Analysis on the formation of upload Vulnerabilities

This article was published in section 2006.4 of the black line of defense. Please note that
Analysis on the formation of upload Vulnerabilities
Text/lonely hedgehog

After briefly introducing the investigation and completion of injection vulnerabilities, I will introduce another vulnerability, the upload vulnerability, which is more lethal than injection. Injection often results in some sensitive information in the database, such as the Administrator name and password (Note: Injection here refers to the MDB database), but the upload vulnerability is different, it uploads Trojans in ASP, JSP, CGI, PHP, and other formats to the website directory. The minimum permission is WEBSHELL, (hedgehog 2005 works) haha! Then you can get an administrator! It's exciting! OK! Then lets go!

For the search for the Upload Vulnerability, we still start with the source file. There are two targets: FilePath and FileName ).

1. FilePath
When talking about FilePath, some friends may feel unfamiliar, but you must be familiar with the mobile network 6.0 Upload Vulnerability! The upload vulnerability is caused by poor filtering of FILEPath. Although the mobile network does not have this vulnerability, there are still a lot of people using this upload source code program. For example, I am using this "Marriott download program" and the Upfile in its ADS (advertisement) section. asp (upload), there is a vulnerability that does not strictly filter Filepath (hedgehog 2005) to analyze some of its source code:
<%
Dim upload, file, formName, formPath, iCount, filename, fileExt // defines the upload variable
Set upload = new upload_5xSoft // create the test code of the uploaded object JM
FormPath = upload. form ("filepath") // The first step is to obtain the file path. This is the key.
If right (formPath, 1) <> "/" then formPath = formPath &"/"
For each formName in upload. file // use For to read uploaded files
Set file = upload. file (formName) // generate a file object jmdcw
........................ // Omit Part of the Code
FileExt = lcase (right (file. filename, 4) // extract the last four digits from the file name and convert it to lowercase characters.
If fileEXT <> ". gif "and fileEXT <> ". jpg "and fileEXT <> ". zip "and fileEXT <> ". rar "and fileEXT <> ". swf "then // file extension judgment
Response. write "<font size = 2> the file format is incorrect [<a href = # onclick = history. go (-1)> re-upload </a>] </font>"
Response. end
End if
Randomize
RanNum = int (90000 * rnd) + 10000
Filename = formPath & year (now) & month (now) & day (now) & hour (now) & minute (now) & second (now) & ranNum & fileExt // Step 2. the filename consists of the submitted file path, the random file name, year, month, and day, And the converted extension.
If file. FileSize> 0 then
File. SaveAs Server. mappath (FileName) // save the file jmdcw
End if
Set file = nothing
Next
%>
In this source code, the two key sentences are as follows:
1. formPath = upload. form ("filepath ")
2. filename = formPath & year (now) & month (now) & day (now) & hour (now) & minute (now) & second (now) & ranNum & fileExt
Ad insertion. Variables and constants: variables are the values that can change at any time during the program's operation. constants are the opposite, it refers to the value that remains unchanged during the running of the Program (hedgehog 2005 ).

The following describes how the vulnerability is formed. In the first code, obtain the file storage path from the variable filepath, and then in the second sentence, use the PATH variable formPath to add randomly generated numbers and the determined extension to form a new variable. The Filename variable is the path and name of the uploaded file. This is a little general, and the following is an example. For example, if you select “111.jpg to upload a file, a FilePath variable is also uploaded along with the file. Assume that the value is "image". When these values are uploaded to the upfile. in asp, the filename is changed to "image/200512316321944973.jpg". After the upload succeeds, the 111.jpg is saved in the image folder, and the file name is changed to "2017200512316321944973.jpg ". This process seems impeccable, but it is still a breakthrough method developed by the cow. What is the solution? The breakthrough point is on the variable. If you change the FilePath value to "image/aa. asp □”, and the subsequent "□” indicates the binary 00 (null). In this way, the variable is submitted into upfile. after asp, the Filename value is changed to "image/aa. asp □/ 200512316321944974.jpg ". When the server reads this variable," □” is a binary 00 and the variable statement is deemed to have ended, therefore, the characters after "□" are ignored, and the Filename becomes" image/aa. asp ", the program uses file. if SaveAs is saved, the file is saved as aa. asp file, look! The vulnerability has occurred.

To exploit this vulnerability, you can use the upload tool of Guilin veterans, capture packets with WinSock, save and submit data in notepad, and add and modify relevant content, use WinHex to change the space to binary, and then use the NC commit method. For more information about the above two methods, see related articles (hedgehog 2005 ).

