https://souljian.cn/tags/%E6%BC%8F%E6%B4%9E/Recent content in 漏洞 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 00:00:00 +0800https://souljian.cn/p/751088100/Sun, 30 Aug 2026 00:00:00 +0800https://souljian.cn/p/751088100/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>上传测试只用于授权靶场。对真实系统上传木马可能触犯法律。</p> <h2 id="一上传为什么危险">一、上传为什么危险 </h2><p>文件上传一旦能落地可执行目录，就等于给攻击者“放进去一个后门”。测试核心是“<strong>文件能不能传上去、能不能访问、能不能执行</strong>”。</p> <h2 id="二思路清单">二、思路清单 </h2><h3 id="1-前端校验绕过">1. 前端校验绕过 </h3><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">直接改包（绕过 JS 限制） </span></span><span class="line"><span class="cl">删掉前端限制后重放 </span></span></code></pre></td></tr></table> </div> </div><h3 id="2-mime--content-type-绕过">2. MIME / Content-Type 绕过 </h3><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">改 Content-Type 为 image/png 等 </span></span><span class="line"><span class="cl">服务端若只看 MIME，可绕过 </span></span></code></pre></td></tr></table> </div> </div><h3 id="3-扩展名校验绕过">3. 扩展名校验绕过 </h3><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">双扩展：shell.php.jpg、shell.jpg.php </span></span><span class="line"><span class="cl">大小写：.PhP、.JSP </span></span><span class="line"><span class="cl">特殊后缀：.php3、.phtml、.php5、.jspx、.war、.asp </span></span><span class="line"><span class="cl">加空格/点/换行：shell.php 、shell.php. </span></span><span class="line"><span class="cl">配合服务器解析差异 </span></span></code></pre></td></tr></table> </div> </div><h3 id="4-内容文件头校验绕过">4. 内容/文件头校验绕过 </h3><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">在文件头加图片魔数：GIF89a / \xFF\xD8\xFF </span></span><span class="line"><span class="cl">文件内容里夹一句话（图片马） </span></span></code></pre></td></tr></table> </div> </div><h3 id="5-解析漏洞">5. 解析漏洞 </h3><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">nginx 解析：/shell.jpg/x.php → 以 PHP 解析 </span></span><span class="line"><span class="cl">Apache 多后缀解析 </span></span><span class="line"><span class="cl">IIS 分号/畸形解析 </span></span><span class="line"><span class="cl">中间件版本决定能否利用 </span></span></code></pre></td></tr></table> </div> </div><h3 id="6-配合文件包含--其他">6. 配合文件包含 / 其他 </h3><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">上传图片马 → 配合文件包含执行 </span></span><span class="line"><span class="cl">上传 .htaccess / .user.ini 改解析规则 </span></span><span class="line"><span class="cl">上传 XML → XXE </span></span><span class="line"><span class="cl">上传压缩包 → 解压路径穿越 </span></span></code></pre></td></tr></table> </div> </div><h3 id="7-上传后路径探测">7. 上传后路径探测 </h3><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">找上传文件真实路径（时间戳/随机名？） </span></span><span class="line"><span class="cl">目录探测：/upload/、/files/ </span></span><span class="line"><span class="cl">访问确认是否能执行 </span></span></code></pre></td></tr></table> </div> </div><h2 id="三优先级">三、优先级 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">先测能不能绕过上传限制（前端→MIME→扩展名→内容） </span></span><span class="line"><span class="cl">再判断服务器解析（解析漏洞） </span></span><span class="line"><span class="cl">最后配合文件包含/htaccess 打通执行 </span></span></code></pre></td></tr></table> </div> </div><h2 id="执行顺序">执行顺序 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">第 1 步：改包绕过前端/ MIME 校验 </span></span><span class="line"><span class="cl">第 2 步：逐个试扩展名绕过（双扩展/大小写/特殊后缀） </span></span><span class="line"><span class="cl">第 3 步：内容校验绕过（图片马/魔数） </span></span><span class="line"><span class="cl">第 4 步：探测上传路径并确认能否执行 </span></span><span class="line"><span class="cl">第 5 步：配合解析漏洞/文件包含打通 GetShell </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>上传测试的核心是“<strong>文件能不能落到可执行位置并被触发</strong>”。一条条过：前端、MIME、扩展名、内容、解析、配合。每个站点环境不同（中间件/语言），对应的绕过方式也不同，抓包 + 探测真实路径是关键。</p>