search
HomeBackend DevelopmentPHP ProblemHow to upload a Trojan in php in one sentence

How to upload a Trojan in php in one sentence

Several common methods for uploading Trojans in one sentence:

1. Use 00 to truncate, brupsuite upload

Use 00 Truncation takes advantage of programmers' lax filtering of file upload paths when writing programs, resulting in the 0X00 upload truncation vulnerability.
Assume that the upload path of the file is http://xx.xx.xx.xx/upfiles/lubr.php.jpg. Use Burpsuite to capture and truncate the file and replace the "." after lubr.php with "0X00". When uploading, when the file system reads "0X00", it will think that the file has ended, and the content of lubr.php.jpg will be written to lubr.php to achieve the purpose of attack.

2. Construct server-side extension detection and upload

When the browser submits the file to the server, the server will check the browser based on the set blacklist The submitted file extension is tested. If the uploaded file extension does not meet the blacklist restrictions, it will not be uploaded, otherwise the upload will be successful.
This example explains how to change the file name of the one-sentence Trojan lubr.php to lubr.php.abc. First, when the server verifies the file extension, it verifies .abc. As long as the extension is changed to comply with the server-side blacklist rules, it can be uploaded. In addition, when the file is accessed on the browser side, if Apache cannot parse the .abc extension, it will look forward for a parsable extension, that is, ".php". The one-sentence Trojan can be parsed and connected via a Chinese chopper.

3, Bypass Content-Type detection file type upload

When the browser uploads files to the server, the server The file Content-Type type is detected. If it is allowed by the whitelist, it can be uploaded normally, otherwise the upload will fail. To bypass Content-Type file type detection, use Burpsuite to intercept and modify the Content-Type of the file in the data package to make it comply with the whitelist rules and achieve the purpose of uploading.

4. Construct a picture Trojan to bypass file content detection and upload Shell

Generally, file content verification uses the gettimeagesize() function to detect whether the file is a valid file. Pictures, if so, are allowed to be uploaded, otherwise they are not allowed to be uploaded.

Recommended tutorial: PHP video tutorial

The above is the detailed content of How to upload a Trojan in php in one sentence. For more information, please follow other related articles on the PHP Chinese website!

Statement
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

PhpStorm Mac version

PhpStorm Mac version

The latest (2018.2.1) professional PHP integrated development tool

SecLists

SecLists

SecLists is the ultimate security tester's companion. It is a collection of various types of lists that are frequently used during security assessments, all in one place. SecLists helps make security testing more efficient and productive by conveniently providing all the lists a security tester might need. List types include usernames, passwords, URLs, fuzzing payloads, sensitive data patterns, web shells, and more. The tester can simply pull this repository onto a new test machine and he will have access to every type of list he needs.

SublimeText3 English version

SublimeText3 English version

Recommended: Win version, supports code prompts!