黑基网 首页 学院 网络安全 查看内容

Web黑客:文件上传漏洞入侵解析

2017-8-23 01:12| 投稿: xiaotiger |来自: 互联网

摘要: 工具:weevely介绍:主要用于生成PHP后门文件。功能:流程记录:第一步:生成密码为123456,位置在本机桌面上的后门文件,目的是用于上传。weevely generate 123456 /root/桌面/backdoor.php第二步:尝试上传正常图 ...

工具:weevely

介绍:主要用于生成PHP后门文件。

功能:

流程记录:

第一步:生成密码为123456,位置在本机桌面上的后门文件,目的是用于上传。

weevely generate 123456 /root/桌面/backdoor.php

第二步:尝试上传正常图片文件

可能出现的错误:

提示很明显,是没有相关的权限,粗暴的解决方法是所有都给最高权限777,但是从专业角度来看,这样不好。可是,我新手,随意。命令:

chmod -R 777 /opt/lampp

由于防御等级我选择的是低级,所以,正常图片文件上传可以,后门shell上传也可以。看一下源代码:

前端

首先分析前端代码。提交的方式是表单POST提交。选择文件按钮的name是"uploaded",这就说明后端肯定是用$_POST来收集uploaded的值。

前端

upload按钮对应的就是表单的submit提交按钮。只要用户选择好文件,一旦点击提交,那么后端就会利用$_POST来收集到对应的文件。

那么,这里就有可能存在一个漏洞。那就是,后端是否对收集到的文件信息做检测?比如若是要求提交图片信息,那用户提交视频会怎样?这里的PHP代码必须得做出筛选,否则就会产生严重的漏洞。

第三步:验证是否存在上面所说的漏洞,提交weevely生成的后门shell。然后利用weevely远程连接

可以看出,文件上传在了往上面两级的hackable……后门的文件夹中。于是,结合当前页面的url,就可以推断出我们shell后门的正确地址url。利用weevely远程访问即可。

命令: weevely URL [password]

像这么容易就上传异类文件成功的,说明PHP后台代码安全方面写的实在是不好。当然,这是我刻意将防御等级变成low的结果。

远程连接后可以干嘛?目前,还没有接触到提权的知识。所以,我只能随便看看,只要该系统中有相关的可读文件,那么我们都可以看。可以让攻击者得到更多的系统信息。(只要攻击者会相关的命令)

下面,进行后端代码的分析:

很明显,这里的代码就是,用户只要上传了,就给用户存储,不管用户上传的是什么玩意儿。因此攻击者可以攻击成功。

下面,来看一下如何针对中级防御的网站进行文件上传入侵。(未待完续,觉得不错就关注,这是我个人学习笔记。第一时间发布在简书——FKTX)

小编推荐:欲学习电脑技术、系统维护、网络管理、编程开发和安全攻防等高端IT技术,请 点击这里 注册黑基账号,公开课频道价值万元IT培训教程免费学,让您少走弯路、事半功倍,好工作升职加薪!

本文出自:http://www.toutiao.com/i6456984496959914510/

免责声明:本文由投稿者转载自互联网,版权归原作者所有,文中所述不代表本站观点,若有侵权或转载等不当之处请联系我们处理,让我们一起为维护良好的互联网秩序而努力!联系方式见网站首页右下角。


