Search
File Uploads vulnerabilities
2 min read

File Uploads vulnerabilities

UseeGod's Picture
UseeGod in CheatSheet

๐Ÿ”Ž What is File upload vulnerabilities?

file-upload-vulnerabilities

ํŒŒ์ผ ์—…๋กœ๋“œ ์ทจ์•ฝ์ ์€ ์›น ์„œ๋ฒ„๊ฐ€ ์‚ฌ์šฉ์ž๊ฐ€ ์ด๋ฆ„, ์œ ํ˜•, ๋‚ด์šฉ ๋˜๋Š” ํฌ๊ธฐ์™€ ๊ฐ™์€ ํ•ญ๋ชฉ์„ ์ถฉ๋ถ„ํžˆ ๊ฒ€์ฆํ•˜์ง€ ์•Š๊ณ  ํŒŒ์ผ ์‹œ์Šคํ…œ์— ํŒŒ์ผ์„ ์—…๋กœ๋“œ ํ•˜๋„๋ก ํ—ˆ์šฉํ•˜๋Š” ๊ฒฝ์šฐ์ž…๋‹ˆ๋‹ค.
์ด์— ๋Œ€ํ•œ ์ œํ•œ์„ ์ ์ ˆํ•˜๊ฒŒ ์ ์šฉํ•˜์ง€ ์•Š์œผ๋ฉด ๊ธฐ๋ณธ ์ด๋ฏธ์ง€ ์—…๋กœ๋“œ ๊ธฐ๋Šฅ์„ ์‚ฌ์šฉํ•˜์—ฌ ์ž ์žฌ์ ์œผ๋กœ ์œ„ํ—˜ํ•œ ์•…์„ฑ ํŒŒ์ผ์„ ์ด๋ฏธ์ง€ ํŒŒ์ผ ๋Œ€์‹  ์—…๋กœ๋“œ ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

Lab

ํŒŒ์ผ๋ช… ๋ณ€๊ฒฝ

แ„‰แ…ณแ„แ…ณแ„…แ…ตแ†ซแ„‰แ…ฃแ†บ 2022-05-29 แ„‹แ…ฉแ„’แ…ฎ 3 43 51

ํŒŒ์ผ๋ช…์„ .jpeg์—์„œ .php๋กœ ๋ณ€๊ฒฝ ํ›„ php ์ฝ”๋“œ ์ž‘์„ฑ

// ํ•ด๋‹น ๊ฒฝ๋กœ์˜ ํŒŒ์ผ ์ฝ๊ธฐ
<?php echo file_get_contents('/etc/passwd'); ?>

แ„‰แ…ณแ„แ…ณแ„…แ…ตแ†ซแ„‰แ…ฃแ†บ 2022-05-29 แ„‹แ…ฉแ„’แ…ฎ 3 44 41 แ„‰แ…ณแ„แ…ณแ„…แ…ตแ†ซแ„‰แ…ฃแ†บ 2022-05-29 แ„‹แ…ฉแ„’แ…ฎ 3 46 35 แ„‰แ…ณแ„แ…ณแ„…แ…ตแ†ซแ„‰แ…ฃแ†บ 2022-05-29 แ„‹แ…ฉแ„’แ…ฎ 3 46 59 แ„‰แ…ณแ„แ…ณแ„…แ…ตแ†ซแ„‰แ…ฃแ†บ 2022-05-29 แ„‹แ…ฉแ„’แ…ฎ 3 47 18

Content-type ๋ณ€๊ฒฝ

แ„‰แ…ณแ„แ…ณแ„…แ…ตแ†ซแ„‰แ…ฃแ†บ 2022-05-29 แ„‹แ…ฉแ„’แ…ฎ 8 52 19

Content-type ์ด image/jpeg ์™€ image/png ๋งŒ ํ—ˆ์šฉ๋˜์–ด ์žˆ์Œ
Content-Type์„ text/php ์—์„œ image/jpeg๋กœ ๋ณ€๊ฒฝํ•˜์—ฌ ์ „์†ก

