[红日安全]Web安全Day5 - 任意文件上传实战攻防

上传头像
上传相册
上传附件
添加文章图片
前台留言资料上传
编辑器文件上传
......

PHP:
php2、php3、php5、phtml、pht(是否解析需要根据配置文件中设置类型来决定)
ASP：
asa、cer、cdx
ASPX：
ascx、ashx、asac
JSP：
jsp、jspx、jspf

Content-Type绕过
前端绕过
文件解析规则绕过
Windows环境特性绕过
文件名大小写绕过
双写绕过
点空格绕过
文件头绕过
条件竞争绕过
......

1、当创建.asp的文件目录的时候，在此目录下的任意文件，服务器都解析为asp文件。例如如下：
漏洞目录利用形式：www.xxx.com/xx.asp/xx.jpg。
xx.jpg的内容可以为一段合法的asp脚本文件。

2、服务器默认不解析”;“以后的内容，导致xx.asp;.jpg被解析成xx.asp
漏洞文件利用形式：www.xxx.com/xx.asp;.jpg
xx.jpg的内容可以为一段合法的asp脚本文件。

通过对IIS6的核心文件类型解析相关文件的逆向后，整理出下面的核心处理代码。
//reverse code by golds7n with ida
int __thiscall Url(void *this, char *UrlStruct)
{
  void *pW3_URL_INFO; // esi@1
  int bSuccess; // eax@1
  const wchar_t *i; // eax@2
  wchar_t *wcsSlashTemp; // ebx@6
  int wcsTemp; // eax@6
  int wcs_Exten; // eax@6
  int v8; // esi@9
  int v10; // eax@11
  int v11; // ST04_4@13
  int v12; // eax@13
  int ExtenDll; // eax@19
  int Extenisa; // eax@20
  int ExtenExe; // eax@21
  int ExtenCgi; // eax@22
  int ExtenCom; // eax@23
  int ExtenMap; // eax@24
  int Entry; // [sp+Ch] [bp-148h]@6
  wchar_t *wcsMaohaoTemp; // [sp+10h] [bp-144h]@6
  unsigned int dotCount; // [sp+14h] [bp-140h]@1
  wchar_t *Str; // [sp+18h] [bp-13Ch]@3
  char *url_FileName; // [sp+1Ch] [bp-138h]@1
  char Url_FileExtenName; // [sp+20h] [bp-134h]@1
  char v25; // [sp+50h] [bp-104h]@1

 dotCount = 0;
  pW3_URL_INFO = this;
  STRU::STRU(&Url_FileExtenName, &v25, 0x100u);
  url_FileName = (char *)pW3_URL_INFO + 228;
  bSuccess = STRU::Copy((char *)pW3_URL_INFO + 228, UrlStruct);
  if ( bSuccess < 0 )
    goto SubEnd;
  for ( i = (const wchar_t *)STRU::QueryStr((char *)pW3_URL_INFO + 228); ; i = Str + 1 )
  {
    Str = _wcschr(i, '.');   ***********N1************
    if ( !Str )
      break;
    ++dotCount;
    if ( dotCount > W3_URL_INFO::sm_cMaxDots )
      break;
    bSuccess = STRU::Copy(&Url_FileExtenName, Str);
    if ( bSuccess < 0 )
      goto SubEnd;
    wcsSlashTemp = _wcschr(Str, '/'); ***********N2************
    JUMPOUT(wcsSlashTemp, 0, loc_5A63FD37);
    wcsTemp = STRU::QueryStr(&Url_FileExtenName);
    wcsMaohaoTemp = _wcschr((const wchar_t *)wcsTemp, ':');  ***********N3************
    JUMPOUT(wcsMaohaoTemp, 0, loc_5A63FD51);
    wcs_Exten = STRU::QueryStr(&Url_FileExtenName);
    __wcslwr((wchar_t *)wcs_Exten);
    if ( META_SCRIPT_MAP::FindEntry(&Url_FileExtenName, &Entry) )
    {
      *((_DWORD *)pW3_URL_INFO + 201) = Entry;
      JUMPOUT(wcsSlashTemp, 0, loc_5A63FDAD);
      STRU::Reset((char *)pW3_URL_INFO + 404);
      break;
    }
    if ( STRU::QueryCCH(&Url_FileExtenName) == 4 )
    {
      ExtenDll = STRU::QueryStr(&Url_FileExtenName);
      if ( !_wcscmp(L".dll", (const wchar_t *)ExtenDll)
        || (Extenisa = STRU::QueryStr(&Url_FileExtenName), !_wcscmp(L".isa", (const wchar_t *)Extenisa)) )
        JUMPOUT(loc_5A63FD89);
      ExtenExe = STRU::QueryStr(&Url_FileExtenName);
      if ( !_wcscmp(L".exe", (const wchar_t *)ExtenExe)
        || (ExtenCgi = STRU::QueryStr(&Url_FileExtenName), !_wcscmp(L".cgi", (const wchar_t *)ExtenCgi))
        || (ExtenCom = STRU::QueryStr(&Url_FileExtenName), !_wcscmp(L".com", (const wchar_t *)ExtenCom)) )
        JUMPOUT(loc_5A63FD89);
      ExtenMap = STRU::QueryStr(&Url_FileExtenName);
      JUMPOUT(_wcscmp(L".map", (const wchar_t *)ExtenMap), 0, loc_5A63FD7B);
    }
  }
  if ( *((_DWORD *)pW3_URL_INFO + 201)
    || (v10 = *((_DWORD *)pW3_URL_INFO + 202), v10 == 3)
    || v10 == 2
    || (v11 = *(_DWORD *)(*((_DWORD *)pW3_URL_INFO + 204) + 0xC4C),
        v12 = STRU::QueryStr(url_FileName),
        bSuccess = SelectMimeMappingForFileExt(v12, v11, (char *)pW3_URL_INFO + 756, (char *)pW3_URL_INFO + 1012),
        bSuccess >= 0) )
    v8 = 0;
  else
SubEnd:
    v8 = bSuccess;
  STRU::_STRU(&Url_FileExtenName);
  return v8;
}

