文件上传-Windows点空格点绕过

[题目信息]：

题目名称	题目难度
文件上传-Windows点空格点绕过	1

[题目考点]：

复制代码

Windowsw文件特性考察

[Flag格式]:

复制代码

SangFor{UDOaJfziTs4c-dceIyGxa53-Ybrg9dtF}

[环境部署]：

docker-compose.yml文件或者docker tar原始文件。

复制代码

docker-compose up -d

[题目writeup]：

1、实验主页

2、使用dirsearch扫描备份文件；

扫描到index.txt备份文件；

修改Url地址内容，将index.txt修改为indeX.txt；发现可以成功访问；

证明服务端服务器是Linux系统；

3、代码分析

复制代码

<?php
include "config.php";
function deldot($s){
    for($i = strlen($s)-1;$i>0;$i--){
        $c = substr($s,$i,1);
        if($i == strlen($s)-1 and $c != '.'){
            return $s;
        }

`if($c != '.'){ return substr($s,0,$i+1); } } `

}

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
if (file_exists(UPLOAD_PATH)) {
$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
$file_name = trim($_FILES['upload_file']['name']);
$file_name = deldot($file_name);//删除文件名末尾的点 #1
$file_ext = strrchr($file_name, '.');
$file_ext = strtolower($file_ext); //转换为小写 #2
$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA #3
$file_ext = trim($file_ext); //首尾去空 #4

复制代码

`    if (!in_array($file_ext, $deny_ext)) {
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = UPLOAD_PATH.'/'.$file_name;
        if (move_uploaded_file($temp_file, $img_path)) {
            $is_upload = true;
        } else {
            echo $msg = '上传出错！';
        }
    } else {
        echo $msg = '此文件类型不允许上传！';
    }
} else {
    echo $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
}
`

}
?>

#1处删除末尾的点；
#2处将上传的文件名转换为小写；
#3处如果上传文件后缀包含::$DATA，会替换为空；
#4处去除前后空格；

那么前面所述的4种Windows绕过方案均无法使用；

但是假设我们上传的文件后缀为.php. .（php点号空格点号）

#1删除点号，剩余点号空格，#4删除空格，剩余点号，那么php.可以绕过黑名单验证；

3、上传jpg文件进行抓包；

抓包之后修改文件后缀为.php进行测试；

修改文件后缀为. .（点空格点）

证明该文件已经上传成功

访问upload/1.php

php文件成功解析；