1、MIME說明
image.png
image.png
image.png
查詢方法:
https://www.w3school.com.cn/media/media_mimeref.asp
2、漏洞源碼
<?php
/**
* Created by 獨自等待
* Date: 14-1-22
* Time: 下午8:35
* Name: upload2.php
* 獨自等待博客：http://www.waitalone.cn/
*/
//文件上傳漏洞演示腳本之MIME驗證
$uploaddir = 'uploads/';
if (isset($_POST['submit'])) {
if (file_exists($uploaddir)) {
if (($_FILES['upfile']['type'] == 'image/gif') || ($_FILES['upfile']['type'] == 'image/jpeg') ||
($_FILES['upfile']['type'] == 'image/png') || ($_FILES['upfile']['type'] == 'image/bmp')
) {
if (move_uploaded_file($_FILES['upfile']['tmp_name'], $uploaddir . '/' . $_FILES['upfile']['name'])) {
echo '文件上傳成功，保存于：' . $uploaddir . $_FILES['upfile']['name'] . "n";
}
} else {
echo '文件類型不正確，請重新上傳！' . "n";
}
} else {
exit($uploaddir . '文件夾不存在,請手工創(chuàng)建！');
}
//print_r($_FILES);
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html;charset=gbk"/>
<meta http-equiv="content-language" content="zh-CN"/>
<title>文件上傳漏洞演示腳本--MIME驗證實例</title>
<body>
<h3>文件上傳漏洞演示腳本--MIME驗證實例</h3>
<form action="" method="post" enctype="multipart/form-data" name="upload">
請選擇要上傳的文件：<input type="file" name="upfile"/>
<input type="submit" name="submit" value="上傳"/>
</form>
</body>
</html>
3、上傳php文件類型失敗
image.png
4、再次上傳，通過burp抓包
image.png
5、修改文件類型
圖片文件的類型
image.png
修改上傳文件upload.php的文件類型
image.png
上傳成功
image.png