แ„‰แ…ณแ„แ…ณแ„…แ…ตแ†ซแ„‰แ…ฃแ†บ 2022-05-29 แ„‹แ…ฉแ„’แ…ฎ 8 53 40 แ„‰แ…ณแ„แ…ณแ„…แ…ตแ†ซแ„‰แ…ฃแ†บ 2022-05-29 แ„‹แ…ฉแ„’แ…ฎ 8 54 11

แ„‰แ…ณแ„แ…ณแ„…แ…ตแ†ซแ„‰แ…ฃแ†บ 2022-05-29 แ„‹แ…ฉแ„’แ…ฎ 8 54 21 แ„‰แ…ณแ„แ…ณแ„…แ…ตแ†ซแ„‰แ…ฃแ†บ 2022-05-29 แ„‹แ…ฉแ„’แ…ฎ 8 55 15

..%2f ์‚ฌ์šฉ ๊ฒฝ๋กœ์šฐํšŒ

PHPํŒŒ์ผ ์—…๋กœ๋“œ ์‹œ ํ•„ํ„ฐ๋ง ์—†์ด PHPํŒŒ์ผ์ด ์—…๋กœ๋“œ ๊ฐ€๋Šฅํ•œ๊ฒƒ์„ ํ™•์ธ
๋‹จ, ์—…๋กœ๋“œ ํŒŒ์ผ ์ ‘์† ์‹œ ์ฝ”๋“œ๊ฐ€ ์‹คํ–‰๋˜์ง€ ์•Š๊ณ  ํ…์ŠคํŠธ ํ˜•์‹์œผ๋กœ ๋ฐ˜ํ™˜

แ„‰แ…ณแ„แ…ณแ„…แ…ตแ†ซแ„‰แ…ฃแ†บ 2022-05-29 แ„‹แ…ฉแ„’แ…ฎ 9 31 58 แ„‰แ…ณแ„แ…ณแ„…แ…ตแ†ซแ„‰แ…ฃแ†บ 2022-05-29 แ„‹แ…ฉแ„’แ…ฎ 9 32 23

directory traversal์„ ํ†ตํ•ด ../ ๊ณต๊ฒฉ ์‹œ๋„
๊ทธ๋Ÿฌ๋‚˜ ์„œ๋ฒ„์—์„œ ../ ์„ ํ•„ํ„ฐ๋งํ•˜์—ฌ ์‚ญ์ œ์ฒ˜๋ฆฌ

แ„‰แ…ณแ„แ…ณแ„…แ…ตแ†ซแ„‰แ…ฃแ†บ 2022-05-29 แ„‹แ…ฉแ„’แ…ฎ 9 33 01 แ„‰แ…ณแ„แ…ณแ„…แ…ตแ†ซแ„‰แ…ฃแ†บ 2022-05-29 แ„‹แ…ฉแ„’แ…ฎ 9 33 14

์ธ์ฝ”๋”ฉ์„ ์‚ฌ์šฉํ•˜์—ฌ ..%2f์„ ์ด์šฉํ•˜์—ฌ ์—…๋กœ๋“œ ์‹œ๋„
ํ•„ํ„ฐ๋ง์„ ๊ฑฐ์น˜์ง€ ์•Š๊ณ  ์ •์ƒ์ ์œผ๋กœ ๊ฒฝ๋กœ ์šฐํšŒํ•˜์—ฌ ์—…๋กœ๋“œ๊ฐ€ ๋œ๊ฒƒ์„ ํ™•์ธ
์—…๋กœ๋“œ ๋œ ๊ฒฝ๋กœ๋กœ ์ ‘์†์‹œ PHP์ฝ”๋“œ๊ฐ€ ์‹คํ–‰๋จ

