├── Pass-01
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-02
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-03
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-04
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-05
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-06
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-07
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-08
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-09
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-10
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-11
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-12
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-13
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-14
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-15
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-16
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-17
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-18
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-19
    ├── helper.php
    ├── index.php
    ├── myupload.php
    └── show_code.php
├── Pass-20
    ├── helper.php
    ├── index.php
    └── show_code.php
├── Pass-21
    ├── helper.php
    ├── index.php
    └── show_code.php
├── README.md
├── common.php
├── config.php
├── css
    ├── index.css
    └── prism.css
├── doc
    ├── code.jpg
    ├── index.jpg
    ├── mind-map.png
    ├── pass.jpg
    └── sum_up.png
├── docker
    ├── Dockerfile
    ├── docker-php.conf
    └── php.ini
├── footer.php
├── head.php
├── img
    ├── close.png
    ├── favicon.png
    ├── loading.gif
    └── logo.png
├── include.php
├── index.php
├── js
    ├── index.js
    ├── jquery.min.js
    ├── prism-line-numbers.min.js
    ├── prism-php.min.js
    └── prism.js
├── menu.php
├── rmdir.php
└── upload
    └── readme.php


/Pass-01/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | 
3 | if($_GET['action'] == 'get_prompt'){
4 |     echo '本pass在客户端使用js对不合法图片进行检查！';
5 | }
6 | 
7 | ?>


--------------------------------------------------------------------------------
/Pass-01/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../head.php';
 4 | include '../menu.php';
 5 | 
 6 | $is_upload = false;
 7 | $msg = null;
 8 | if (isset($_POST['submit'])) {
 9 |     if (file_exists(UPLOAD_PATH)) {
10 |         $temp_file = $_FILES['upload_file']['tmp_name'];
11 |         $img_path = UPLOAD_PATH . '/' . $_FILES['upload_file']['name'];
12 |         if (move_uploaded_file($temp_file, $img_path)){
13 |             $is_upload = true;
14 |         } else {
15 |             $msg = '上传出错！';
16 |         }
17 |     } else {
18 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
19 |     }
20 | }
21 | ?>
22 | 
23 | <div id="upload_panel">
24 |     <ol>
25 |         <li>
26 |             <h3>任务</h3>
27 |             <p>上传一个<code>webshell</code>到服务器。</p>
28 |         </li>
29 |         <li>
30 |             <h3>上传区</h3>
31 |             <form enctype="multipart/form-data" method="post" onsubmit="return checkFile()">
32 |                 <p>请选择要上传的图片：<p>
33 |                 <input class="input_file" type="file" name="upload_file"/>
34 |                 <input class="button" type="submit" name="submit" value="上传"/>
35 |             </form>
36 |             <div id="msg">
37 |                 <?php 
38 |                     if($msg != null){
39 |                         echo "提示：".$msg;
40 |                     }
41 |                 ?>
42 |             </div>
43 |             <div id="img">
44 |                 <?php
45 |                     if($is_upload){
46 |                         echo '<img src="'.$img_path.'" width="250px" />';
47 |                     }
48 |                 ?>
49 |             </div>
50 |         </li>
51 | 	    <?php 
52 | 	        if($_GET['action'] == "show_code"){
53 | 	            include 'show_code.php';
54 | 	        }
55 | 	    ?>
56 | 	</ol>
57 | </div>
58 | 
59 | <?php
60 | include '../footer.php'
61 | ?>
62 | 
63 | 
64 | <script type="text/javascript">
65 |     function checkFile() {
66 |         var file = document.getElementsByName('upload_file')[0].value;
67 |         if (file == null || file == "") {
68 |             alert("请选择要上传的文件!");
69 |             return false;
70 |         }
71 |         //定义允许上传的文件类型
72 |         var allow_ext = ".jpg|.png|.gif";
73 |         //提取上传文件的类型
74 |         var ext_name = file.substring(file.lastIndexOf("."));
75 |         //判断上传文件类型是否允许上传
76 |         if (allow_ext.indexOf(ext_name) == -1) {
77 |             var errMsg = "该文件不允许上传，请上传" + allow_ext + "类型的文件,当前文件类型为：" + ext_name;
78 |             alert(errMsg);
79 |             return false;
80 |         }
81 |     }
82 | </script>


--------------------------------------------------------------------------------
/Pass-01/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-javascript">function checkFile() {
 5 |     var file = document.getElementsByName('upload_file')[0].value;
 6 |     if (file == null || file == "") {
 7 |         alert("请选择要上传的文件!");
 8 |         return false;
 9 |     }
10 |     //定义允许上传的文件类型
11 |     var allow_ext = ".jpg|.png|.gif";
12 |     //提取上传文件的类型
13 |     var ext_name = file.substring(file.lastIndexOf("."));
14 |     //判断上传文件类型是否允许上传
15 |     if (allow_ext.indexOf(ext_name + "|") == -1) {
16 |         var errMsg = "该文件不允许上传，请上传" + allow_ext + "类型的文件,当前文件类型为：" + ext_name;
17 |         alert(errMsg);
18 |         return false;
19 |     }
20 | }
21 | </code>
22 | </pre>
23 | </li>


--------------------------------------------------------------------------------
/Pass-02/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | 
3 | if($_GET['action'] == 'get_prompt'){
4 |     echo '本pass在服务端对数据包的MIME进行检查！';
5 | }
6 | 
7 | ?>


--------------------------------------------------------------------------------
/Pass-02/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../head.php';
 4 | include '../menu.php';
 5 | 
 6 | $is_upload = false;
 7 | $msg = null;
 8 | if (isset($_POST['submit'])) {
 9 |     if (file_exists(UPLOAD_PATH)) {
10 |         if (($_FILES['upload_file']['type'] == 'image/jpeg') || ($_FILES['upload_file']['type'] == 'image/png') || ($_FILES['upload_file']['type'] == 'image/gif')) {
11 |             $temp_file = $_FILES['upload_file']['tmp_name'];
12 |             $img_path = UPLOAD_PATH . '/' . $_FILES['upload_file']['name'];          
13 |             if (move_uploaded_file($temp_file, $img_path)) {
14 |                 $is_upload = true;
15 |             } else {
16 |                 $msg = '上传出错！';
17 |             }
18 |         } else {
19 |             $msg = '文件类型不正确，请重新上传！';
20 |         }
21 |     } else {
22 |         $msg = UPLOAD_PATH.'文件夹不存在,请手工创建！';
23 |     }
24 | }
25 | ?>
26 | 
27 | <div id="upload_panel">
28 |     <ol>
29 |         <li>
30 |             <h3>任务</h3>
31 |             <p>上传一个<code>webshell</code>到服务器。</p>
32 |         </li>
33 |         <li>
34 |             <h3>上传区</h3>
35 |             <form enctype="multipart/form-data" method="post" onsubmit="return checkFile()">
36 |                 <p>请选择要上传的图片：<p>
37 |                 <input class="input_file" type="file" name="upload_file"/>
38 |                 <input class="button" type="submit" name="submit" value="上传"/>
39 |             </form>
40 |             <div id="msg">
41 |                 <?php 
42 |                     if($msg != null){
43 |                         echo "提示：".$msg;
44 |                     }
45 |                 ?>
46 |             </div>
47 |             <div id="img">
48 |                 <?php
49 |                     if($is_upload){
50 |                         echo '<img src="'.$img_path.'" width="250px" />';
51 |                     }
52 |                 ?>
53 |             </div>
54 |         </li>
55 |         <?php 
56 |             if($_GET['action'] == "show_code"){
57 |                 include 'show_code.php';
58 |             }
59 |         ?>
60 |     </ol>
61 | </div>
62 | 
63 | <?php
64 | include '../footer.php';
65 | ?>


--------------------------------------------------------------------------------
/Pass-02/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">$is_upload = false;
 5 | $msg = null;
 6 | if (isset($_POST['submit'])) {
 7 |     if (file_exists(UPLOAD_PATH)) {
 8 |         if (($_FILES['upload_file']['type'] == 'image/jpeg') || ($_FILES['upload_file']['type'] == 'image/png') || ($_FILES['upload_file']['type'] == 'image/gif')) {
 9 |             $temp_file = $_FILES['upload_file']['tmp_name'];
10 |             $img_path = UPLOAD_PATH . '/' . $_FILES['upload_file']['name']            
11 |             if (move_uploaded_file($temp_file, $img_path)) {
12 |                 $is_upload = true;
13 |             } else {
14 |                 $msg = '上传出错！';
15 |             }
16 |         } else {
17 |             $msg = '文件类型不正确，请重新上传！';
18 |         }
19 |     } else {
20 |         $msg = UPLOAD_PATH.'文件夹不存在,请手工创建！';
21 |     }
22 | }
23 | </code>
24 | </pre>
25 | </li>


--------------------------------------------------------------------------------
/Pass-03/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | 
3 | if($_GET['action'] == 'get_prompt'){
4 |     echo '本pass禁止上传.asp|.aspx|.php|.jsp后缀文件！';
5 | }
6 | 
7 | ?>


