当前位置：网站首页>[try to hack] upload labs (temporarily write to 12)

[try to hack] upload labs (temporarily write to 12)

2022-06-13 04:37:00 【Happy star】

Blog home page ： Happy star The blog home page of
Series column ：Try to Hack
Welcome to focus on the likes collection ️ Leaving a message.
Starting time ：2022 year 6 month 12 Japan
The author's level is very limited , If an error is found , Please let me know , thank ！

Insert picture description here

Navigation assistant

Pass-01 JS Detection bypass

Usually, the upload page contains special detection files to upload JavaScript Code , The most common is to check whether the extension is legal 

function checkFile() {
    
    var file = document.getElementsByName('upload_file')[0].value;
    if (file == null || file == "") {
    
        alert(" Please select the file to upload !");
        return false;
    }
    // Define the types of files allowed to be uploaded 
    var allow_ext = ".jpg|.png|.gif";
    // Extract the type of uploaded file 
    var ext_name = file.substring(file.lastIndexOf("."));
    // Determine whether the type of uploaded file is allowed to be uploaded 
    if (allow_ext.indexOf(ext_name + "|") == -1) {
    
        var errMsg = " The file is not allowed to upload , Please upload " + allow_ext + " Files of type , The current file type is ：" + ext_name;
        alert(errMsg);
        return false;
    }
}

Determine the method of this kind of detection ： Select a file upload type that prohibits uploading , Click the OK button , The browser immediately pop-up prompt forbids uploading , Generally, it can be concluded that it is a client JavaScript testing

Bypass method ：
1、 Disable front end js
Google browser -> Set up -> Security and privacy settings -> Website setup ->javascript
Insert picture description here

2、 Change the type of malicious code file that needs to be uploaded to the type that allows uploading , For example, will shell.php Change it to shell.jpg Upload , To configure Burp Suite The agent captures packets , Then the file name is overwritten shell.php
Insert picture description here

3、 Upload shell.jpg.php, Maybe when the front-end program checks the suffix , Check from the front .

Pass-02 MIME Verify bypass (Content-Type)

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    if (file_exists($UPLOAD_ADDR)) {
    
        if (($_FILES['upload_file']['type'] == 'image/jpeg') || ($_FILES['upload_file']['type'] == 'image/png') || ($_FILES['upload_file']['type'] == 'image/gif')) {
    
            if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {
    
                $img_path = $UPLOAD_ADDR . $_FILES['upload_file']['name'];
                $is_upload = true;

            }
        } else {
    
            $msg = ' Incorrect file type , Please upload again ！';
        }
    } else {
    
        $msg = $UPLOAD_ADDR.' Folder does not exist , Please create... By hand ！';
    }
}

No suffix detection , Upload shell.php
Insert picture description here
Insert picture description here

Pass-03 Filtering is not strict 

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    if (file_exists($UPLOAD_ADDR)) {
    
        $deny_ext = array('.asp','.aspx','.php','.jsp');
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);// Delete the point at the end of the filename 
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); // Convert to lowercase 
        $file_ext = str_ireplace('::$DATA', '', $file_ext);// Remove strings ::$DATA
        $file_ext = trim($file_ext); // Close out and leave it empty 

        if(!in_array($file_ext, $deny_ext)) {
    
            if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR. '/' . $_FILES['upload_file']['name'])) {
    
                 $img_path = $UPLOAD_ADDR .'/'. $_FILES['upload_file']['name'];
                 $is_upload = true;
            }
        } else {
    
            $msg = ' Upload is not allowed .asp,.aspx,.php,.jsp Suffix file ！';
        }
    } else {
    
        $msg = $UPLOAD_ADDR . ' Folder does not exist , Please create... By hand ！';
    }
}

Some commonly used executable file script suffixes ：

・ php , php2 , php3 , php5 , phtml

・ asp , cer , asa , cdx

・ aspx , ascx , ashx・ jsp , jspx

・py

Whether to resolve or not depends on the type set in the configuration file
Need modification Apache Of httpd.conf file
Insert picture description here
Search for AddType
Add the following
AddType application/x-httpd-php .php .phtml .phps .php5 .pht
Insert picture description here

take shell.php Change it to shell.php3 upload

Pass-04 .htaccess Bypass 

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    if (file_exists($UPLOAD_ADDR)) {
    
