How to upload a Trojan in php in one sentence

Several common methods for uploading Trojans in one sentence:

1. Use 00 to truncate, brupsuite upload

Use 00 Truncation takes advantage of programmers' lax filtering of file upload paths when writing programs, resulting in the 0X00 upload truncation vulnerability.
Assume that the upload path of the file is http://xx.xx.xx.xx/upfiles/lubr.php.jpg. Use Burpsuite to capture and truncate the file and replace the "." after lubr.php with "0X00". When uploading, when the file system reads "0X00", it will think that the file has ended, and the content of lubr.php.jpg will be written to lubr.php to achieve the purpose of attack.

2. Construct server-side extension detection and upload

When the browser submits the file to the server, the server will check the browser based on the set blacklist The submitted file extension is tested. If the uploaded file extension does not meet the blacklist restrictions, it will not be uploaded, otherwise the upload will be successful.
This example explains how to change the file name of the one-sentence Trojan lubr.php to lubr.php.abc. First, when the server verifies the file extension, it verifies .abc. As long as the extension is changed to comply with the server-side blacklist rules, it can be uploaded. In addition, when the file is accessed on the browser side, if Apache cannot parse the .abc extension, it will look forward for a parsable extension, that is, ".php". The one-sentence Trojan can be parsed and connected via a Chinese chopper.

3, Bypass Content-Type detection file type upload

When the browser uploads files to the server, the server The file Content-Type type is detected. If it is allowed by the whitelist, it can be uploaded normally, otherwise the upload will fail. To bypass Content-Type file type detection, use Burpsuite to intercept and modify the Content-Type of the file in the data package to make it comply with the whitelist rules and achieve the purpose of uploading.

4. Construct a picture Trojan to bypass file content detection and upload Shell

Generally, file content verification uses the gettimeagesize() function to detect whether the file is a valid file. Pictures, if so, are allowed to be uploaded, otherwise they are not allowed to be uploaded.

Recommended tutorial: PHP video tutorial

The above is the detailed content of How to upload a Trojan in php in one sentence. For more information, please follow other related articles on the PHP Chinese website!