        <%ST(A)%>
		<div id="Content_ContentList" class="content-width"><a name="body" accesskey="B" href="#body"></a>
			<div class="pageContent">
					<div style="float:right;width:180px !important;width:auto">
						  <a href="feed.asp?cateID=17" target="_blank" title="订阅所有黑客的日志" accesskey="F"><img border="0" src="images/rss.png" alt="订阅所有黑客的日志" style="margin-bottom:-1px"/> 订阅</a>
						   | <a href="?id=44" title="上一篇日志: serv-u的本地提升权限的源代码" accesskey=","><img border="0" src="images/Cprevious.gif" alt=""/>上一篇</a> | <a href="?id=46" title="下一篇日志: 入侵监测系统简明教程" accesskey="."><img border="0" src="images/Cnext.gif" alt=""/>下一篇</a>
					</div> 
						   <img src="images/icons/1.gif" style="margin:0px 2px -4px 0px" alt=""/> <strong><a href="default.asp?cateID=17" title="查看所有黑客的日志">黑客</a></strong> </div>
						   <div class="Content">
						   <div class="Content-top"><div class="ContentLeft"></div><div class="ContentRight"></div>
						     <h1 class="ContentTitle"><strong>上传方面的部分设计漏洞</strong></h1>
						     <h2 class="ContentAuthor">作者:apple 日期:2006-06-09</h2>
						   </div>
						    <div class="Content-Info">
							  <div class="InfoOther">字体大小: <a href="javascript:SetFont('12px')" accesskey="1">小</a> <a href="javascript:SetFont('14px')" accesskey="2">中</a> <a href="javascript:SetFont('16px')" accesskey="3">大</a></div>
							  <div class="InfoAuthor"><img src="images/weather/hn2_sunny.gif" style="margin:0px 2px -6px 0px" alt=""/><img src="images/weather/hn2_t_sunny.gif" alt=""/> <img src="images/level3.gif" style="margin:0px 2px -1px 0px" alt=""/> 
					              <$EditAndDel$>
							  </div>
							</div>
						  <div id="logPanel" class="Content-body">
					             例子1: <br/>一个文档上传处： <br/>--------code begin--------- <br/>function Checkvalue(the){ <br/>var yes=true; <br/>if( the.username.value==\"\" || the.password.value==\"\" || the.primarykey.value==\"\"){ <br/>alert(\"表单中标示 * 的项目必须填写完整 !\"); <br/>yes=false;} <br/>var fileext=the.primarykey.value.substring(the.primarykey.value.length-4,the.primarykey.value.length) <br/>fileext=fileext.toLowerCase() <br/>if (!(fileext=='.doc' || fileext=='.txt' || fileext=='.dat')) <br/>{alert(\"对不起，不正确的文件位置,必须为.doc、.txt或.dat ！\"); <br/>the.primarykey.focus(); <br/>yes=false; <br/>} <br/>return yes; <br/>} <br/>--------code end--------- <br/>他只用javascript做限制，而没有从PHP环境下改正。 <br/>直接把那个网页当到本地后，改了改原代码。 <br/>他当中的if (!(fileext=='.doc' || fileext=='.txt' || fileext=='.dat')) <br/>修改成 <br/>if ((fileext=='.doc' || fileext=='.txt' || fileext=='.dat')) <br/>并且修改FORM里头的地址从upload.php改为<a href="http://IP/upload.php" target="_blank">http://IP/upload.php</a> <br/><br/>例子2: <br/>一个网站的上传处： <br/>--------code begin--------- <br/>function getFileExtension(filePath) { //v1.0 <br/>fileName = ((filePath.indexOf('/') &gt; -1) ? filePath.substring(filePath.lastIndexOf('/')+1,filePath.length) : filePath.substring(filePath.lastIndexOf('\\\\')+1,filePath.length)); <br/>return fileName.substring(fileName.lastIndexOf('.')+1,fileName.length); <br/>} <br/><br/>function checkFileUpload(form,extensions) { //v1.0 <br/>document.MM_returnValue = true; <br/>if (extensions && extensions != '') { <br/>for (var i = 0; i field = form.elements; <br/>if (field.type.toUpperCase() != 'FILE') continue; <br/>if (field.value == '') { <br/>alert('文件框中必须保证已经有文件被选中!'); <br/>document.MM_returnValue = false;field.focus();break; <br/>} <br/>if (extensions.toUpperCase().indexOf(getFileExtension(field.value).toUpperCase()) == -1) { <br/>alert('这种文件类型不允许上传!.\\n只有以下类型的文件才被允许上传: ' + extensions + '.\\n请选择别的文件并重新上传.'); <br/>document.MM_returnValue = false;field.focus();break; <br/>} } } <br/>} <br/>--------code end--------- <br/>初看觉得，没有上面提到的那样白痴的问题，当时我们接着来 <br/>--------code begin--------- <br/><br/><br/>--------code end--------- <br/><br/>上面这句话让他死的很难看，把checkFileUpload(this,'zip,gtp,gp3');checkFileUpload(this,'zip')改成checkFileUpload(this,'asp,gtp,gp3');checkFileUpload(this,'asp')或者直接?