        $deny_ext = array(".php",".php5",".php4",".php3",".php2","php1",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2","pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);// Delete the point at the end of the filename 
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); // Convert to lowercase 
        $file_ext = str_ireplace('::$DATA', '', $file_ext);// Remove strings ::$DATA
        $file_ext = trim($file_ext); // Close out and leave it empty 

        if (!in_array($file_ext, $deny_ext)) {
    
            if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {
    
                $img_path = $UPLOAD_ADDR . $_FILES['upload_file']['name'];
                $is_upload = true;
            }
        } else {
    
            $msg = ' This file is not allowed to upload !';
        }
    } else {
    
        $msg = $UPLOAD_ADDR . ' Folder does not exist , Please create... By hand ！';
    }
}

.htaccess file ( perhaps ” Distributed profile ”） Provides a way to change the configuration for the directory , namely , In a particular Place a file containing one or more instructions in the document directory , To apply to this directory and all its subdirectories . So a special Under the fixed directory .htaccess The instructions in the file may overwrite the instructions in its parent directory .htaccess Instruction in file , That is, the instructions in the subdirectory will overwrite the instructions in the parent directory or the main configuration file

Let's create a .htaccess file , The contents are as follows , Upload it 

<FilesMatch "shell.png">
SetHandler application/x-httpd-php
</FilesMatch>

It means if there is one in the file shell.png The file of , He will be interpreted as .php

take shell.php Change it to shell.png, Upload directly

Pass-05 Case around 

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    if (file_exists($UPLOAD_ADDR)) {
    
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);// Delete the point at the end of the filename 
        $file_ext = strrchr($file_name, '.');
        $file_ext = str_ireplace('::$DATA', '', $file_ext);// Remove strings ::$DATA
        $file_ext = trim($file_ext); // Head to tail 

        if (!in_array($file_ext, $deny_ext)) {
    
            if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {
    
                $img_path = $UPLOAD_ADDR . '/' . $file_name;
                $is_upload = true;
            }
        } else {
    
            $msg = ' This file is not allowed to upload ';
        }
    } else {
    
        $msg = $UPLOAD_ADDR . ' Folder does not exist , Please create... By hand ！';
    }
}

take shell.php Change it to shell.PHP Upload directly

Pass-06 Space around

windows Wait for the system , After the file is named by suffixes plus spaces, spaces are automatically deleted by default 

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    if (file_exists($UPLOAD_ADDR)) {
    
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);// Delete the point at the end of the filename 
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); // Convert to lowercase 
        $file_ext = str_ireplace('::$DATA', '', $file_ext);// Remove strings ::$DATA
        
        if (!in_array($file_ext, $deny_ext)) {
    
            if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {
    
                $img_path = $UPLOAD_ADDR . '/' . $file_name;
                $is_upload = true;
            }
        } else {
    
            $msg = ' This file is not allowed to upload ';
        }
    } else {
    
        $msg = $UPLOAD_ADDR . ' Folder does not exist , Please create... By hand ！';
    }
}

take shell.php Change it to shell.php Space
Add a space

Cannot be modified directly , It needs to be modified
Insert picture description here

Pass-07 Point around

The same principle as space bypass , The main reason is windows The system deletes the file suffix by default . And Spaces 

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    if (file_exists($UPLOAD_ADDR)) {
    
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); // Convert to lowercase 
        $file_ext = str_ireplace('::$DATA', '', $file_ext);// Remove strings ::$DATA
        $file_ext = trim($file_ext); // Head to tail 
        
        if (!in_array($file_ext, $deny_ext)) {
    
            if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {
    
                $img_path = $UPLOAD_ADDR . '/' . $file_name;
                $is_upload = true;
            }
        } else {
    
            $msg = ' This file is not allowed to upload ';
        }
    } else {
    
        $msg = $UPLOAD_ADDR . ' Folder does not exist , Please create... By hand ！';
    }
}

Also add some directly , It can't be added , Need to grab bags
Insert picture description here

Pass-08 ::$DATA Bypass

::$DATA Data flow , The default data stream has no name . have access to FindFirstStreamW and FindNextStreamW Function to enumerate data streams .

