从上传的文件执行代码
我正在对我朋友的网站进行安全审核。其中一项功能是允许用户从 html 上传文件。唯一的验证是将文件重命名为当前时间戳。
我想知道，有没有办法上传恶意文件，以便当用户访问该文件的 url 时，它会执行代码（在服务器端）？
我尝试上传 hello-world php 脚本，但它只是显示代码而不是执行它。如果文件扩展名是.php，它将被执行，但是，没有文件扩展名（因为文件被重命名）。
编辑：作为安全审计的一部分，我可以访问完整的源代码。如果我能在不使用它的情况下解决这个问题那就更好了，但如果需要的话我可以回答有关源代码的任何问题。
I'm doing a security audit on my friend's website. One piece of functionality is allowing users to upload files from html. The only validation is renaming the file to the current time stamp.
I was wondering, is there a way to upload a malicious file so that when a user goes to the url for that file, it executes code (on the server side)?
I tried uploading a hello-world php script, but it simply displays the code rather than executing it. If the file extension was .php, it would be executed, however, there is no file extension (because the file was renamed).
EDIT: I have access to the complete source code as part of the security audit. It would be better if I could solve this issue without using it, but I can answer any questions about the source code if needed.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
据我所知，上传文件并通过访问它。浏览器无法在服务器端执行它，除非服务器设置为执行不带扩展名的文件。
但是，如果存在其他漏洞（例如本地文件包含），您也许能够上传并执行 php 脚本。
您可以在此处阅读有关文件包含的一些信息：
RFI 上的 Wiki（几乎相同） 和此处
有关 LFI 的文档及其使用方法
是否可以执行该文件取决于服务器/站点设置的分配，因此您'您必须自己进行渗透测试，以确定是否可以执行 php 脚本。
在没有扩展名的文件中，您唯一可以做的就是，正如您提到的那样，XSS，但仅限于较旧的浏览器（IE8 及以下版本容易受到攻击，大多数其他浏览器则不然。）
As far as i know, uploading the file and visiting it via. the browser can not execute it server-side, unless the server is set to execute files without extensions.
However, if there's other vulnerabilities like Local File Inclusion you might be able to upload and execute a php script.
You can read a bit about File inclution here:
Wiki on RFI (almost the same) and here
Document on LFI and how it can be used
If you can execute the file or not depends allot on the server/sites setup, so you'll have to pen-test it you self to se if you can execute a php script.
The only thing you can do in a file with no extension is, as you mention your self, XSS, but only in older browsers (IE8 and down is vulnerable, most other browsers aren't.)
安全扫描器 Chorizo! 可能会让人感兴趣：
https://chorizo-scanner.com/
该解决方案由一家公司实施，该公司白天进行 PHP 咨询和编码。
这是一项付费服务。一次扫描是免费的。
The security scanner Chorizo! might be of interest:
https://chorizo-scanner.com/
The solution was implemented by a company, which does daytime PHP consulting and coding.
It's a payed service. One scan is free.
好吧，您始终面临风险的一件事是提供将恶意代码发送到服务器上的可能性 - 无论他们是否能够仅通过查看特定文件的 URL 来执行它，都不是您所要做的全部想想。
如果您的代码中存在一个漏洞，您可以动态包含或打开服务器上的本地文件，那么人们可以简单地包含要执行的（现在）本地恶意代码。现在，这种攻击对于试图在远程服务器上包含代码的人来说甚至很常见，但某些设置被配置为防止包含远程文件，从而阻止这些攻击。如果代码实际位于计算机上并且在可执行代码中发现了弱点，这样的配置仍然会让您容易受到攻击。
这只是一个想法——我不会对此过于担心或恐慌，但我也不会完全排除它。
Well, one thing that you would always remain at risk for is providing the possibility of getting malicious code onto the server - whether or not they would be able to execute it merely by viewing the URL of the specific file isn't all you have to think about.
If there was a vulnerability in YOUR code where you dynamically include or open local files on the server, then one could simply include the (now) local malicious code to be executed. Now granted this sort of attack is even common with people trying to include code on remote servers, but some setups are configured to prevent including remote files which would stop those attacks. Such a configuration would still leave you vulnerable if the code is physically on the machine and a weakness is found in your executable code.
That's just a thought - I wouldn't worry or panic too much about it, but I wouldn't entirely rule it out either.
据我了解，很多网络输出依赖于读取文件而不是实际执行它们。服务器需要特定的权限才能执行文件。
解决办法首先检查上传的文件类型是否允许。如果您只上传图像 - 您不需要 .php 脚本。但这并不能阻止我创建 bad.php 并将其上传为 bad.jpg。
例如，我（在我的 ubuntu 机器上）上传了一个具有 777 权限的 php 文件，并且只能通过输入
php hello.php来运行它。您通常不会对某人上传的文件执行 include() 操作，因此我相信大多数代码都与可读有关。关于文件包含的维基百科页面是一个很好的开始，其中包含一个 PHP 示例：
https://en.wikipedia.org/wiki/File_inclusion_vulnerability
From my understanding a lot of web output relies on reading files not actually executing them. A server will need specific permissions to execute a file.
The solution is firstly to check that the file types uploaded are allowed. If you are only uploading images - you don't expect a .php script. But this does not stop me creating bad.php and uploading it as bad.jpg.
I for example (on my ubuntu box) uploaded a php file with 777 permissions and could only run it by typing
php hello.php. You would never normally do an include() on a file someone has uploaded so I believe most code relates to being readable.Wikipedias page on File inclusion is a good start and includes a PHP example:
https://en.wikipedia.org/wiki/File_inclusion_vulnerability
使用 JavaScript 上传文件。 js漏洞很多。
http://en.wikipedia.org/wiki/Cross-site_scripting
Upload a file with javascript. There are plenty of js vulnerabilities.
http://en.wikipedia.org/wiki/Cross-site_scripting