8fe464a0ffb7320cbf0fd119a.jpg)](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-fe5e3c6936511cd8fe464a0ffb7320cbf0fd119a.jpg)  
到这里会发现,返回的地址部分路径在我们上传图片的时候,是可控的? 那么我们尝试更改上传时的地址,看看是否可以成功上传custom\_name 参数 =&gt; 文件名  
folader 参数-&gt; 目录(拼接在dir参数的目录后)  
dir 参数-&gt; 上传到的目录(有限制,只能设置特定的几个目录)  
[![](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-2ce260b9fb90168a9b1db38916a9ecd15b5a7591.jpg)](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-2ce260b9fb90168a9b1db38916a9ecd15b5a7591.jpg)  
可以发现,的确是成功上传了.那么查看文件是否存在,访问一下  
`http://xxx/files/scude_recruit/image/test/test.jpg`  
[![](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-bd40abf746741a3fa44e6a080477591e0259b315.jpg)](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-bd40abf746741a3fa44e6a080477591e0259b315.jpg)  
成功上传jpg

#### 0x02 文件后缀绕过

在直接更改为jsp后缀上传时,返回Error了  
[![](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-800a77042977059036ef0fa1e44ef6820e6ed8a3.jpg)](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-800a77042977059036ef0fa1e44ef6820e6ed8a3.jpg)  
报错信息我们url decode一下,可以发现貌似是白名单  
[![](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-60861e255de9b02d69fa3f5f40758cfcfe35f255.jpg)](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-60861e255de9b02d69fa3f5f40758cfcfe35f255.jpg)  
那么正常绕过思路就行不通了  
在前面的上传中,发现还有个images参数为可控量,我们尝试更改后上传  
[![](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-c2aba38528d50c2f35fa39e18d0852d176492280.jpg)](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-c2aba38528d50c2f35fa39e18d0852d176492280.jpg)  
在更改为test目录后,发现报错返回了只能更改的几个目录相继进行更改后,发现每个目录都限制了特定的文件内容  
这里更改为file目录测试  
[![](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-209ce1c8f6b18af3e36dd5a0a235ab005aa31360.jpg)](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-209ce1c8f6b18af3e36dd5a0a235ab005aa31360.jpg)  
限制了部分后缀,更改为txt后缀上传  
[![](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-1cdb15a17e5c0f88436d4493bf5bfd7500196df6.jpg)](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-1cdb15a17e5c0f88436d4493bf5bfd7500196df6.jpg)  
能够直接上传  
后端貌似是检测POST data中参数后缀,我们是否能尝试之前得到的custom\_name参数来进行上传呢  
POST中上传的文件后缀更改为"txt",Get中custom\_name参数更改为1.jspx  
[![](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-fceb69dbba337830457b94bf3680dc39f8fc5920.jpg)](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-fceb69dbba337830457b94bf3680dc39f8fc5920.jpg)  
url decode后发现成功上传,访问看看存不存在  
[![](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-0a85780764f3e71ffbccf5543770a1b52a8a6ae7.jpg)](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-0a85780764f3e71ffbccf5543770a1b52a8a6ae7.jpg)  
存在,但不解析

#### 0x03 跨目录Getshell

在之前上传文件的时候,可以得到文件上传的jsp文件所在目录,那么我们尝试../跨目录上传到能解析jsp的目录下  
[![](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-6fb8ff788fd32b4963366d37a8582c49d0ea97a8.png)](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-6fb8ff788fd32b4963366d37a8582c49d0ea97a8.png)  
访问  
[http://xxx/files/scude\_recruit/file/../../../files\_upload/1.jspx](http://xxx/files/scude_recruit/file/../../../files_upload/1.jspx)  
[![](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-53d79af54b397f1ce3e716eaf8de4db71be8124a.png)](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-53d79af54b397f1ce3e716eaf8de4db71be8124a.png)  
成功解析,最后上个cmd马  
[![](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-5faf219a3d685ca3d8606cf07688608569b5d898.jpg)](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-5faf219a3d685ca3d8606cf07688608569b5d898.jpg)  
[![](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-251d1a613725ce9e934f14bbe46658af0f13a15c.png)](https://shs3.b.qianxin.com/attack_forum/2021/07/attach-251d1a613725ce9e934f14bbe46658af0f13a15c.png)

发表于 2021-07-15 11:50:06
阅读 ( 5512 )
分类：漏洞分析

记一次文件上传

0 条评论