Yes NTFS For a file in the format , Contains at least one stream , namely data flow （ Its stream type by $DATA）,data Stream is the mainstream of file , default data Liuqi stream name It's empty . The default is a file. If a stream is specified , And the stream does not stream type It will be automatically added during storage $DATA. For example, the example seen above myfile.txt:stream1:$DATA When stored, it is actually for myfile.txt:stream1, But in the query results, you need to remove :$DATA, Otherwise, parameter errors will occur , This is notepad Can't support the flow well .

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    if (file_exists($UPLOAD_ADDR)) {
    
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);// Delete the point at the end of the filename 
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); // Convert to lowercase 
        $file_ext = trim($file_ext); // Head to tail 
        
        if (!in_array($file_ext, $deny_ext)) {
    
            if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {
    
                $img_path = $UPLOAD_ADDR . '/' . $file_name;
                $is_upload = true;
            }
        } else {
    
            $msg = ' This file is not allowed to upload ';
        }
    } else {
    
        $msg = $UPLOAD_ADDR . ' Folder does not exist , Please create... By hand ！';
    }
}

utilize windows System NTFS features ,burpsuite Grab the bag , Change the suffix to php::$DATA
Insert picture description here

Pass-09 Dot and space to bypass 

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    if (file_exists($UPLOAD_ADDR)) {
    
        $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);// Delete the point at the end of the filename 
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); // Convert to lowercase 
        $file_ext = str_ireplace('::$DATA', '', $file_ext);// Remove strings ::$DATA
        $file_ext = trim($file_ext); // Head to tail 
        
        if (!in_array($file_ext, $deny_ext)) {
    
            if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $_FILES['upload_file']['name'])) {
    
                $img_path = $UPLOAD_ADDR . '/' . $file_name;
                $is_upload = true;
            }
        } else {
    
            $msg = ' This file is not allowed to upload ';
        }
    } else {
    
        $msg = $UPLOAD_ADDR . ' Folder does not exist , Please create... By hand ！';
    }
}

It first deletes the dot after the suffix , Then delete the space .
take shell.php Change it to shell.php. Space . 

		$file_name = trim($_FILES['upload_file']['name']);
        $file_name = deldot($file_name);// Delete the point at the end of the filename 
        $file_ext = strrchr($file_name, '.');
        $file_ext = strtolower($file_ext); // Convert to lowercase 
        $file_ext = str_ireplace('::$DATA', '', $file_ext);// Remove strings ::$DATA
        $file_ext = trim($file_ext); // Head to tail

It becomes shell.php.
So successfully bypass
also windows Feature automatically removes points

Grab the bag
Insert picture description here

Pass-10 Double writing bypasses 

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    if (file_exists($UPLOAD_ADDR)) {
    
        $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");

        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = str_ireplace($deny_ext,"", $file_name);
        if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $UPLOAD_ADDR . '/' . $file_name)) {
    
            $img_path = $UPLOAD_ADDR . '/' .$file_name;
            $is_upload = true;
        }
    } else {
    
        $msg = $UPLOAD_ADDR . ' Folder does not exist , Please create... By hand ！';
    }
}

modify shell.php by shell.pphphp
Upload directly

Pass-11 %00 Bypass

Read the source code and find , Is to change the save name of the file ( Change to random number ), The purpose is to let us not know the file name , So you can't access 

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    
    $ext_arr = array('jpg','png','gif');
    $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
    if(in_array($file_ext,$ext_arr)){
    
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = $_GET['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;

        if(move_uploaded_file($temp_file,$img_path)){
    
            $is_upload = true;
        }
        else{
    
            $msg = ' Upload failed ！';
        }
    }
    else{
    
        $msg = " Only upload is allowed .jpg|.png|.gif Type file ！";
    }
}

Upload shell.php Try to grab a bag
Insert picture description here
Found file save path

We will shell.php Change it to shell.png Bypass suffix judgment , Then change the file saving path to ../upload/shell.php%00
Use %00 You can truncate the following random numbers
Insert picture description here

It will become shell.php%00/878179172.png
(878179172 Is a random number )
Warning ： This is not a legal path
Upload failed
Insert picture description here
But the general idea is like this

Pass-12 00 Bypass

The code is the same as the previous question 

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    
    $ext_arr = array('jpg','png','gif');
    $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
    if(in_array($file_ext,$ext_arr)){
    
