Attackers can bypass the faisunzip. php compression program to package the entire site program.

As required by JJ, write an analysis source code process:


Attackers can bypass the faisunzip compression program to package the entire site program.
When I scanned the website today, I found a compressed file program: zip. php.



Why can't I enter the code? Here I want to bypass the program and check the program code:


 

Then, I constructed the parameters through the hidden domain of Firefox login to this step:

 

Click to submit:

 

Tip: No file is selected or the directory description is helpful:

I continue to check that the Code does exist.

 

Let's look up;

 

Okay, let's look for the dfile array control.

 


Okay. We can still construct these parameters on the login page.


 
After the two statements are added, an error is reported when the package is large, but the operation still succeeds. When an error is reported, the path can be exposed.


 
And construct the following html to do this.
<Input type = "hidden" value = "dozip" id = "myaction" name = "myaction">
<Input name = "dfile []" type = 'checkbox' value = "/usr/home/hmu080012" checked>
Package again.
The prompt is packed.