www.xxx.com/xxx.asp;xxx.jpg
N1:从头部查找查找"."号,获得".asp;xxxx.jpg"
N2:查找";"号,如果有则内存截断
N3:查找"/",如果有则内存截断

www.xxxx.com/apache.php.bbb.aaa

地址：http://httpd.apache.org/docs/current/mod/directive-dict.html

extension
In general, this is the part of the filename which follows the last dot. However, Apache recognizes multiple filename extensions, so if a filename contains more than one dot, each dot-separated part of the filename following the first dot is an extension. For example, the filename file.html.en contains two extensions: .html and .en. For Apache directives, you may specify extensions with or without the leading dot. In addition, extensions are not case sensitive.

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    $ext_arr = array('jpg','png','gif');
    $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
    if(in_array($file_ext,$ext_arr)){
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = $_POST['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;

        if(move_uploaded_file($temp_file,$img_path)){
            $is_upload = true;
        } else {
            $msg = "上传失败";
        }
    } else {
        $msg = "只允许上传.jpg|.png|.gif类型文件！";
    }
}

function getReailFileType($filename){
    $file = fopen($filename, "rb");
    $bin = fread($file, 2); //只读2字节
    fclose($file);
    $strInfo = @unpack("C2chars", $bin);    
    $typeCode = intval($strInfo['chars1'].$strInfo['chars2']);    
    $fileType = '';    
    switch($typeCode){      
        case 255216:            
            $fileType = 'jpg';
            break;
        case 13780:            
            $fileType = 'png';
            break;        
        case 7173:            
            $fileType = 'gif';
            break;
        default:            
            $fileType = 'unknown';
        }    
        return $fileType;
}

$is_upload = false;
$msg = null;
if(isset($_POST['submit'])){
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $file_type = getReailFileType($temp_file);

    if($file_type == 'unknown'){
        $msg = "文件未知，上传失败！";
    }else{
        $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);  //此处为了方便演示添加了file_ext 变量
        $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").".".$file_ext;
        if(move_uploaded_file($temp_file,$img_path)){
            $is_upload = true;
        } else {
            $msg = "上传出错！";
        }
    }
}

python upload-fuzz-dic-builder.py -n test -a jpg -l php -m apache --os win -o upload_file.txt

docker-compose up -d

docker-compose logs | grep password
查看结果：
weblogic_1  |       ----> 'weblogic' admin password: oZUcqr8j
weblogic_1  | admin password  : [oZUcqr8j]
weblogic_1  | *  password assigned to an admin-level user.  For *

/u01/oracle/user_projects/domains/base_domain/servers/AdminServer/tmp/_WL_internal/com.oracle.webservices.wls.ws-testclient-app-wls/4mcj4y/war/css

/u01/oracle/user_projects/domains/base_domain/tmp/WSTestPageWorkDir

文件地址： \fckeditor\editor\filemanager\browser\default\connectors\php\config.php

array('html','htm','php','php2','php3','php4','php5','phtml','pwml','inc','asp','aspx','ascx','jsp','cfm','cfc','pl','bat','exe','com','dll','vbs','js','reg','cgi','htaccess','asis','sh','shtml','shtm','phtm')

http://localhost/fckeditor/editor/filemanager/browser/default/connectors/uploads/file/05091707156.php

if(isset($_POST['submit'])){
    $ext_arr = array('jpg','png','gif');
    $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
    if(in_array($file_ext,$ext_arr)){
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = UPLOAD_PATH.'/'.rand(10, 99).date("YmdHis").".".$file_ext;

        if(move_uploaded_file($temp_file,$img_path)){
            $is_upload = true;
        } else {
            $msg = "上传失败";
        }
    } else {
        $msg = "只允许上传.jpg|.png|.gif类型文件！";
    }
}