--------------------------------------------------------------------------------
/Pass-03/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../common.php';
 4 | include '../head.php';
 5 | include '../menu.php';
 6 | 
 7 | $is_upload = false;
 8 | $msg = null;
 9 | if (isset($_POST['submit'])) {
10 |     if (file_exists(UPLOAD_PATH)) {
11 |         $deny_ext = array('.asp','.aspx','.php','.jsp');
12 |         $file_name = trim($_FILES['upload_file']['name']);
13 |         $file_name = deldot($file_name);//删除文件名末尾的点
14 |         $file_ext = strrchr($file_name, '.');
15 |         $file_ext = strtolower($file_ext); //转换为小写
16 |         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
17 |         $file_ext = trim($file_ext); //收尾去空
18 | 
19 |         if(!in_array($file_ext, $deny_ext)) {
20 |             $temp_file = $_FILES['upload_file']['tmp_name'];
21 |             $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;            
22 |             if (move_uploaded_file($temp_file,$img_path)) {
23 |                  $is_upload = true;
24 |             } else {
25 |                 $msg = '上传出错！';
26 |             }
27 |         } else {
28 |             $msg = '不允许上传.asp,.aspx,.php,.jsp后缀文件！';
29 |         }
30 |     } else {
31 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
32 |     }
33 | }
34 | ?>
35 | 
36 | <div id="upload_panel">
37 |     <ol>
38 |         <li>
39 |             <h3>任务</h3>
40 |             <p>上传一个<code>webshell</code>到服务器。</p>
41 |         </li>
42 |         <li>
43 |             <h3>上传区</h3>
44 |             <form enctype="multipart/form-data" method="post" onsubmit="return checkFile()">
45 |                 <p>请选择要上传的图片：<p>
46 |                 <input class="input_file" type="file" name="upload_file"/>
47 |                 <input class="button" type="submit" name="submit" value="上传"/>
48 |             </form>
49 |             <div id="msg">
50 |                 <?php 
51 |                     if($msg != null){
52 |                         echo "提示：".$msg;
53 |                     }
54 |                 ?>
55 |             </div>
56 |             <div id="img">
57 |                 <?php
58 |                     if($is_upload){
59 |                         echo '<img src="'.$img_path.'" width="250px" />';
60 |                     }
61 |                 ?>
62 |             </div>
63 |         </li>
64 |         <?php 
65 |             if($_GET['action'] == "show_code"){
66 |                 include 'show_code.php';
67 |             }
68 |         ?>
69 |     </ol>
70 | </div>
71 | 
72 | <?php
73 | include '../footer.php';
74 | ?>


--------------------------------------------------------------------------------
/Pass-03/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">$is_upload = false;
 5 | $msg = null;
 6 | if (isset($_POST['submit'])) {
 7 |     if (file_exists(UPLOAD_PATH)) {
 8 |         $deny_ext = array('.asp','.aspx','.php','.jsp');
 9 |         $file_name = trim($_FILES['upload_file']['name']);
10 |         $file_name = deldot($file_name);//删除文件名末尾的点
11 |         $file_ext = strrchr($file_name, '.');
12 |         $file_ext = strtolower($file_ext); //转换为小写
13 |         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
14 |         $file_ext = trim($file_ext); //收尾去空
15 | 
16 |         if(!in_array($file_ext, $deny_ext)) {
17 |             $temp_file = $_FILES['upload_file']['tmp_name'];
18 |             $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;            
19 |             if (move_uploaded_file($temp_file,$img_path)) {
20 |                  $is_upload = true;
21 |             } else {
22 |                 $msg = '上传出错！';
23 |             }
24 |         } else {
25 |             $msg = '不允许上传.asp,.aspx,.php,.jsp后缀文件！';
26 |         }
27 |     } else {
28 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
29 |     }
30 | }
31 | </code>
32 | </pre>
33 | </li>


--------------------------------------------------------------------------------
/Pass-04/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo '本pass禁止上传.php|.php5|.php4|.php3|.php2|php1|.html|.htm|.phtml|.pHp|.pHp5|.pHp4|.pHp3|.pHp2|pHp1|.Html|.Htm|.pHtml|.jsp|.jspa|.jspx|.jsw|.jsv|.jspf|.jtml|.jSp|.jSpx|.jSpa|.jSw|.jSv|.jSpf|.jHtml|.asp|.aspx|.asa|.asax|.ascx|.ashx|.asmx|.cer|.aSp|.aSpx|.aSa|.aSax|.aScx|.aShx|.aSmx|.cEr|.sWf|.swf后缀文件！';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-04/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../common.php';
 4 | include '../head.php';
 5 | include '../menu.php';
 6 | 
 7 | $is_upload = false;
 8 | $msg = null;
 9 | if (isset($_POST['submit'])) {
10 |     if (file_exists(UPLOAD_PATH)) {
11 |         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".ini");
12 |         $file_name = trim($_FILES['upload_file']['name']);
13 |         $file_name = deldot($file_name);//删除文件名末尾的点
14 |         $file_ext = strrchr($file_name, '.');
15 |         $file_ext = strtolower($file_ext); //转换为小写
16 |         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
17 |         $file_ext = trim($file_ext); //收尾去空
18 | 
19 |         if (!in_array($file_ext, $deny_ext)) {
20 |             $temp_file = $_FILES['upload_file']['tmp_name'];
21 |             $img_path = UPLOAD_PATH.'/'.$file_name;
22 |             if (move_uploaded_file($temp_file, $img_path)) {
23 |                 $is_upload = true;
24 |             } else {
25 |                 $msg = '上传出错！';
26 |             }
27 |         } else {
28 |             $msg = '此文件不允许上传!';
29 |         }
30 |     } else {
31 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
32 |     }
33 | }
34 | ?>
35 | 
36 | 
37 | <div id="upload_panel">
38 |     <ol>
39 |         <li>
40 |             <h3>任务</h3>
41 |             <p>上传一个<code>webshell</code>到服务器。</p>
42 |         </li>
43 |         <li>
44 |             <h3>上传区</h3>
45 |             <form enctype="multipart/form-data" method="post" onsubmit="return checkFile()">
46 |                 <p>请选择要上传的图片：<p>
47 |                 <input class="input_file" type="file" name="upload_file"/>
48 |                 <input class="button" type="submit" name="submit" value="上传"/>
49 |             </form>
50 |             <div id="msg">
51 |                 <?php 
52 |                     if($msg != null){
53 |                         echo "提示：".$msg;
54 |                     }
55 |                 ?>
56 |             </div>
57 |             <div id="img">
58 |                 <?php
59 |                     if($is_upload){
60 |                         echo '<img src="'.$img_path.'" width="250px" />';
61 |                     }
62 |                 ?>
63 |             </div>
64 |         </li>
65 |         <?php 
66 |             if($_GET['action'] == "show_code"){
67 |                 include 'show_code.php';
68 |             }
69 |         ?>
70 |     </ol>
71 | </div>
72 | 
73 | 
74 | <?php
75 | include '../footer.php';
76 | ?>


--------------------------------------------------------------------------------
/Pass-04/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">$is_upload = false;
 5 | $msg = null;
 6 | if (isset($_POST['submit'])) {
 7 |     if (file_exists(UPLOAD_PATH)) {
 8 |         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".ini");
 9 |         $file_name = trim($_FILES['upload_file']['name']);
10 |         $file_name = deldot($file_name);//删除文件名末尾的点
11 |         $file_ext = strrchr($file_name, '.');
12 |         $file_ext = strtolower($file_ext); //转换为小写
13 |         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
14 |         $file_ext = trim($file_ext); //收尾去空
15 | 
16 |         if (!in_array($file_ext, $deny_ext)) {
17 |             $temp_file = $_FILES['upload_file']['tmp_name'];
18 |             $img_path = UPLOAD_PATH.'/'.$file_name;
19 |             if (move_uploaded_file($temp_file, $img_path)) {
20 |                 $is_upload = true;
21 |             } else {
22 |                 $msg = '上传出错！';
23 |             }
24 |         } else {
25 |             $msg = '此文件不允许上传!';
26 |         }
27 |     } else {
28 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
29 |     }
30 | }
31 | </code>
32 | </pre>
33 | </li>


--------------------------------------------------------------------------------
/Pass-05/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo '上传目录存在php文件（readme.php）';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-05/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../common.php';
 4 | include '../head.php';
 5 | include '../menu.php';
 6 | 
 7 | $is_upload = false;
 8 | $msg = null;
 9 | if (isset($_POST['submit'])) {
10 |     if (file_exists(UPLOAD_PATH)) {
11 |         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
12 |         $file_name = trim($_FILES['upload_file']['name']);
13 |         $file_name = deldot($file_name);//删除文件名末尾的点
14 |         $file_ext = strrchr($file_name, '.');
15 |         $file_ext = strtolower($file_ext); //转换为小写
16 |         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
17 |         $file_ext = trim($file_ext); //首尾去空
18 |         
19 |         if (!in_array($file_ext, $deny_ext)) {
20 |             $temp_file = $_FILES['upload_file']['tmp_name'];
21 |             $img_path = UPLOAD_PATH.'/'.$file_name;
22 |             if (move_uploaded_file($temp_file, $img_path)) {
23 |                 $is_upload = true;
24 |             } else {
25 |                 $msg = '上传出错！';
26 |             }
27 |         } else {
28 |             $msg = '此文件类型不允许上传！';
29 |         }
30 |     } else {
31 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
32 |     }
33 | }
34 | ?>
35 | 
36 | <div id="upload_panel">
37 |     <ol>
38 |         <li>
39 |             <h3>任务</h3>
40 |             <p>上传一个<code>webshell</code>到服务器。</p>
41 |         </li>
42 |         <li>
43 |             <h3>上传区</h3>
44 |             <form enctype="multipart/form-data" method="post" onsubmit="return checkFile()">
45 |                 <p>请选择要上传的图片：<p>
46 |                 <input class="input_file" type="file" name="upload_file"/>
47 |                 <input class="button" type="submit" name="submit" value="上传"/>
48 |             </form>
49 |             <div id="msg">
50 |                 <?php 
51 |                     if($msg != null){
52 |                         echo "提示：".$msg;
53 |                     }
54 |                 ?>
55 |             </div>
56 |             <div id="img">
57 |                 <?php
58 |                     if($is_upload){
59 |                         echo '<img src="'.$img_path.'" width="250px" />';
60 |                     }
61 |                 ?>
62 |             </div>
63 |         </li>
64 |         <?php 
65 |             if($_GET['action'] == "show_code"){
66 |                 include 'show_code.php';
67 |             }
68 |         ?>
69 |     </ol>
70 | </div>
71 | 
72 | <?php
73 | include '../footer.php';
74 | ?>