*晃猚heckFileUpload(this,'asp')，呵呵，一样可以随便传东西上去喽！ <br/>不过记的前面的action中的地址要改成绝对地址<a href="http://ip/upload/webpage/upload/upl...?GP_upload=true" target="_blank">http://ip/upload/webpage/upload/upl...?GP_upload=true</a> <br/><br/>例子3: <br/>这个是17173的一个图片上传的地方： <br/>--------code begin--------- <br/>function form1_onsubmit(theForm) { <br/>if(theForm.file1.value == \"\") <br/>{ <br/>alert(\"选择照片\"); <br/>return(false); <br/>} <br/><br/>if (theForm.title.value == \"\") <br/>{ <br/>alert(\"请输入照片名称\"); <br/>theForm.title.focus(); <br/>return (false); <br/>} <br/>if (theForm.gameid.value == \"\") <br/>{ <br/>alert(\"请输入您在游戏中的ID\"); <br/>theForm.gameid.focus(); <br/>return (false); <br/>} <br/><br/>if (theForm.onlinetime.value == \"\") <br/>{ <br/>alert(\"请输入您的上线时间\"); <br/>theForm.onlinetime.focus(); <br/>return (false); <br/>} <br/>if (theForm.author.value == \"\") <br/>{ <br/>alert(\"请输入您的名字\"); <br/>theForm.author.focus(); <br/>return (false); <br/>} <br/>if (theForm.webgame.value == \"\") <br/>{ <br/>alert(\"您是哪个网络游戏服务器的玩家??\"); <br/>theForm.webgame.focus(); <br/>return (false); <br/>} <br/>if(theForm.email.value == \"\") <br/>{ <br/>alert(\"请输入您的email\"); <br/>theForm.email.focus(); <br/>return(false); <br/>} <br/>if(theForm.other.value == \"\") <br/>{ <br/>alert(\"请输入简介\"); <br/>theForm.other.focus(); <br/>return(false); <br/>} <br/><br/>if (theForm.title.value.length &gt; 20) <br/>{ <br/>alert(\"非法名称\"); <br/>theForm.title.focus(); <br/>return (false); <br/>} <br/><br/>if(theForm.catalogid.value == \"0\") <br/>{ <br/>alert(\"选择类别\"); <br/>return(false); <br/>} <br/><br/>if (theForm.author.value.length &gt; 20) <br/>{ <br/>alert(\"非法作者名字\"); <br/>theForm.author.focus(); <br/>return (false); <br/>} <br/><br/><br/>var checkOK = \"@.\"; <br/>var checkStr = theForm.email.value; <br/>var allValid = true; <br/>for (i = 0; i &lt; checkOK.length; i++) <br/>{ <br/>j=checkStr.indexOf(checkOK.charAt(i)); <br/><br/>if ( (j==-1) && (checkStr!=\"\") ) <br/><br/>{ <br/><br/>alert(\"非法电子邮件\"); <br/>theForm.email.focus(); <br/>return (false); <br/>} <br/>} <br/>var fname = document.form1.file1.value; <br/>var ftype = fname.substring(fname.length-3,fname.length); <br/>if(ftype!='jpg' && ftype!='gif' && ftype!='tif' && ftype!='zip' && ftype!='asp') <br/>{ <br/>alert(\"图片格式必须是:*.jpg,*.gif,*.tif\"); <br/>return(false); <br/>} <br/>theForm.filetype.value = theForm.file1.value.substr(theForm.file1.value.length-3,3) ; <br/><br/>return (true); <br/>} <br/>--------code end--------- <br/>不难看出 <br/>if(ftype!='jpg' && ftype!='gif' && ftype!='tif' && ftype!='zip' && ftype!='asp')这句话证明了他只对文件后缀做限制 <br/>把他改成if(ftype!='jpg' && ftype!='gif' && ftype!='tif' && ftype!='zip' && ftype!='asp') <br/>再把ACTION里头的地址改改，可以上传了，不过结果没预料的那么好，我们读取不到文件，呵呵，如果都被读取了，那么17173不是早就完蛋翘了<br/><br/><br/><br/>
							<br/><br/>
						   <br/>
						   </div>
						   <div class="Content-body">
					             
							<img src="images/From.gif" style="margin:0px 2px -4px 0px" alt=""/><strong>文章来自:</strong> <a href="http://www.xoofeng.com/apple/" target="_blank">本站原创</a><br/>
							<img src="images/icon_trackback.gif" style="margin:0px 2px -4px 0px" alt=""/><strong>引用通告地址:</strong> <a href="http://www.xoofeng.com/apple/trackback.asp?tbID=45" target="_blank">http://www.xoofeng.com/apple/trackback.asp?tbID=45</a><br/>
						    <img src="images/tag.gif" style="margin:4px 2px -4px 0px" alt=""/><strong>Tags:</strong> <br/>
						   </div>
						   <div class="Content-bottom"><div class="ContentBLeft"></div><div class="ContentBRight"></div>评论: 0</a> | 引用: 0 | 查看次数: <$log_ViewNums$>
			</div></div></div>