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = $_POST['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;

        if(move_uploaded_file($temp_file,$img_path)){
    
            $is_upload = true;
        }
        else{
    
            $msg = " Upload failed ";
        }
    }
    else{
    
        $msg = " Only upload is allowed .jpg|.png|.gif Type file ！";
    }
}

take shell.php Change it to shell.png, Grab and upload
Insert picture description here
I found that this time save_path No longer url in （get The ginseng ） 了 , But in post Parameters in .
post Parameters in %00 Will be considered a string , So we can't just add （ But it still works 00 truncation ）

Bypass method ：
First the save_path Change it to ../upload/shell.php+
The plus sign is used for positioning and placeholder
Insert picture description here

Switch to hex, find
Insert picture description here
The plus sign is 2b
Change it to 00 It can be truncated

Pass-13 Header bypass 

function getReailFileType($filename){
    
    $file = fopen($filename, "rb");
    $bin = fread($file, 2); // read-only 2 byte 
    fclose($file);
    $strInfo = @unpack("C2chars", $bin);    
    $typeCode = intval($strInfo['chars1'].$strInfo['chars2']);    
    $fileType = '';    
    switch($typeCode){
          
        case 255216:            
            $fileType = 'jpg';
            break;
        case 13780:            
            $fileType = 'png';
            break;        
        case 7173:            
            $fileType = 'gif';
            break;
        default:            
            $fileType = 'unknown';
        }    
        return $fileType;
}

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $file_type = getReailFileType($temp_file);

    if($file_type == 'unknown'){
    
        $msg = " File unknown , Upload failed ！";
    }else{
    
        $img_path = $UPLOAD_ADDR."/".rand(10, 99).date("YmdHis").".".$file_type;
        if(move_uploaded_file($temp_file,$img_path)){
    
            $is_upload = true;
        }
        else{
    
            $msg = " Upload failed ";
        }
    }

Pass-14 Bypass 

function isImage($filename){
    
    $types = '.jpeg|.png|.gif';
    if(file_exists($filename)){
    
        $info = getimagesize($filename);
        $ext = image_type_to_extension($info[2]);
        if(stripos($types,$ext)){
    
            return $ext;
        }else{
    
            return false;
        }
    }else{
    
        return false;
    }
}

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $res = isImage($temp_file);
    if(!$res){
    
        $msg = " File unknown , Upload failed ！";
    }else{
    
        $img_path = $UPLOAD_ADDR."/".rand(10, 99).date("YmdHis").$res;
        if(move_uploaded_file($temp_file,$img_path)){
    
            $is_upload = true;
        }
        else{
    
            $msg = " Upload failed ";
        }
    }
}

getimagesize() Can be jpg,gif Wait for the size of the picture type and return the size , This function is also used to determine the image type .

Pass-15 Bypass 

function isImage($filename){
    
    // Need to open php_exif modular 
    $image_type = exif_imagetype($filename);
    switch ($image_type) {
    
        case IMAGETYPE_GIF:
            return "gif";
            break;
        case IMAGETYPE_JPEG:
            return "jpg";
            break;
        case IMAGETYPE_PNG:
            return "png";
            break;    
        default:
            return false;
            break;
    }
}

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $res = isImage($temp_file);
    if(!$res){
    
        $msg = " File unknown , Upload failed ！";
    }else{
    
        $img_path = $UPLOAD_ADDR."/".rand(10, 99).date("YmdHis").".".$res;
        if(move_uploaded_file($temp_file,$img_path)){
    
            $is_upload = true;
        }
        else{
    
            $msg = " Upload failed ";
        }
    }
}

exif_imagetype() Function to get the picture type

Pass-16 Bypass 

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])){
    
    //  Get the basic information of the uploaded file , file name , type , size , Temporary file path 
    $filename = $_FILES['upload_file']['name'];
    $filetype = $_FILES['upload_file']['type'];
    $tmpname = $_FILES['upload_file']['tmp_name'];

    $target_path=$UPLOAD_ADDR.basename($filename);

    //  Get the extension of the uploaded file 
    $fileext= substr(strrchr($filename,"."),1);