--------------------------------------------------------------------------------
/Pass-05/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">$is_upload = false;
 5 | $msg = null;
 6 | if (isset($_POST['submit'])) {
 7 |     if (file_exists(UPLOAD_PATH)) {
 8 |         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess");
 9 |         $file_name = trim($_FILES['upload_file']['name']);
10 |         $file_name = deldot($file_name);//删除文件名末尾的点
11 |         $file_ext = strrchr($file_name, '.');
12 |         $file_ext = strtolower($file_ext); //转换为小写
13 |         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
14 |         $file_ext = trim($file_ext); //首尾去空
15 |         
16 |         if (!in_array($file_ext, $deny_ext)) {
17 |             $temp_file = $_FILES['upload_file']['tmp_name'];
18 |             $img_path = UPLOAD_PATH.'/'.$file_name;
19 |             if (move_uploaded_file($temp_file, $img_path)) {
20 |                 $is_upload = true;
21 |             } else {
22 |                 $msg = '上传出错！';
23 |             }
24 |         } else {
25 |             $msg = '此文件类型不允许上传！';
26 |         }
27 |     } else {
28 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
29 |     }
30 | }
31 | </code>
32 | </pre>
33 | </li>


--------------------------------------------------------------------------------
/Pass-06/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo '本pass禁止上传.php|.php5|.php4|.php3|.php2|php1|.html|.htm|.phtml|.pHp|.pHp5|.pHp4|.pHp3|.pHp2|pHp1|.Html|.Htm|.pHtml|.jsp|.jspa|.jspx|.jsw|.jsv|.jspf|.jtml|.jSp|.jSpx|.jSpa|.jSw|.jSv|.jSpf|.jHtml|.asp|.aspx|.asa|.asax|.ascx|.ashx|.asmx|.cer|.aSp|.aSpx|.aSa|.aSax|.aScx|.aShx|.aSmx|.cEr|.sWf|.swf|.htaccess后缀文件！';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-06/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../common.php';
 4 | include '../head.php';
 5 | include '../menu.php';
 6 | 
 7 | $is_upload = false;
 8 | $msg = null;
 9 | if (isset($_POST['submit'])) {
10 |     if (file_exists(UPLOAD_PATH)) {
11 |         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
12 |         $file_name = trim($_FILES['upload_file']['name']);
13 |         $file_name = deldot($file_name);//删除文件名末尾的点
14 |         $file_ext = strrchr($file_name, '.');
15 |         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
16 |         $file_ext = trim($file_ext); //首尾去空
17 | 
18 |         if (!in_array($file_ext, $deny_ext)) {
19 |             $temp_file = $_FILES['upload_file']['tmp_name'];
20 |             $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
21 |             if (move_uploaded_file($temp_file, $img_path)) {
22 |                 $is_upload = true;
23 |             } else {
24 |                 $msg = '上传出错！';
25 |             }
26 |         } else {
27 |             $msg = '此文件类型不允许上传！';
28 |         }
29 |     } else {
30 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
31 |     }
32 | }
33 | ?>
34 | 
35 | <div id="upload_panel">
36 |     <ol>
37 |         <li>
38 |             <h3>任务</h3>
39 |             <p>上传一个<code>webshell</code>到服务器。</p>
40 |         </li>
41 |         <li>
42 |             <h3>上传区</h3>
43 |             <form enctype="multipart/form-data" method="post" onsubmit="return checkFile()">
44 |                 <p>请选择要上传的图片：<p>
45 |                 <input class="input_file" type="file" name="upload_file"/>
46 |                 <input class="button" type="submit" name="submit" value="上传"/>
47 |             </form>
48 |             <div id="msg">
49 |                 <?php 
50 |                     if($msg != null){
51 |                         echo "提示：".$msg;
52 |                     }
53 |                 ?>
54 |             </div>
55 |             <div id="img">
56 |                 <?php
57 |                     if($is_upload){
58 |                         echo '<img src="'.$img_path.'" width="250px" />';
59 |                     }
60 |                 ?>
61 |             </div>
62 |         </li>
63 |         <?php 
64 |             if($_GET['action'] == "show_code"){
65 |                 include 'show_code.php';
66 |             }
67 |         ?>
68 |     </ol>
69 | </div>
70 | 
71 | <?php
72 | include '../footer.php';
73 | ?>


--------------------------------------------------------------------------------
/Pass-06/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">$is_upload = false;
 5 | $msg = null;
 6 | if (isset($_POST['submit'])) {
 7 |     if (file_exists(UPLOAD_PATH)) {
 8 |         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
 9 |         $file_name = trim($_FILES['upload_file']['name']);
10 |         $file_name = deldot($file_name);//删除文件名末尾的点
11 |         $file_ext = strrchr($file_name, '.');
12 |         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
13 |         $file_ext = trim($file_ext); //首尾去空
14 | 
15 |         if (!in_array($file_ext, $deny_ext)) {
16 |             $temp_file = $_FILES['upload_file']['tmp_name'];
17 |             $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
18 |             if (move_uploaded_file($temp_file, $img_path)) {
19 |                 $is_upload = true;
20 |             } else {
21 |                 $msg = '上传出错！';
22 |             }
23 |         } else {
24 |             $msg = '此文件类型不允许上传！';
25 |         }
26 |     } else {
27 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
28 |     }
29 | }
30 | </code>
31 | </pre>
32 | </li>


--------------------------------------------------------------------------------
/Pass-07/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo '本pass禁止上传.php|.php5|.php4|.php3|.php2|php1|.html|.htm|.phtml|.pHp|.pHp5|.pHp4|.pHp3|.pHp2|pHp1|.Html|.Htm|.pHtml|.jsp|.jspa|.jspx|.jsw|.jsv|.jspf|.jtml|.jSp|.jSpx|.jSpa|.jSw|.jSv|.jSpf|.jHtml|.asp|.aspx|.asa|.asax|.ascx|.ashx|.asmx|.cer|.aSp|.aSpx|.aSa|.aSax|.aScx|.aShx|.aSmx|.cEr|.sWf|.swf后缀文件！';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-07/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../common.php';
 4 | include '../head.php';
 5 | include '../menu.php';
 6 | 
 7 | $is_upload = false;
 8 | $msg = null;
 9 | if (isset($_POST['submit'])) {
10 |     if (file_exists(UPLOAD_PATH)) {
11 |         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
12 |         $file_name = $_FILES['upload_file']['name'];
13 |         $file_name = deldot($file_name);//删除文件名末尾的点
14 |         $file_ext = strrchr($file_name, '.');
15 |         $file_ext = strtolower($file_ext); //转换为小写
16 |         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
17 |         
18 |         if (!in_array($file_ext, $deny_ext)) {
19 |             $temp_file = $_FILES['upload_file']['tmp_name'];
20 |             $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
21 |             if (move_uploaded_file($temp_file,$img_path)) {
22 |                 $is_upload = true;
23 |             } else {
24 |                 $msg = '上传出错！';
25 |             }
26 |         } else {
27 |             $msg = '此文件不允许上传';
28 |         }
29 |     } else {
30 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
31 |     }
32 | }
33 | ?>
34 | 
35 | <div id="upload_panel">
36 |     <ol>
37 |         <li>
38 |             <h3>任务</h3>
39 |             <p>上传一个<code>webshell</code>到服务器。</p>
40 |         </li>
41 |         <li>
42 |             <h3>上传区</h3>
43 |             <form enctype="multipart/form-data" method="post" onsubmit="return checkFile()">
44 |                 <p>请选择要上传的图片：<p>
45 |                 <input class="input_file" type="file" name="upload_file"/>
46 |                 <input class="button" type="submit" name="submit" value="上传"/>
47 |             </form>
48 |             <div id="msg">
49 |                 <?php 
50 |                     if($msg != null){
51 |                         echo "提示：".$msg;
52 |                     }
53 |                 ?>
54 |             </div>
55 |             <div id="img">
56 |                 <?php
57 |                     if($is_upload){
58 |                         echo '<img src="'.$img_path.'" width="250px" />';
59 |                     }
60 |                 ?>
61 |             </div>
62 |         </li>
63 |         <?php 
64 |             if($_GET['action'] == "show_code"){
65 |                 include 'show_code.php';
66 |             }
67 |         ?>
68 |     </ol>
69 | </div>
70 | 
71 | <?php
72 | include '../footer.php';
73 | ?>


--------------------------------------------------------------------------------
/Pass-07/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">$is_upload = false;
 5 | $msg = null;
 6 | if (isset($_POST['submit'])) {
 7 |     if (file_exists(UPLOAD_PATH)) {
 8 |         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
 9 |         $file_name = $_FILES['upload_file']['name'];
10 |         $file_name = deldot($file_name);//删除文件名末尾的点
11 |         $file_ext = strrchr($file_name, '.');
12 |         $file_ext = strtolower($file_ext); //转换为小写
13 |         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
14 |         
15 |         if (!in_array($file_ext, $deny_ext)) {
16 |             $temp_file = $_FILES['upload_file']['tmp_name'];
17 |             $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
18 |             if (move_uploaded_file($temp_file,$img_path)) {
19 |                 $is_upload = true;
20 |             } else {
21 |                 $msg = '上传出错！';
22 |             }
23 |         } else {
24 |             $msg = '此文件不允许上传';
25 |         }
26 |     } else {
27 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
28 |     }
29 | }
30 | </code>
31 | </pre>
32 | </li>


