upload-labs靶场Pass-05
upload-labs靶场Pass-05
大小写绕过
$deny_ext = array(“.php”,“.php5”,“.php4”,“.php3”,“.php2”,“.html”,“.htm”,“.phtml”,“.pht”,“.pHp”,“.pHp5”,“.pHp4”,“.pHp3”,“.pHp2”,“.Html”,“.Htm”,“.pHtml”,“.jsp”,“.jspa”,“.jspx”,“.jsw”,“.jsv”,“.jspf”,“.jtml”,“.jSp”,“.jSpx”,“.jSpa”,“.jSw”,“.jSv”,“.jSpf”,“.jHtml”,“.asp”,“.aspx”,“.asa”,“.asax”,“.ascx”,“.ashx”,“.asmx”,“.cer”,“.aSp”,“.aSpx”,“.aSa”,“.aSax”,“.aScx”,“.aShx”,“.aSmx”,“.cEr”,“.sWf”,“.swf”,“.htaccess”);
f i l e n a m e = t r i m ( file_name = trim( filename=trim(_FILES[‘upload_file’][‘name’]);
分析源码,依旧是黑名单绕过,发现源码中没有进行大小写转换,
考虑大小写绕过
将上传文件后缀修改为phP等黑名单中没有的就可以绕过。