Example analysis of web file upload vulnerabilities

File upload function module

The file upload function is a necessary function for most WEB applications. Websites allow users to upload their own avatars, some social networking sites allow users to upload photos, and some services Websites like this require users to upload electronic files of supporting materials, and e-commerce websites allow users to upload pictures to show product conditions, etc. Without adequate security measures, even a seemingly insignificant file upload function can face extremely high security risks.

Principle of File Upload Vulnerability

When a user uploads a file in the file upload function module, if the WEB application There is no effective verification of file security during the upload process. Attackers can attack the server by uploading malicious files such as WEBshell. In this case, it is believed that the system has a file upload vulnerability.

File upload vulnerability---webshell

The most common method of file upload vulnerability is to upload website Trojan horse (webshell) file. WEBSHELL is also called web page Trojan horse file. According to Different development languages ​​are divided into ASP Trojans, PHP Trojans, JSP Trojans, etc. This type of Trojan takes advantage of the system command execution, file reading and writing functions in the script language. Once uploaded to the server and parsed by the script engine, the attacker can Control of the server can be achieved.

Website Trojan (webshell) files are divided into big horses and small horses (one sentence Trojan), picture horses, etc.

Da Ma: The function is relatively good and can be used with the browser; the amount of code is usually Larger; the concealment is relatively weak, the amount of code is large, and features usually need to be hidden through encryption and other methods.

Xiao Ma: The function is simple and needs to be used with the client; the code size is usually small; the concealment is relatively strong, and it is easy to hide features through deformation and bypass filtering. It is usually used together with the cknife tool.

Picture Horse: When a website restricts uploading to image-related formats, attackers cannot bypass the restriction and can try to use Picture Horse to implement webshell operations.

File upload vulnerability bypasses restrictions

In one sentence, the Trojan is similar to . Trojan files are uploaded to the server through the file upload module. The parameter v in $_POST['v'] is the parameter we can use. We pass the instruction we want to execute to the server through parameter v for execution; or use the cknife tool to operate the target server.

(1) The upload format of this webpage is restricted and needs to comply with the following types of formats: jpg, jpeg, JPG, and JPEG, so the original format is changed to 1.jpg format (server-side calibration Verification)

Open the burp suite software to intercept the data packet and change the file name to 1.php so that the php script can be run. Otherwise, although the file with the jpg suffix can Uploaded, but it didn't work.

Define v=phpinfo() in the hackbar plug-in; you can view a large amount of information about the current status of php

(2) This page limits the upload format (MIME). You need to change the file format to JPEG or PNG (server-side verification)

Use burp suite to intercept information and change content-Type to image/png

Use hackbar tool to define parameter v=phoinfo(); view PHP status information

(3) This page filters the file suffix and does not accept PHP type files (server-side verification)

Open the burp suite software to intercept the information, change the file name to 1.PHp, and bypass the identification of the web server

Use hackbar to define v=system (ipconfig);

(4) Use truncation to truncate the jpg. This sentence is somewhat confusing. The correct way to write it should be: 1. Use " 2. When using "

1.php

The above is the detailed content of Example analysis of web file upload vulnerabilities. For more information, please follow other related articles on the PHP Chinese website!