--------------------------------------------------------------------------------
/Pass-08/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo '本pass禁止上传所有可以解析的后缀！';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-08/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../head.php';
 4 | include '../menu.php';
 5 | 
 6 | $is_upload = false;
 7 | $msg = null;
 8 | if (isset($_POST['submit'])) {
 9 |     if (file_exists(UPLOAD_PATH)) {
10 |         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
11 |         $file_name = trim($_FILES['upload_file']['name']);
12 |         $file_ext = strrchr($file_name, '.');
13 |         $file_ext = strtolower($file_ext); //转换为小写
14 |         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
15 |         $file_ext = trim($file_ext); //首尾去空
16 |         
17 |         if (!in_array($file_ext, $deny_ext)) {
18 |             $temp_file = $_FILES['upload_file']['tmp_name'];
19 |             $img_path = UPLOAD_PATH.'/'.$file_name;
20 |             if (move_uploaded_file($temp_file, $img_path)) {
21 |                 $is_upload = true;
22 |             } else {
23 |                 $msg = '上传出错！';
24 |             }
25 |         } else {
26 |             $msg = '此文件类型不允许上传！';
27 |         }
28 |     } else {
29 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
30 |     }
31 | }
32 | ?>
33 | 
34 | <div id="upload_panel">
35 |     <ol>
36 |         <li>
37 |             <h3>任务</h3>
38 |             <p>上传一个<code>webshell</code>到服务器。</p>
39 |         </li>
40 |         <li>
41 |             <h3>上传区</h3>
42 |             <form enctype="multipart/form-data" method="post" onsubmit="return checkFile()">
43 |                 <p>请选择要上传的图片：<p>
44 |                 <input class="input_file" type="file" name="upload_file"/>
45 |                 <input class="button" type="submit" name="submit" value="上传"/>
46 |             </form>
47 |             <div id="msg">
48 |                 <?php 
49 |                     if($msg != null){
50 |                         echo "提示：".$msg;
51 |                     }
52 |                 ?>
53 |             </div>
54 |             <div id="img">
55 |                 <?php
56 |                     if($is_upload){
57 |                         echo '<img src="'.$img_path.'" width="250px" />';
58 |                     }
59 |                 ?>
60 |             </div>
61 |         </li>
62 |         <?php 
63 |             if($_GET['action'] == "show_code"){
64 |                 include 'show_code.php';
65 |             }
66 |         ?>
67 |     </ol>
68 | </div>
69 | 
70 | <?php
71 | include '../footer.php';
72 | ?>


--------------------------------------------------------------------------------
/Pass-08/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">$is_upload = false;
 5 | $msg = null;
 6 | if (isset($_POST['submit'])) {
 7 |     if (file_exists(UPLOAD_PATH)) {
 8 |         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
 9 |         $file_name = trim($_FILES['upload_file']['name']);
10 |         $file_ext = strrchr($file_name, '.');
11 |         $file_ext = strtolower($file_ext); //转换为小写
12 |         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
13 |         $file_ext = trim($file_ext); //首尾去空
14 |         
15 |         if (!in_array($file_ext, $deny_ext)) {
16 |             $temp_file = $_FILES['upload_file']['tmp_name'];
17 |             $img_path = UPLOAD_PATH.'/'.$file_name;
18 |             if (move_uploaded_file($temp_file, $img_path)) {
19 |                 $is_upload = true;
20 |             } else {
21 |                 $msg = '上传出错！';
22 |             }
23 |         } else {
24 |             $msg = '此文件类型不允许上传！';
25 |         }
26 |     } else {
27 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
28 |     }
29 | }
30 | </code>
31 | </pre>
32 | </li>


--------------------------------------------------------------------------------
/Pass-09/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo '本pass禁止上传.php|.php5|.php4|.php3|.php2|php1|.html|.htm|.phtml|.pHp|.pHp5|.pHp4|.pHp3|.pHp2|pHp1|.Html|.Htm|.pHtml|.jsp|.jspa|.jspx|.jsw|.jsv|.jspf|.jtml|.jSp|.jSpx|.jSpa|.jSw|.jSv|.jSpf|.jHtml|.asp|.aspx|.asa|.asax|.ascx|.ashx|.asmx|.cer|.aSp|.aSpx|.aSa|.aSax|.aScx|.aShx|.aSmx|.cEr|.sWf|.swf|.htaccess后缀文件！';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-09/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../common.php';
 4 | include '../head.php';
 5 | include '../menu.php';
 6 | 
 7 | $is_upload = false;
 8 | $msg = null;
 9 | if (isset($_POST['submit'])) {
10 |     if (file_exists(UPLOAD_PATH)) {
11 |         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
12 |         $file_name = trim($_FILES['upload_file']['name']);
13 |         $file_name = deldot($file_name);//删除文件名末尾的点
14 |         $file_ext = strrchr($file_name, '.');
15 |         $file_ext = strtolower($file_ext); //转换为小写
16 |         $file_ext = trim($file_ext); //首尾去空
17 |         
18 |         if (!in_array($file_ext, $deny_ext)) {
19 |             $temp_file = $_FILES['upload_file']['tmp_name'];
20 |             $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
21 |             if (move_uploaded_file($temp_file, $img_path)) {
22 |                 $is_upload = true;
23 |             } else {
24 |                 $msg = '上传出错！';
25 |             }
26 |         } else {
27 |             $msg = '此文件类型不允许上传！';
28 |         }
29 |     } else {
30 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
31 |     }
32 | }
33 | ?>
34 | 
35 | <div id="upload_panel">
36 |     <ol>
37 |         <li>
38 |             <h3>任务</h3>
39 |             <p>上传一个<code>webshell</code>到服务器。</p>
40 |         </li>
41 |         <li>
42 |             <h3>上传区</h3>
43 |             <form enctype="multipart/form-data" method="post" onsubmit="return checkFile()">
44 |                 <p>请选择要上传的图片：<p>
45 |                 <input class="input_file" type="file" name="upload_file"/>
46 |                 <input class="button" type="submit" name="submit" value="上传"/>
47 |             </form>
48 |             <div id="msg">
49 |                 <?php 
50 |                     if($msg != null){
51 |                         echo "提示：".$msg;
52 |                     }
53 |                 ?>
54 |             </div>
55 |             <div id="img">
56 |                 <?php
57 |                     if($is_upload){
58 |                         echo '<img src="'.$img_path.'" width="250px" />';
59 |                     }
60 |                 ?>
61 |             </div>
62 |         </li>
63 |         <?php 
64 |             if($_GET['action'] == "show_code"){
65 |                 include 'show_code.php';
66 |             }
67 |         ?>
68 |     </ol>
69 | </div>
70 | 
71 | <?php
72 | include '../footer.php';
73 | ?>


--------------------------------------------------------------------------------
/Pass-09/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">$is_upload = false;
 5 | $msg = null;
 6 | if (isset($_POST['submit'])) {
 7 |     if (file_exists(UPLOAD_PATH)) {
 8 |         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
 9 |         $file_name = trim($_FILES['upload_file']['name']);
10 |         $file_name = deldot($file_name);//删除文件名末尾的点
11 |         $file_ext = strrchr($file_name, '.');
12 |         $file_ext = strtolower($file_ext); //转换为小写
13 |         $file_ext = trim($file_ext); //首尾去空
14 |         
15 |         if (!in_array($file_ext, $deny_ext)) {
16 |             $temp_file = $_FILES['upload_file']['tmp_name'];
17 |             $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
18 |             if (move_uploaded_file($temp_file, $img_path)) {
19 |                 $is_upload = true;
20 |             } else {
21 |                 $msg = '上传出错！';
22 |             }
23 |         } else {
24 |             $msg = '此文件类型不允许上传！';
25 |         }
26 |     } else {
27 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
28 |     }
29 | }
30 | </code>
31 | </pre>
32 | </li>


--------------------------------------------------------------------------------
/Pass-10/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo '本pass只允许上传.jpg|.png|.gif后缀的文件！';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-10/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../common.php';
 4 | include '../head.php';
 5 | include '../menu.php';
 6 | 
 7 | $is_upload = false;
 8 | $msg = null;
 9 | if (isset($_POST['submit'])) {
10 |     if (file_exists(UPLOAD_PATH)) {
11 |         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
12 |         $file_name = trim($_FILES['upload_file']['name']);
13 |         $file_name = deldot($file_name);//删除文件名末尾的点
14 |         $file_ext = strrchr($file_name, '.');
15 |         $file_ext = strtolower($file_ext); //转换为小写
16 |         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
17 |         $file_ext = trim($file_ext); //首尾去空
18 |         
19 |         if (!in_array($file_ext, $deny_ext)) {
20 |             $temp_file = $_FILES['upload_file']['tmp_name'];
21 |             $img_path = UPLOAD_PATH.'/'.$file_name;
22 |             if (move_uploaded_file($temp_file, $img_path)) {
23 |                 $is_upload = true;
24 |             } else {
25 |                 $msg = '上传出错！';
26 |             }
27 |         } else {
28 |             $msg = '此文件类型不允许上传！';
29 |         }
30 |     } else {
31 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
32 |     }
33 | }
34 | ?>
35 | 
36 | <div id="upload_panel">
37 |     <ol>
38 |         <li>
39 |             <h3>任务</h3>
40 |             <p>上传一个<code>webshell</code>到服务器。</p>
41 |         </li>
42 |         <li>
43 |             <h3>上传区</h3>
44 |             <form enctype="multipart/form-data" method="post" onsubmit="return checkFile()">
45 |                 <p>请选择要上传的图片：<p>
46 |                 <input class="input_file" type="file" name="upload_file"/>
47 |                 <input class="button" type="submit" name="submit" value="上传"/>
48 |             </form>
49 |             <div id="msg">
50 |                 <?php 
51 |                     if($msg != null){
52 |                         echo "提示：".$msg;
53 |                     }
54 |                 ?>
55 |             </div>
56 |             <div id="img">
57 |                 <?php
58 |                     if($is_upload){
59 |                         echo '<img src="'.$img_path.'" width="250px" />';
60 |                     }
61 |                 ?>
62 |             </div>
63 |         </li>
64 |         <?php 
65 |             if($_GET['action'] == "show_code"){
66 |                 include 'show_code.php';
67 |             }
68 |         ?>
69 |     </ol>
70 | </div>
71 | 
72 | <?php
73 | include '../footer.php';
74 | ?>