    // Judge file suffix and type , Upload only when it is legal 
    if(($fileext == "jpg") && ($filetype=="image/jpeg")){
    
        if(move_uploaded_file($tmpname,$target_path))
        {
    
            // Use the uploaded image to generate a new image 
            $im = imagecreatefromjpeg($target_path);

            if($im == false){
    
                $msg = " The file is not jpg Format picture ！";
            }else{
    
                // Assign a file name to the new image 
                srand(time());
                $newfilename = strval(rand()).".jpg";
                $newimagepath = $UPLOAD_ADDR.$newfilename;
                imagejpeg($im,$newimagepath);
                // Show the second rendered image （ Use new images generated by users uploading images ）
                $img_path = $UPLOAD_ADDR.$newfilename;
                unlink($target_path);
                $is_upload = true;
            }
        }
        else
        {
    
            $msg = " Upload failed ！";
        }

    }else if(($fileext == "png") && ($filetype=="image/png")){
    
        if(move_uploaded_file($tmpname,$target_path))
        {
    
            // Use the uploaded image to generate a new image 
            $im = imagecreatefrompng($target_path);

            if($im == false){
    
                $msg = " The file is not png Format picture ！";
            }else{
    
                 // Assign a file name to the new image 
                srand(time());
                $newfilename = strval(rand()).".png";
                $newimagepath = $UPLOAD_ADDR.$newfilename;
                imagepng($im,$newimagepath);
                // Show the second rendered image （ Use new images generated by users uploading images ）
                $img_path = $UPLOAD_ADDR.$newfilename;
                unlink($target_path);
                $is_upload = true;               
            }
        }
        else
        {
    
            $msg = " Upload failed ！";
        }

    }else if(($fileext == "gif") && ($filetype=="image/gif")){
    
        if(move_uploaded_file($tmpname,$target_path))
        {
    
            // Use the uploaded image to generate a new image 
            $im = imagecreatefromgif($target_path);
            if($im == false){
    
                $msg = " The file is not gif Format picture ！";
            }else{
    
                // Assign a file name to the new image 
                srand(time());
                $newfilename = strval(rand()).".gif";
                $newimagepath = $UPLOAD_ADDR.$newfilename;
                imagegif($im,$newimagepath);
                // Show the second rendered image （ Use new images generated by users uploading images ）
                $img_path = $UPLOAD_ADDR.$newfilename;
                unlink($target_path);
                $is_upload = true;
            }
        }
        else
        {
    
            $msg = " Upload failed ！";
        }
    }else{
    
        $msg = " Only upload suffixes are allowed .jpg|.png|.gif The picture file of ！";
    }
}

Pass-17 Bypass 

$is_upload = false;
$msg = null;

if(isset($_POST['submit'])){
    
    $ext_arr = array('jpg','png','gif');
    $file_name = $_FILES['upload_file']['name'];
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $file_ext = substr($file_name,strrpos($file_name,".")+1);
    $upload_file = $UPLOAD_ADDR . '/' . $file_name;

    if(move_uploaded_file($temp_file, $upload_file)){
    
        if(in_array($file_ext,$ext_arr)){
    
             $img_path = $UPLOAD_ADDR . '/'. rand(10, 99).date("YmdHis").".".$file_ext;
             rename($upload_file, $img_path);
             unlink($upload_file);
             $is_upload = true;
        }else{
    
            $msg = " Only upload is allowed .jpg|.png|.gif Type file ！";
            unlink($upload_file);
        }
    }else{
    
        $msg = ' Upload failed ！';
    }
}

Pass-18 Bypass

Pass-19 Bypass 

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    
    if (file_exists($UPLOAD_ADDR)) {
    
        $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");

        $file_name = $_POST['save_name'];
        $file_ext = pathinfo($file_name,PATHINFO_EXTENSION);

        if(!in_array($file_ext,$deny_ext)) {
    
            $img_path = $UPLOAD_ADDR . '/' .$file_name;
            if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $img_path)) {
     
                $is_upload = true;
            }else{
    
                $msg = ' Upload failed ！';
            }
        }else{
    
            $msg = ' Do not save as this type of file ！';
        }

    } else {
    
        $msg = $UPLOAD_ADDR . ' Folder does not exist , Please create... By hand ！';
    }
原网站

版权声明
本文为[Happy star]所创，转载请带上原文链接，感谢
https://yzsam.com/2022/164/202206130423287165.html

边栏推荐

猜你喜欢

随机推荐