Ii. FileName

I have introduced the vulnerability of loose filtering of FilePath. Let's take a look at the vulnerability caused by loose filtering of FileName. There are various filtering methods for loose filtering of uploaded file names, here are two types:

1. Easy to write
The Upload Vulnerability involved in "reproduce past vulnerabilities-the negligence of qinzhu music program" in section 2005.10 is a Mobile upload vulnerability. The following uses this vulnerability as an example to describe part of the source code in Upfile_Article.asp:
<%
Const UpFileType = "rar | gif | jpg | bmp | swf | mid | mp3" // supported file types: jmdcw
Const SaveUpFilesPath = ".../previusfile/Article" // directory for storing uploaded files. Note: The above two constants define the hedgehog test code in the config. asp file.
Dim upload, oFile, formName, SavePath, filename, fileExt // variable definition
........................
FoundErr = false // specifies whether to upload a variable. If the initialization is false, it indicates that the object can be uploaded.
EnableUpload = false // This is a variable that indicates whether the file extension is valid. If the initialization is false, it indicates that the file extension is invalid.
SavePath = SaveUpFilesPath // directory for storing uploaded files
........................
Sub upload_0 () // No component upload in the environment
Set upload = new upfile_class // create an upload object
........................
For each formName in upload. file // use the For loop to read uploaded files. Jmdcw
Set ofile = upload. file (formName) // generate a file object
........................
FileExt = lcase (ofile. FileExt) // convert the extension to lowercase characters
ArrUpFileType = split (UpFileType, "|") // read the allowed upload extension defined in the background
For I = 0 to ubound (arrUpFileType) // first, read the arrUpFileType array through the FOR loop.
If fileEXT = trim (arrUpFileType (I) then // if fileEXT is an extension that allows upload
EnableUpload = true // EnableUpload is true, indicating that the file is legal.
Exit
End if
Next
If fileEXT = "asp" or fileEXT = "asa" or fileEXT = "aspx" then // check whether fileEXT has the extension asp, asa, and aspx.
EnableUpload = false // if it belongs to one of the three items, EnableUpload is defined as false, and the upload file extension is invalid. Jm
End if
If EnableUpload = false then // Level 3, verification. If the variables passed to this EnableUpload are false, the file extension is invalid.
Msg = "this file type cannot be uploaded! Only the following file types can be uploaded: "& UpFileType
FoundErr = true // Note: because the file name is invalid, the FoundErr value is changed from initial false to true.
End if
StrJS = "<SCRIPT language = javascript>" & vbcrlf
If FoundErr <> true then // indicates the upload function. If FoundErr is not equal to true, the object can be uploaded.
Randomize
RanNum = int (900 * rnd) + 100
Filename = SavePath & year (now) & month (now) & day (now) & hour (now) & minute (now) & second (now) & ranNum &". "& fileExt // defines the filename. Its value is a fixed path name + year, month, day, and random value generated name + the transferred fileExt extension.
Ofile. SaveToFile Server. mappath (FileName) // save the file cws
Msg = "File Uploaded! "
........................
Next
Set upload = nothing
End sub
%>
In this source code, two FOR loops and two logical variables are used. The first FOR loop "for each formName in upload. file is used to obtain all uploaded file names. The second FOR loop "for I = 0 to ubound (arrUpFileType)" is used to detect file extensions. The two logical variables are EnableUpload and FoundErr. EnableUpload indicates the validity of the file extension. True indicates that the file extension is valid. FoundErr indicates whether the file can be uploaded. False indicates that the file can be uploaded. Is it strange? False is used! If we upload a file, the code is impeccable, but what if we want to upload two files? Because there is no component to upload in the environment, you can upload multiple files. OK! Let's take a look at the process of uploading multiple files:
First, construct a local HTM file with two upload boxes. The HTM code is as follows:
<Form action = "http://www.jmdcw.com/adminhttp://www.bkjia.com/Upfile_AdPic.asp" method = "post" name = "form1">
<Input name = "FileName1" type = "FILE" class = "tx1" size = "40">
<Input name = "FileName" type = "FILE" class = "tx1" size = "40">
<Input type = "submit" name = "Submit" value = "Upload">
</Form>
Run the htmjob and select a jpg image in the first box. The file name is 2017111.jpg. In the second box, select a Cer file named "222. cer" and click "Upload" to submit the two files to the program. Next, observe the upload process of the two files in Upfile_AdPic.asp (pay attention to the changes in logical variables ).
Callback. In the first step of verification, jpg is the type that can be uploaded, and the variable EnableUpload = true.
2. Go to the second level to check whether the data transfer is of the three types. Because the data transfer is not of the three types, the EnableUpload variable is still true.
3. Go to Level 3. If EnableUpload is set to false, FoundErr is set to true, and EnableUploa