--------------------------------------------------------------------------------
/Pass-10/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">$is_upload = false;
 5 | $msg = null;
 6 | if (isset($_POST['submit'])) {
 7 |     if (file_exists(UPLOAD_PATH)) {
 8 |         $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf",".htaccess",".ini");
 9 |         $file_name = trim($_FILES['upload_file']['name']);
10 |         $file_name = deldot($file_name);//删除文件名末尾的点
11 |         $file_ext = strrchr($file_name, '.');
12 |         $file_ext = strtolower($file_ext); //转换为小写
13 |         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
14 |         $file_ext = trim($file_ext); //首尾去空
15 |         
16 |         if (!in_array($file_ext, $deny_ext)) {
17 |             $temp_file = $_FILES['upload_file']['tmp_name'];
18 |             $img_path = UPLOAD_PATH.'/'.$file_name;
19 |             if (move_uploaded_file($temp_file, $img_path)) {
20 |                 $is_upload = true;
21 |             } else {
22 |                 $msg = '上传出错！';
23 |             }
24 |         } else {
25 |             $msg = '此文件类型不允许上传！';
26 |         }
27 |     } else {
28 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
29 |     }
30 | }
31 | </code>
32 | </pre>
33 | </li>


--------------------------------------------------------------------------------
/Pass-11/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo '本pass会从文件名中去除.php|.php5|.php4|.php3|.php2|php1|.html|.htm|.phtml|.pHp|.pHp5|.pHp4|.pHp3|.pHp2|pHp1|.Html|.Htm|.pHtml|.jsp|.jspa|.jspx|.jsw|.jsv|.jspf|.jtml|.jSp|.jSpx|.jSpa|.jSw|.jSv|.jSpf|.jHtml|.asp|.aspx|.asa|.asax|.ascx|.ashx|.asmx|.cer|.aSp|.aSpx|.aSa|.aSax|.aScx|.aShx|.aSmx|.cEr|.sWf|.swf|.htaccess字符！';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-11/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../head.php';
 4 | include '../menu.php';
 5 | 
 6 | $is_upload = false;
 7 | $msg = null;
 8 | if (isset($_POST['submit'])) {
 9 |     if (file_exists(UPLOAD_PATH)) {
10 |         $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess","ini");
11 | 
12 |         $file_name = trim($_FILES['upload_file']['name']);
13 |         $file_name = str_ireplace($deny_ext,"", $file_name);
14 |         $temp_file = $_FILES['upload_file']['tmp_name'];
15 |         $img_path = UPLOAD_PATH.'/'.$file_name;        
16 |         if (move_uploaded_file($temp_file, $img_path)) {
17 |             $is_upload = true;
18 |         } else {
19 |             $msg = '上传出错！';
20 |         }
21 |     } else {
22 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
23 |     }
24 | }
25 | ?>
26 | 
27 | <div id="upload_panel">
28 |     <ol>
29 |         <li>
30 |             <h3>任务</h3>
31 |             <p>上传一个<code>webshell</code>到服务器。</p>
32 |         </li>
33 |         <li>
34 |             <h3>上传区</h3>
35 |             <form enctype="multipart/form-data" method="post">
36 |                 <p>请选择要上传的图片：<p>
37 |                 <input class="input_file" type="file" name="upload_file"/>
38 |                 <input class="button" type="submit" name="submit" value="上传"/>
39 |             </form>
40 |             <div id="msg">
41 |                 <?php 
42 |                     if($msg != null){
43 |                         echo "提示：".$msg;
44 |                     }
45 |                 ?>
46 |             </div>
47 |             <div id="img">
48 |                 <?php
49 |                     if($is_upload){
50 |                         echo '<img src="'.$img_path.'" width="250px" />';
51 |                     }
52 |                 ?>
53 |             </div>
54 |         </li>
55 |         <?php 
56 |             if($_GET['action'] == "show_code"){
57 |                 include 'show_code.php';
58 |             }
59 |         ?>
60 |     </ol>
61 | </div>
62 | 
63 | <?php
64 | include '../footer.php';
65 | ?>


--------------------------------------------------------------------------------
/Pass-11/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">$is_upload = false;
 5 | $msg = null;
 6 | if (isset($_POST['submit'])) {
 7 |     if (file_exists(UPLOAD_PATH)) {
 8 |         $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess","ini");
 9 | 
10 |         $file_name = trim($_FILES['upload_file']['name']);
11 |         $file_name = str_ireplace($deny_ext,"", $file_name);
12 |         $temp_file = $_FILES['upload_file']['tmp_name'];
13 |         $img_path = UPLOAD_PATH.'/'.$file_name;        
14 |         if (move_uploaded_file($temp_file, $img_path)) {
15 |             $is_upload = true;
16 |         } else {
17 |             $msg = '上传出错！';
18 |         }
19 |     } else {
20 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
21 |     }
22 | }
23 | </code>
24 | </pre>
25 | </li>


--------------------------------------------------------------------------------
/Pass-12/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo '本pass上传路径可控！';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-12/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../head.php';
 4 | include '../menu.php';
 5 | 
 6 | $is_upload = false;
 7 | $msg = null;
 8 | if(isset($_POST['submit'])){
 9 |     $ext_arr = array('jpg','png','gif');
10 |     $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
11 |     if(in_array($file_ext,$ext_arr)){
12 |         $temp_file = $_FILES['upload_file']['tmp_name'];
13 |         $img_path = $_GET['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;
14 | 
15 |         if(move_uploaded_file($temp_file,$img_path)){
16 |             $is_upload = true;
17 |         } else {
18 |             $msg = '上传出错！';
19 |         }
20 |     } else{
21 |         $msg = "只允许上传.jpg|.png|.gif类型文件！";
22 |     }
23 | }
24 | ?>
25 | 
26 | <div id="upload_panel">
27 |     <ol>
28 |         <li>
29 |             <h3>任务</h3>
30 |             <p>上传一个<code>webshell</code>到服务器。</p>
31 |         </li>
32 |         <li>
33 |             <h3>上传区</h3>
34 |             <form action="?save_path=../upload/" enctype="multipart/form-data" method="post">
35 |                 <p>请选择要上传的图片：<p>
36 |                 <input class="input_file" type="file" name="upload_file"/>
37 |                 <input class="button" type="submit" name="submit" value="上传"/>
38 |             </form>
39 |             <div id="msg">
40 |                 <?php 
41 |                     if($msg != null){
42 |                         echo "提示：".$msg;
43 |                     }
44 |                 ?>
45 |             </div>
46 |             <div id="img">
47 |                 <?php
48 |                     if($is_upload){
49 |                         echo '<img src="'.$img_path.'" width="250px" />';
50 |                     }
51 |                 ?>
52 |             </div>
53 |         </li>
54 |         <?php 
55 |             if($_GET['action'] == "show_code"){
56 |                 include 'show_code.php';
57 |             }
58 |         ?>
59 |     </ol>
60 | </div>
61 | 
62 | <?php
63 | include '../footer.php';
64 | ?>


--------------------------------------------------------------------------------
/Pass-12/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">$is_upload = false;
 5 | $msg = null;
 6 | if(isset($_POST['submit'])){
 7 |     $ext_arr = array('jpg','png','gif');
 8 |     $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
 9 |     if(in_array($file_ext,$ext_arr)){
10 |         $temp_file = $_FILES['upload_file']['tmp_name'];
11 |         $img_path = $_GET['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;
12 | 
13 |         if(move_uploaded_file($temp_file,$img_path)){
14 |             $is_upload = true;
15 |         } else {
16 |             $msg = '上传出错！';
17 |         }
18 |     } else{
19 |         $msg = "只允许上传.jpg|.png|.gif类型文件！";
20 |     }
21 | }
22 | </code>
23 | </pre>
24 | </li>


--------------------------------------------------------------------------------
/Pass-13/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo '本pass上传路径可控！';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-13/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../head.php';
 4 | include '../menu.php';
 5 | 
 6 | $is_upload = false;
 7 | $msg = null;
 8 | if(isset($_POST['submit'])){
 9 |     $ext_arr = array('jpg','png','gif');
10 |     $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
11 |     if(in_array($file_ext,$ext_arr)){
12 |         $temp_file = $_FILES['upload_file']['tmp_name'];
13 |         $img_path = $_POST['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;
14 | 
15 |         if(move_uploaded_file($temp_file,$img_path)){
16 |             $is_upload = true;
17 |         } else {
18 |             $msg = "上传失败";
19 |         }
20 |     } else {
21 |         $msg = "只允许上传.jpg|.png|.gif类型文件！";
22 |     }
23 | }
24 | ?>
25 | 
26 | <div id="upload_panel">
27 |     <ol>
28 |         <li>
29 |             <h3>任务</h3>
30 |             <p>上传一个<code>webshell</code>到服务器。</p>
31 |         </li>
32 |         <li>
33 |             <h3>上传区</h3>
34 |             <form enctype="multipart/form-data" method="post">
35 |                 <p>请选择要上传的图片：<p>
36 |                 <input type="hidden" name="save_path" value="../upload/"/>
37 |                 <input class="input_file" type="file" name="upload_file"/>
38 |                 <input class="button" type="submit" name="submit" value="上传"/>
39 |             </form>
40 |             <div id="msg">
41 |                 <?php 
42 |                     if($msg != null){
43 |                         echo "提示：".$msg;
44 |                     }
45 |                 ?>
46 |             </div>
47 |             <div id="img">
48 |                 <?php
49 |                     if($is_upload){
50 |                         echo '<img src="'.$img_path.'" width="250px" />';
51 |                     }
52 |                 ?>
53 |             </div>
54 |         </li>
55 |         <?php 
56 |             if($_GET['action'] == "show_code"){
57 |                 include 'show_code.php';
58 |             }
59 |         ?>
60 |     </ol>
61 | </div>
62 | 
63 | <?php
64 | include '../footer.php';
65 | ?>


--------------------------------------------------------------------------------
/Pass-13/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">$is_upload = false;
 5 | $msg = null;
 6 | if(isset($_POST['submit'])){
 7 |     $ext_arr = array('jpg','png','gif');
 8 |     $file_ext = substr($_FILES['upload_file']['name'],strrpos($_FILES['upload_file']['name'],".")+1);
 9 |     if(in_array($file_ext,$ext_arr)){
10 |         $temp_file = $_FILES['upload_file']['tmp_name'];
11 |         $img_path = $_POST['save_path']."/".rand(10, 99).date("YmdHis").".".$file_ext;
12 | 
13 |         if(move_uploaded_file($temp_file,$img_path)){
14 |             $is_upload = true;
15 |         } else {
16 |             $msg = "上传失败";
17 |         }
18 |     } else {
19 |         $msg = "只允许上传.jpg|.png|.gif类型文件！";
20 |     }
21 | }
22 | </code>
23 | </pre>
24 | </li>


