[ Natas 12 -> Natas 13 웹쉘(Webshell) ]

[ Natas 12 -> Natas 13 웹쉘(Webshell) ]

2017. 9. 23. 18:41ㆍNetworkHacking/[OverTheWire]Vortex

1> 페이지 초기화면

2> 페이지 소스코드

3> PHP코드

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
<?  
 
function genRandomString() {     // 랜덤한 문자열 반환 함수
    $length = 10; 
    $characters = "0123456789abcdefghijklmnopqrstuvwxyz"; 
    $string = "";     
 
    for ($p = 0; $p < $length; $p++) {            // 10개의 랜덤한 문자들을 $string 변수에 입력한다 
        $string .= $characters[mt_rand(0, strlen($characters)-1)]; 
    } 
 
    return $string; 
} 
 
function makeRandomPath($dir, $ext) {     // 랜덤한 이름의 경로를 만드는 함수
    do {                                 // 디렉터리명과 확장자명을 인수로 받아서 경로명을 반환한다
    $path = $dir."/".genRandomString().".".$ext;     
    } while(file_exists($path)); 
    return $path; 
} 
 
function makeRandomPathFromFilename($dir, $fn) { 
    $ext = pathinfo($fn, PATHINFO_EXTENSION);         // pathinfo(경로,OPTIONS) , PATHINFO_EXTENSION:해당 경로명에서 확장자를 가져온다
    return makeRandomPath($dir, $ext);                 
} 
 
if(array_key_exists("filename", $_POST)) { 
    $target_path = makeRandomPathFromFilename("upload", $_POST["filename"]);     // 디렉터리명은 upload 가된다. 파일명은 위에서 정의한 랜덤함수들로 생성된 랜덤값이다
 
 
        if(filesize($_FILES['uploadedfile']['tmp_name']) > 1000) {     // 업로드하는 파일의 크기가 1000kb 이상이면 업로드 금지
        echo "File is too big"; 
    } else { 
        if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {     // 업로드한 파일을 $target_path로 이동시킨다. ( 실제 서버에 파일이 업로드 된다 )
            echo "The file <a href=\"$target_path\">$target_path</a> has been uploaded"; 
        } else{ 
            echo "There was an error uploading the file, please try again!"; 
        } 
    } 
} else { 
?> 
....

.Colored by Color Scripter
cs

# Example pathinfo() Example

<?php
$path_parts = pathinfo('/www/htdocs/inc/lib.inc.php');

echo $path_parts['dirname'], "\n";
echo $path_parts['basename'], "\n";
echo $path_parts['extension'], "\n";
echo $path_parts['filename'], "\n"; // since PHP 5.2.0
?>

The above example will output:

/www/htdocs/inc
lib.inc.php
php
lib.inc

4> HTML코드

1
2
3
4
5
6
7
8
9
10
11
....
<form enctype="multipart/form-data" action="index.php" method="POST">
<input type="hidden" name="MAX_FILE_SIZE" value="1000" /> 
<input type="hidden" name="filename" value="<? print genRandomString(); ?>.jpg" /> 
                    // filename 변수에는 랜덤한 파일명으로 확장자는 " .jpg " 로 고정되어서 파일이 업로드된다
                    // .jpg 확장자를 .php 로 변경시켜서 서버로 보내야 웹쉘을 실행시킬 수 있다
 
Choose a JPEG to upload (max 1KB):<br/> 
<input name="uploadedfile" type="file" /><br /> 
<input type="submit" value="Upload File" /> 
</form> 
</html>
Colored by Color Scripter
cs