鲜花

握手

雷人

路过

鸡蛋

相关阅读

发表评论

最新评论

引用 游客 2017-11-30 10:39
Z0tBe5  <a href="http://yunalfccodfz.com/">yunalfccodfz</a>, [url=http://awqlitohvdim.com/]awqlitohvdim[/url], [link=http://ltgfssnckvpp.com/]ltgfssnckvpp[/link], http://rokxwqzeecju.com/
引用 游客 2017-11-30 09:10
4RXhQ4  <a href="http://rmawiofzkihg.com/">rmawiofzkihg</a>, [url=http://fxryekveuyvy.com/]fxryekveuyvy[/url], [link=http://mxqxsfecmlyp.com/]mxqxsfecmlyp[/link], http://umbgcorewkwg.com/
引用 游客 2017-11-30 07:38
dwIs4O  <a href="http://psirtxkxspzj.com/">psirtxkxspzj</a>, [url=http://ysxjstjpyykv.com/]ysxjstjpyykv[/url], [link=http://sbedntxohtjx.com/]sbedntxohtjx[/link], http://hczfskcimugz.com/
引用 游客 2017-11-30 06:03
refGMQ  <a href="http://fhxbeodvlhso.com/">fhxbeodvlhso</a>, [url=http://cxhwyahvnhrz.com/]cxhwyahvnhrz[/url], [link=http://pfzmldjpkwtp.com/]pfzmldjpkwtp[/link], http://kqgferxvhanz.com/
引用 游客 2017-11-30 04:07
QwFZ5O  <a href="http://jretnnyjotly.com/">jretnnyjotly</a>, [url=http://kirdlebahacr.com/]kirdlebahacr[/url], [link=http://bfxjabmzbrgc.com/]bfxjabmzbrgc[/link], http://vrxulwwnunbk.com/
引用 游客 2017-11-30 00:17
XLEAiP http://www.LnAJ7K8QSpfMO2wQ8gO.com
引用 游客 2017-11-23 13:03
Whereabouts in  are you from? <a href=" http://avanafil.blog.hu/ ">cheap avanafil</a>  Whether Sanchez beat Smith in the competition became irrelevant when he injured his shoulder in the fourth quarter of the third preseason game, after Rex Ryan threw out his veteran behind a second-team offensive line. Marvin Austin crunched Sanchez near the left sideline as the Jets attempted to beat the Giants in a meaningless game.
引用 游客 2017-11-23 04:03
Just over two years <a href=" 茂禄驴http://avanafil.blog.hu/#hump ">buy avanafil</a>  Find a toothbrush that suits you, says Price, who likens the process to selecting dinnerware. "If it's comfortable in your hand, you'll use it very nicely." So if your mouth is small, you might want to consider a child-size toothbrush, he says. And whether it's a toothbrush or toothpaste, look for the ADA endorsement on the package, which will indicate the bristles are strong enough to remove pl ...
引用 游客 2017-11-17 17:34
DEtyGM  <a href="http://fraymfqcalpp.com/">fraymfqcalpp</a>, [url=http://iibsrjgcaxrr.com/]iibsrjgcaxrr[/url], [link=http://oddwgihhwlwv.com/]oddwgihhwlwv[/link], http://cgnbcwlwkjcx.com/
引用 游客 2017-11-17 16:13
NIH7XP  <a href="http://barywgomzlog.com/">barywgomzlog</a>, [url=http://rihnqcrvqdjd.com/]rihnqcrvqdjd[/url], [link=http://zaczvszfowgm.com/]zaczvszfowgm[/link], http://tayaflkgmjco.com/
引用 游客 2017-11-16 07:35
I want to make a withdrawal <a href=" http://goldentabs.com/search?q=naprosyn ">goldentabs naprosyn</a>  A deteriorating outlook for the PC industry has made a dealmore challenging, and the buyout group is currently not planningto increase its $13.65 per share offer to take Dell private,people familiar with the matter said on Wednesday.
引用 游客 2017-11-16 07:35
I've just started at  <a href=" http://goldentabs.com/categories/Erectile-Dysfunction/Buy-Cheap-Suhagra.html ">cheap suhagra</a>  Still, CREA Chief Economist Gregory Klump said stronger thanexpected sales are probably due to the fact mortgage rates haveinched higher and buyers either want to make a deal before theyrise further or before their pre-approved rate expires.
引用 游客 2017-11-16 07:35
Get a job <a href=" http://goldentabs.com/search?q=dapoxetine ">buy dapoxetine</a>  Net revenue rose 22 percent to $344.5 million, on the highend of Lululemon's guidance. This compared with the average analyst forecast of $343 million. Comparable store sales rose 8percent for the quarter on a constant dollar basis.
引用 游客 2017-11-16 07:35
It's a bad line <a href=" http://goldentabs.com/categories/Erectile-Dysfunction/Buy-Cheap-Brand-Cialis.html ">goldentabs cialis</a>  The ABI also called for fewer banks to be involved in IPOs, ** the process of setting a sale price that reflected the value of the company more efficient. Only three banks should run sales worth more than 250 million pounds ($370 million) while smaller deals should be restricted to two institutions, it said.
引用 游客 2017-11-16 07:35
Have you read any good books lately? <a href=" http://goldentabs.com/search?q=naprosyn#permanent ">cheap naprosyn</a>  Ken Levine's epic earns its keep with perhaps the best gaming story so far this year, even if the combat did grow slightly tedious by the game's very end. Booker DeWitt's trip through the floating city of Columbia has him unraveling a unique mystery, and Elizabeth is easily one of the most memorable sidekicks in gaming. She's even more interesting because of how she  ...
引用 游客 2017-11-16 06:43
Insufficient funds <a href=" 茂禄驴http://goldentabs.com/search?q=levitra#pod ">cheap levitra</a>  A mobile phone application called e-Soko was given to farmers in 2007. The app is designed to save farmers time and help them find the best deal, by sending automated text messages with the latest market prices.
引用 游客 2017-11-16 06:43
A few months <a href=" 茂禄驴http://goldentabs.com/search?q=levitra ">buy levitra</a>  According to a new report by Rep. Henry Waxman, D-Calif., one of Congress's staunchest proponents of climate policy, the 10 congressional districts that experienced the highest number of temperature records last year are represented by politicians who voted against climate-related policies 97 percent of the time during the last Congress.
引用 游客 2017-11-16 06:43
It's OK <a href=" http://goldentabs.com/search?q=dapoxetine ">goldentabs dapoxetine</a>  Telecom Italia stuck to its other full-year targets forstable organic revenue and adjusted net debt falling to below 27billion euros from 28.8 billion at end-June. ($1 = 0.7557 euros) (Reporting by Danilo Masoni; Editing by David Holmes)
引用 游客 2017-11-16 05:51
I'm not working at the moment <a href=" http://goldentabs.com/search?q=dapoxetine ">goldentabs dapoxetine</a>  By the end of 2012, about 64 percent of transplanted organs in China came from executed prisoners and the number has dipped to under 54 percent so far this year, according to figures provided by Huang.
引用 游客 2017-11-16 05:50
I'm unemployed <a href=" 茂禄驴http://goldentabs.com/search?q=levitra#grasshopper ">order levitra
</a>  "That means no one should consider any reports, articles or [any other] rumors reliable unless they come directly from me &ndash; and I can guarantee you they won't," he said. "We all understand the goal that we are working toward - two states living side by side in peace and security, two states because two proud peoples each deserve a country to call their own." ...

查看全部评论(30)


新出炉

返回顶部