--------------------------------------------------------------------------------
/Pass-14/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo '本pass检查图标内容开头2个字节！';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-14/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../head.php';
 4 | include '../menu.php';
 5 | 
 6 | function getReailFileType($filename){
 7 |     $file = fopen($filename, "rb");
 8 |     $bin = fread($file, 2); //只读2字节
 9 |     fclose($file);
10 |     $strInfo = @unpack("C2chars", $bin);    
11 |     $typeCode = intval($strInfo['chars1'].$strInfo['chars2']);    
12 |     $fileType = '';    
13 |     switch($typeCode){      
14 |         case 255216:            
15 |             $fileType = 'jpg';
16 |             break;
17 |         case 13780:            
18 |             $fileType = 'png';
19 |             break;        
20 |         case 7173:            
21 |             $fileType = 'gif';
22 |             break;
23 |         default:            
24 |             $fileType = 'unknown';
25 |         }    
26 |         return $fileType;
27 | }
28 | 
29 | $is_upload = false;
30 | $msg = null;
31 | if(isset($_POST['submit'])){
32 |     $temp_file = $_FILES['upload_file']['tmp_name'];
33 |     $file_type = getReailFileType($temp_file);
34 | 
35 |     if($file_type == 'unknown'){
36 |         $msg = "文件未知，上传失败！";
37 |     }else{
38 |         $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").".".$file_type;
39 |         if(move_uploaded_file($temp_file,$img_path)){
40 |             $is_upload = true;
41 |         } else {
42 |             $msg = "上传出错！";
43 |         }
44 |     }
45 | }
46 | ?>
47 | 
48 | <div id="upload_panel">
49 |     <ol>
50 |         <li>
51 |             <h3>任务</h3>
52 |             <p>上传<code>图片马</code>到服务器。</p>
53 |             <p>注意：</p>
54 |             <p>1.保证上传后的图片马中仍然包含完整的<code>一句话</code>或<code>webshell</code>代码。</p>
55 |             <p>2.使用<a href="<?php echo INC_VUL_PATH;?>" target="_bank">文件包含漏洞</a>能运行图片马中的恶意代码。</p>
56 |             <p>3.图片马要<code>.jpg</code>,<code>.png</code>,<code>.gif</code>三种后缀都上传成功才算过关！</p>
57 |         </li>
58 |         <li>
59 |             <h3>上传区</h3>
60 |             <form enctype="multipart/form-data" method="post">
61 |                 <p>请选择要上传的图片：<p>
62 |                 <input class="input_file" type="file" name="upload_file"/>
63 |                 <input class="button" type="submit" name="submit" value="上传"/>
64 |             </form>
65 |             <div id="msg">
66 |                 <?php 
67 |                     if($msg != null){
68 |                         echo "提示：".$msg;
69 |                     }
70 |                 ?>
71 |             </div>
72 |             <div id="img">
73 |                 <?php
74 |                     if($is_upload){
75 |                         echo '<img src="'.$img_path.'" width="250px" />';
76 |                     }
77 |                 ?>
78 |             </div>
79 |         </li>
80 |         <?php 
81 |             if($_GET['action'] == "show_code"){
82 |                 include 'show_code.php';
83 |             }
84 |         ?>
85 |     </ol>
86 | </div>
87 | 
88 | <?php
89 | include '../footer.php';
90 | ?>


--------------------------------------------------------------------------------
/Pass-14/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">function getReailFileType($filename){
 5 |     $file = fopen($filename, "rb");
 6 |     $bin = fread($file, 2); //只读2字节
 7 |     fclose($file);
 8 |     $strInfo = @unpack("C2chars", $bin);    
 9 |     $typeCode = intval($strInfo['chars1'].$strInfo['chars2']);    
10 |     $fileType = '';    
11 |     switch($typeCode){      
12 |         case 255216:            
13 |             $fileType = 'jpg';
14 |             break;
15 |         case 13780:            
16 |             $fileType = 'png';
17 |             break;        
18 |         case 7173:            
19 |             $fileType = 'gif';
20 |             break;
21 |         default:            
22 |             $fileType = 'unknown';
23 |         }    
24 |         return $fileType;
25 | }
26 | 
27 | $is_upload = false;
28 | $msg = null;
29 | if(isset($_POST['submit'])){
30 |     $temp_file = $_FILES['upload_file']['tmp_name'];
31 |     $file_type = getReailFileType($temp_file);
32 | 
33 |     if($file_type == 'unknown'){
34 |         $msg = "文件未知，上传失败！";
35 |     }else{
36 |         $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").".".$file_type;
37 |         if(move_uploaded_file($temp_file,$img_path)){
38 |             $is_upload = true;
39 |         } else {
40 |             $msg = "上传出错！";
41 |         }
42 |     }
43 | }
44 | </code>
45 | </pre>
46 | </li>


--------------------------------------------------------------------------------
/Pass-15/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo '本pass使用getimagesize()检查是否为图片文件！';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-15/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../head.php';
 4 | include '../menu.php';
 5 | 
 6 | function isImage($filename){
 7 |     $types = '.jpeg|.png|.gif';
 8 |     if(file_exists($filename)){
 9 |         $info = getimagesize($filename);
10 |         $ext = image_type_to_extension($info[2]);
11 |         if(stripos($types,$ext)>=0){
12 |             return $ext;
13 |         }else{
14 |             return false;
15 |         }
16 |     }else{
17 |         return false;
18 |     }
19 | }
20 | 
21 | $is_upload = false;
22 | $msg = null;
23 | if(isset($_POST['submit'])){
24 |     $temp_file = $_FILES['upload_file']['tmp_name'];
25 |     $res = isImage($temp_file);
26 |     if(!$res){
27 |         $msg = "文件未知，上传失败！";
28 |     }else{
29 |         $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").$res;
30 |         if(move_uploaded_file($temp_file,$img_path)){
31 |             $is_upload = true;
32 |         } else {
33 |             $msg = "上传出错！";
34 |         }
35 |     }
36 | }
37 | ?>
38 | 
39 | <div id="upload_panel">
40 |     <ol>
41 |         <li>
42 |             <h3>任务</h3>
43 |             <p>上传<code>图片马</code>到服务器。</p>
44 |             <p>注意：</p>
45 |             <p>1.保证上传后的图片马中仍然包含完整的<code>一句话</code>或<code>webshell</code>代码。</p>
46 |             <p>2.使用<a href="<?php echo INC_VUL_PATH;?>" target="_bank">文件包含漏洞</a>能运行图片马中的恶意代码。</p>
47 |             <p>3.图片马要<code>.jpg</code>,<code>.png</code>,<code>.gif</code>三种后缀都上传成功才算过关！</p>
48 |         </li>
49 |         <li>
50 |             <h3>上传区</h3>
51 |             <form enctype="multipart/form-data" method="post">
52 |                 <p>请选择要上传的图片：<p>
53 |                 <input class="input_file" type="file" name="upload_file"/>
54 |                 <input class="button" type="submit" name="submit" value="上传"/>
55 |             </form>
56 |             <div id="msg">
57 |                 <?php 
58 |                     if($msg != null){
59 |                         echo "提示：".$msg;
60 |                     }
61 |                 ?>
62 |             </div>
63 |             <div id="img">
64 |                 <?php
65 |                     if($is_upload){
66 |                         echo '<img src="'.$img_path.'" width="250px" />';
67 |                     }
68 |                 ?>
69 |             </div>
70 |         </li>
71 |         <?php 
72 |             if($_GET['action'] == "show_code"){
73 |                 include 'show_code.php';
74 |             }
75 |         ?>
76 |     </ol>
77 | </div>
78 | 
79 | <?php
80 | include '../footer.php';
81 | ?>


--------------------------------------------------------------------------------
/Pass-15/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">function isImage($filename){
 5 |     $types = '.jpeg|.png|.gif';
 6 |     if(file_exists($filename)){
 7 |         $info = getimagesize($filename);
 8 |         $ext = image_type_to_extension($info[2]);
 9 |         if(stripos($types,$ext)>=0){
10 |             return $ext;
11 |         }else{
12 |             return false;
13 |         }
14 |     }else{
15 |         return false;
16 |     }
17 | }
18 | 
19 | $is_upload = false;
20 | $msg = null;
21 | if(isset($_POST['submit'])){
22 |     $temp_file = $_FILES['upload_file']['tmp_name'];
23 |     $res = isImage($temp_file);
24 |     if(!$res){
25 |         $msg = "文件未知，上传失败！";
26 |     }else{
27 |         $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").$res;
28 |         if(move_uploaded_file($temp_file,$img_path)){
29 |             $is_upload = true;
30 |         } else {
31 |             $msg = "上传出错！";
32 |         }
33 |     }
34 | }
35 | </code>
36 | </pre>
37 | </li>