แ„‰แ…ณแ„แ…ณแ„…แ…ตแ†ซแ„‰แ…ฃแ†บ 2022-05-29 แ„‹แ…ฉแ„’แ…ฎ 9 33 52 แ„‰แ…ณแ„แ…ณแ„…แ…ตแ†ซแ„‰แ…ฃแ†บ 2022-05-29 แ„‹แ…ฉแ„’แ…ฎ 9 34 08 แ„‰แ…ณแ„แ…ณแ„…แ…ตแ†ซแ„‰แ…ฃแ†บ 2022-05-29 แ„‹แ…ฉแ„’แ…ฎ 9 34 32


๐Ÿ Cheat sheet

  • PHP Code
// ํ•ด๋‹น ๊ฒฝ๋กœ์˜ ํŒŒ์ผ ์ฝ๊ธฐ
<?php echo file_get_contents('/etc/passwd'); ?>

// cmd ์‰˜ (exploit.php?command=id)
<?php echo system($_GET['command']); ?>

๐Ÿ‘€ How to Prevent ?

  • .jpg, .gif, .pptx ๋“ฑ ์ˆ˜์šฉ ๊ฐ€๋Šฅํ•œ ํ™•์žฅ์ž๋งŒ ์—…๋กœ๋“œ ํ—ˆ์šฉ (ํ™”์ดํŠธ ๋ฆฌ์ŠคํŠธ ๋ฐฉ์‹)
  • Contnet-Type ํ™•์ธ์„ ํ†ตํ•œ ์‹คํ–‰ํŒŒ์ผ ์—…๋กœ๋“œ ์ฐจ๋‹จ
  • ํŒŒ์ผ๋ช…์— ํŠน์ˆ˜๋ฌธ์ž(../, ..\, %, %00 ๋“ฑ)๊ฐ€ ํฌํ•จ๋œ ํŒก๋ฆฌ์˜ ์—…๋กœ๋“œ๋ฅผ ์ฐจ๋‹จํ•˜๋Š” ๋กœ์ง ๊ตฌํ˜„
  • ํŒŒ์ผํ™•์žฅ์ž ๊ฒ€์ฆ ํ”„๋กœ์„ธ์Šค๋ฅผ Client side๊ฐ€ ์•„๋‹Œ Server side์—์„œ ๊ตฌํ˜„
  • ์—…๋กœ๋“œ ๋œ ํŒŒ์ผ์ด ์„œ๋ฒ„์ƒ์—์„œ ์‹คํ–‰ ๋ถˆ๊ฐ€๋Šฅ ํ•˜๋„๋ก ์—…๋กœ๋“œ ํŒŒ์ผ ๋ฐ ๋””๋ ‰ํ„ฐ๋ฆฌ์˜ ์‹คํ–‰ ๊ถŒํ•œ ์ œ๊ฑฐ

๐Ÿ“ƒ References

You may also like

IP ๋Œ€์—ญ ๋ถ„ํ•  ํ‘œ
2 min read

IP ๋Œ€์—ญ ๋ถ„ํ•  ํ‘œ

UseeGod's Picture
UseeGod in CheatSheet
Bypass NAC
1 min read

Bypass NAC

UseeGod's Picture
UseeGod in CheatSheet
AWS Cheat Sheet
3 min read

AWS Cheat Sheet

AWS Cloud

UseeGod's Picture
UseeGod in CheatSheet Cloud

Latest Posts

Web3 ์ž๋ฃŒ ๋ชจ์Œ
1 min read

Web3 ์ž๋ฃŒ ๋ชจ์Œ

UseeGod's Picture
UseeGod
ํ† ํฐ๊ธฐ๋ฐ˜ ์ธ์ฆ์—์„œ bearer ๋ž€?
2 min read

ํ† ํฐ๊ธฐ๋ฐ˜ ์ธ์ฆ์—์„œ bearer ๋ž€?

UseeGod's Picture
UseeGod

Explore Tags

Android BugBounty CVE CheatSheet Cloud Error Git HTB IOS Reversing Web Web3