--------------------------------------------------------------------------------
/Pass-16/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo '本pass使用exif_imagetype()检查是否为图片文件！';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-16/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../head.php';
 4 | include '../menu.php';
 5 | 
 6 | function isImage($filename){
 7 |     //需要开启php_exif模块
 8 |     $image_type = exif_imagetype($filename);
 9 |     switch ($image_type) {
10 |         case IMAGETYPE_GIF:
11 |             return "gif";
12 |             break;
13 |         case IMAGETYPE_JPEG:
14 |             return "jpg";
15 |             break;
16 |         case IMAGETYPE_PNG:
17 |             return "png";
18 |             break;    
19 |         default:
20 |             return false;
21 |             break;
22 |     }
23 | }
24 | 
25 | $is_upload = false;
26 | $msg = null;
27 | if(isset($_POST['submit'])){
28 |     $temp_file = $_FILES['upload_file']['tmp_name'];
29 |     $res = isImage($temp_file);
30 |     if(!$res){
31 |         $msg = "文件未知，上传失败！";
32 |     }else{
33 |         $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").".".$res;
34 |         if(move_uploaded_file($temp_file,$img_path)){
35 |             $is_upload = true;
36 |         } else {
37 |             $msg = "上传出错！";
38 |         }
39 |     }
40 | }
41 | ?>
42 | 
43 | <div id="upload_panel">
44 |     <ol>
45 |         <li>
46 |             <h3>任务</h3>
47 |             <p>上传<code>图片马</code>到服务器。</p>
48 |             <p>注意：</p>
49 |             <p>1.保证上传后的图片马中仍然包含完整的<code>一句话</code>或<code>webshell</code>代码。</p>
50 |             <p>2.使用<a href="<?php echo INC_VUL_PATH;?>" target="_bank">文件包含漏洞</a>能运行图片马中的恶意代码。</p>
51 |             <p>3.图片马要<code>.jpg</code>,<code>.png</code>,<code>.gif</code>三种后缀都上传成功才算过关！</p>
52 |         </li>
53 |         <li>
54 |             <h3>上传区</h3>
55 |             <form enctype="multipart/form-data" method="post">
56 |                 <p>请选择要上传的图片：<p>
57 |                 <input class="input_file" type="file" name="upload_file"/>
58 |                 <input class="button" type="submit" name="submit" value="上传"/>
59 |             </form>
60 |             <div id="msg">
61 |                 <?php 
62 |                     if($msg != null){
63 |                         echo "提示：".$msg;
64 |                     }
65 |                 ?>
66 |             </div>
67 |             <div id="img">
68 |                 <?php
69 |                     if($is_upload){
70 |                         echo '<img src="'.$img_path.'" width="250px" />';
71 |                     }
72 |                 ?>
73 |             </div>
74 |         </li>
75 |         <?php 
76 |             if($_GET['action'] == "show_code"){
77 |                 include 'show_code.php';
78 |             }
79 |         ?>
80 |     </ol>
81 | </div>
82 | 
83 | <?php
84 | include '../footer.php';
85 | ?>


--------------------------------------------------------------------------------
/Pass-16/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">function isImage($filename){
 5 |     //需要开启php_exif模块
 6 |     $image_type = exif_imagetype($filename);
 7 |     switch ($image_type) {
 8 |         case IMAGETYPE_GIF:
 9 |             return "gif";
10 |             break;
11 |         case IMAGETYPE_JPEG:
12 |             return "jpg";
13 |             break;
14 |         case IMAGETYPE_PNG:
15 |             return "png";
16 |             break;    
17 |         default:
18 |             return false;
19 |             break;
20 |     }
21 | }
22 | 
23 | $is_upload = false;
24 | $msg = null;
25 | if(isset($_POST['submit'])){
26 |     $temp_file = $_FILES['upload_file']['tmp_name'];
27 |     $res = isImage($temp_file);
28 |     if(!$res){
29 |         $msg = "文件未知，上传失败！";
30 |     }else{
31 |         $img_path = UPLOAD_PATH."/".rand(10, 99).date("YmdHis").".".$res;
32 |         if(move_uploaded_file($temp_file,$img_path)){
33 |             $is_upload = true;
34 |         } else {
35 |             $msg = "上传出错！";
36 |         }
37 |     }
38 | }
39 | </code>
40 | </pre>
41 | </li>


--------------------------------------------------------------------------------
/Pass-17/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo '本pass重新渲染了图片！';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-17/index.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | include '../config.php';
  3 | include '../head.php';
  4 | include '../menu.php';
  5 | 
  6 | $is_upload = false;
  7 | $msg = null;
  8 | if (isset($_POST['submit'])){
  9 |     // 获得上传文件的基本信息，文件名，类型，大小，临时文件路径
 10 |     $filename = $_FILES['upload_file']['name'];
 11 |     $filetype = $_FILES['upload_file']['type'];
 12 |     $tmpname = $_FILES['upload_file']['tmp_name'];
 13 | 
 14 |     $target_path=UPLOAD_PATH.'/'.basename($filename);
 15 | 
 16 |     // 获得上传文件的扩展名
 17 |     $fileext= substr(strrchr($filename,"."),1);
 18 | 
 19 |     //判断文件后缀与类型，合法才进行上传操作
 20 |     if(($fileext == "jpg") && ($filetype=="image/jpeg")){
 21 |         if(move_uploaded_file($tmpname,$target_path)){
 22 |             //使用上传的图片生成新的图片
 23 |             $im = imagecreatefromjpeg($target_path);
 24 | 
 25 |             if($im == false){
 26 |                 $msg = "该文件不是jpg格式的图片！";
 27 |                 @unlink($target_path);
 28 |             }else{
 29 |                 //给新图片指定文件名
 30 |                 srand(time());
 31 |                 $newfilename = strval(rand()).".jpg";
 32 |                 //显示二次渲染后的图片（使用用户上传图片生成的新图片）
 33 |                 $img_path = UPLOAD_PATH.'/'.$newfilename;
 34 |                 imagejpeg($im,$img_path);
 35 |                 @unlink($target_path);
 36 |                 $is_upload = true;
 37 |             }
 38 |         } else {
 39 |             $msg = "上传出错！";
 40 |         }
 41 | 
 42 |     }else if(($fileext == "png") && ($filetype=="image/png")){
 43 |         if(move_uploaded_file($tmpname,$target_path)){
 44 |             //使用上传的图片生成新的图片
 45 |             $im = imagecreatefrompng($target_path);
 46 | 
 47 |             if($im == false){
 48 |                 $msg = "该文件不是png格式的图片！";
 49 |                 @unlink($target_path);
 50 |             }else{
 51 |                  //给新图片指定文件名
 52 |                 srand(time());
 53 |                 $newfilename = strval(rand()).".png";
 54 |                 //显示二次渲染后的图片（使用用户上传图片生成的新图片）
 55 |                 $img_path = UPLOAD_PATH.'/'.$newfilename;
 56 |                 imagepng($im,$img_path);
 57 | 
 58 |                 @unlink($target_path);
 59 |                 $is_upload = true;               
 60 |             }
 61 |         } else {
 62 |             $msg = "上传出错！";
 63 |         }
 64 | 
 65 |     }else if(($fileext == "gif") && ($filetype=="image/gif")){
 66 |         if(move_uploaded_file($tmpname,$target_path)){
 67 |             //使用上传的图片生成新的图片
 68 |             $im = imagecreatefromgif($target_path);
 69 |             if($im == false){
 70 |                 $msg = "该文件不是gif格式的图片！";
 71 |                 @unlink($target_path);
 72 |             }else{
 73 |                 //给新图片指定文件名
 74 |                 srand(time());
 75 |                 $newfilename = strval(rand()).".gif";
 76 |                 //显示二次渲染后的图片（使用用户上传图片生成的新图片）
 77 |                 $img_path = UPLOAD_PATH.'/'.$newfilename;
 78 |                 imagegif($im,$img_path);
 79 | 
 80 |                 @unlink($target_path);
 81 |                 $is_upload = true;
 82 |             }
 83 |         } else {
 84 |             $msg = "上传出错！";
 85 |         }
 86 |     }else{
 87 |         $msg = "只允许上传后缀为.jpg|.png|.gif的图片文件！";
 88 |     }
 89 | }
 90 | ?>
 91 | 
 92 | <div id="upload_panel">
 93 |     <ol>
 94 |         <li>
 95 |             <h3>任务</h3>
 96 |             <p>上传<code>图片马</code>到服务器。</p>
 97 |             <p>注意：</p>
 98 |             <p>1.保证上传后的图片马中仍然包含完整的<code>一句话</code>或<code>webshell</code>代码。</p>
 99 |             <p>2.使用<a href="<?php echo INC_VUL_PATH;?>" target="_bank">文件包含漏洞</a>能运行图片马中的恶意代码。</p>
100 |             <p>3.图片马要<code>.jpg</code>,<code>.png</code>,<code>.gif</code>三种后缀都上传成功才算过关！</p>
101 |         </li>
102 |         <li>
103 |             <h3>上传区</h3>
104 |             <form enctype="multipart/form-data" method="post">
105 |                 <p>请选择要上传的图片：<p>
106 |                 <input class="input_file" type="file" name="upload_file"/>
107 |                 <input class="button" type="submit" name="submit" value="上传"/>
108 |             </form>
109 |             <div id="msg">
110 |                 <?php 
111 |                     if($msg != null){
112 |                         echo "提示：".$msg;
113 |                     }
114 |                 ?>
115 |             </div>
116 |             <div id="img">
117 |                 <?php
118 |                     if($is_upload){
119 |                         echo '<img src="'.$img_path.'" width="250px" />';
120 |                     }
121 |                 ?>
122 |             </div>
123 |         </li>
124 |         <?php 
125 |             if($_GET['action'] == "show_code"){
126 |                 include 'show_code.php';
127 |             }
128 |         ?>
129 |     </ol>
130 | </div>
131 | 
132 | <?php
133 | include '../footer.php';
134 | ?>


--------------------------------------------------------------------------------
/Pass-17/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">$is_upload = false;
 5 | $msg = null;
 6 | if (isset($_POST['submit'])){
 7 |     // 获得上传文件的基本信息，文件名，类型，大小，临时文件路径
 8 |     $filename = $_FILES['upload_file']['name'];
 9 |     $filetype = $_FILES['upload_file']['type'];
10 |     $tmpname = $_FILES['upload_file']['tmp_name'];
11 | 
12 |     $target_path=UPLOAD_PATH.'/'.basename($filename);
13 | 
14 |     // 获得上传文件的扩展名
15 |     $fileext= substr(strrchr($filename,"."),1);
16 | 
17 |     //判断文件后缀与类型，合法才进行上传操作
18 |     if(($fileext == "jpg") && ($filetype=="image/jpeg")){
19 |         if(move_uploaded_file($tmpname,$target_path)){
20 |             //使用上传的图片生成新的图片
21 |             $im = imagecreatefromjpeg($target_path);
22 | 
23 |             if($im == false){
24 |                 $msg = "该文件不是jpg格式的图片！";
25 |                 @unlink($target_path);
26 |             }else{
27 |                 //给新图片指定文件名
28 |                 srand(time());
29 |                 $newfilename = strval(rand()).".jpg";
30 |                 //显示二次渲染后的图片（使用用户上传图片生成的新图片）
31 |                 $img_path = UPLOAD_PATH.'/'.$newfilename;
32 |                 imagejpeg($im,$img_path);
33 |                 @unlink($target_path);
34 |                 $is_upload = true;
35 |             }
36 |         } else {
37 |             $msg = "上传出错！";
38 |         }
39 | 
40 |     }else if(($fileext == "png") && ($filetype=="image/png")){
41 |         if(move_uploaded_file($tmpname,$target_path)){
42 |             //使用上传的图片生成新的图片
43 |             $im = imagecreatefrompng($target_path);
44 | 
45 |             if($im == false){
46 |                 $msg = "该文件不是png格式的图片！";
47 |                 @unlink($target_path);
48 |             }else{
49 |                  //给新图片指定文件名
50 |                 srand(time());
51 |                 $newfilename = strval(rand()).".png";
52 |                 //显示二次渲染后的图片（使用用户上传图片生成的新图片）
53 |                 $img_path = UPLOAD_PATH.'/'.$newfilename;
54 |                 imagepng($im,$img_path);
55 | 
56 |                 @unlink($target_path);
57 |                 $is_upload = true;               
58 |             }
59 |         } else {
60 |             $msg = "上传出错！";
61 |         }
62 | 
63 |     }else if(($fileext == "gif") && ($filetype=="image/gif")){
64 |         if(move_uploaded_file($tmpname,$target_path)){
65 |             //使用上传的图片生成新的图片
66 |             $im = imagecreatefromgif($target_path);
67 |             if($im == false){
68 |                 $msg = "该文件不是gif格式的图片！";
69 |                 @unlink($target_path);
70 |             }else{
71 |                 //给新图片指定文件名
72 |                 srand(time());
73 |                 $newfilename = strval(rand()).".gif";
74 |                 //显示二次渲染后的图片（使用用户上传图片生成的新图片）
75 |                 $img_path = UPLOAD_PATH.'/'.$newfilename;
76 |                 imagegif($im,$img_path);
77 | 
78 |                 @unlink($target_path);
79 |                 $is_upload = true;
80 |             }
81 |         } else {
82 |             $msg = "上传出错！";
83 |         }
84 |     }else{
85 |         $msg = "只允许上传后缀为.jpg|.png|.gif的图片文件！";
86 |     }
87 | }
88 | </code>
89 | </pre>
90 | </li>


--------------------------------------------------------------------------------
/Pass-18/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo '需要代码审计！';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-18/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../head.php';
 4 | include '../menu.php';
 5 | 
 6 | $is_upload = false;
 7 | $msg = null;
 8 | 
 9 | if(isset($_POST['submit'])){
10 |     $ext_arr = array('jpg','png','gif');
11 |     $file_name = $_FILES['upload_file']['name'];
12 |     $temp_file = $_FILES['upload_file']['tmp_name'];
13 |     $file_ext = substr($file_name,strrpos($file_name,".")+1);
14 |     $upload_file = UPLOAD_PATH . '/' . $file_name;
15 | 
16 |     if(move_uploaded_file($temp_file, $upload_file)){
17 |         if(in_array($file_ext,$ext_arr)){
18 |              $img_path = UPLOAD_PATH . '/'. rand(10, 99).date("YmdHis").".".$file_ext;
19 |              rename($upload_file, $img_path);
20 |              $is_upload = true;
21 |         }else{
22 |             $msg = "只允许上传.jpg|.png|.gif类型文件！";
23 |             unlink($upload_file);
24 |         }
25 |     }else{
26 |         $msg = '上传出错！';
27 |     }
28 | }
29 | ?>
30 | 
31 | <div id="upload_panel">
32 |     <ol>
33 |         <li>
34 |             <h3>任务</h3>
35 |             <p>上传一个<code>webshell</code>到服务器。</p>
36 |         </li>
37 |         <li>
38 |             <h3>上传区</h3>
39 |             <form enctype="multipart/form-data" method="post">
40 |                 <p>请选择要上传的图片：<p>
41 |                 <input class="input_file" type="file" name="upload_file"/>
42 |                 <input class="button" type="submit" name="submit" value="上传"/>
43 |             </form>
44 |             <div id="msg">
45 |                 <?php 
46 |                     if($msg != null){
47 |                         echo "提示：".$msg;
48 |                     }
49 |                 ?>
50 |             </div>
51 |             <div id="img">
52 |                 <?php
53 |                     if($is_upload){
54 |                         echo '<img src="'.$img_path.'" width="250px" />';
55 |                     }
56 |                 ?>
57 |             </div>
58 |         </li>
59 |         <?php 
60 |             if($_GET['action'] == "show_code"){
61 |                 include 'show_code.php';
62 |             }
63 |         ?>
64 |     </ol>
65 | </div>
66 | 
67 | <?php
68 | include '../footer.php';
69 | ?>


--------------------------------------------------------------------------------
/Pass-18/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>index.php代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">$is_upload = false;
 5 | $msg = null;
 6 | 
 7 | if(isset($_POST['submit'])){
 8 |     $ext_arr = array('jpg','png','gif');
 9 |     $file_name = $_FILES['upload_file']['name'];
10 |     $temp_file = $_FILES['upload_file']['tmp_name'];
11 |     $file_ext = substr($file_name,strrpos($file_name,".")+1);
12 |     $upload_file = UPLOAD_PATH . '/' . $file_name;
13 | 
14 |     if(move_uploaded_file($temp_file, $upload_file)){
15 |         if(in_array($file_ext,$ext_arr)){
16 |              $img_path = UPLOAD_PATH . '/'. rand(10, 99).date("YmdHis").".".$file_ext;
17 |              rename($upload_file, $img_path);
18 |              $is_upload = true;
19 |         }else{
20 |             $msg = "只允许上传.jpg|.png|.gif类型文件！";
21 |             unlink($upload_file);
22 |         }
23 |     }else{
24 |         $msg = '上传出错！';
25 |     }
26 | }
27 | </code>
28 | </pre>
29 | </li>


--------------------------------------------------------------------------------
/Pass-19/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo '需要代码审计！';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-19/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../head.php';
 4 | include '../menu.php';
 5 | 
 6 | $is_upload = false;
 7 | $msg = null;
 8 | if (isset($_POST['submit']))
 9 | {
10 |     require_once("./myupload.php");
11 |     $imgFileName =time();
12 |     $u = new MyUpload($_FILES['upload_file']['name'], $_FILES['upload_file']['tmp_name'], $_FILES['upload_file']['size'],$imgFileName);
13 |     $status_code = $u->upload(UPLOAD_PATH);
14 |     switch ($status_code) {
15 |         case 1:
16 |             $is_upload = true;
17 |             $img_path = $u->cls_upload_dir . $u->cls_file_rename_to;
18 |             break;
19 |         case 2:
20 |             $msg = '文件已经被上传，但没有重命名。';
21 |             break; 
22 |         case -1:
23 |             $msg = '这个文件不能上传到服务器的临时文件存储目录。';
24 |             break; 
25 |         case -2:
26 |             $msg = '上传失败，上传目录不可写。';
27 |             break; 
28 |         case -3:
29 |             $msg = '上传失败，无法上传该类型文件。';
30 |             break; 
31 |         case -4:
32 |             $msg = '上传失败，上传的文件过大。';
33 |             break; 
34 |         case -5:
35 |             $msg = '上传失败，服务器已经存在相同名称文件。';
36 |             break; 
37 |         case -6:
38 |             $msg = '文件无法上传，文件不能复制到目标目录。';
39 |             break;      
40 |         default:
41 |             $msg = '未知错误！';
42 |             break;
43 |     }
44 | }
45 | ?>
46 | 
47 | <div id="upload_panel">
48 |     <ol>
49 |         <li>
50 |             <h3>任务</h3>
51 |             <p>上传一个<code>webshell</code>到服务器。</p>
52 |         </li>
53 |         <li>
54 |             <h3>上传区</h3>
55 |             <form enctype="multipart/form-data" method="post">
56 |                 <p>请选择要上传的图片：<p>
57 |                 <input class="input_file" type="file" name="upload_file"/>
58 |                 <input class="button" type="submit" name="submit" value="上传"/>
59 |             </form>
60 |             <div id="msg">
61 |                 <?php 
62 |                     if($msg != null){
63 |                         echo "提示：".$msg;
64 |                     }
65 |                 ?>
66 |             </div>
67 |             <div id="img">
68 |                 <?php
69 |                     if($is_upload){
70 |                         echo '<img src="'.$img_path.'" width="250px" />';
71 |                     }
72 |                 ?>
73 |             </div>
74 |         </li>
75 |         <?php 
76 |             if($_GET['action'] == "show_code"){
77 |                 include 'show_code.php';
78 |             }
79 |         ?>
80 |     </ol>
81 | </div>
82 | 
83 | <?php
84 | include '../footer.php';
85 | ?>


--------------------------------------------------------------------------------
/Pass-19/myupload.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | /** MyUpload.php
  3 |  ** A form Upload class, responsable for handling files upload.
  4 |  ** 
  5 |  ** The basic steps to upload are:
  6 |  **
  7 |  ** -> check if the file has been uploaded to your server tmp dir
  8 |  ** -> set the directory to upload to
  9 |  ** -> check if the type of file is accepted (extension of file only)
 10 |  ** -> check the size of the file
 11 |  ** -> check if file exists in upload dir (not mandatory)
 12 |  ** -> move the file to upload dir
 13 |  ** -> rename the uploaded file (not mandatory)
 14 |  **
 15 |  ** This class has been tested on: (send me an email if you have success
 16 |  ** on other server)
 17 |  ** - Apache/1.3.22 (rpm patched on 2002-06-30) on Linux Red Hat with PHP 4 >= 4.0.3
 18 |  ** 
 19 |  ** Modification:
 20 |  ** - 2002/07/06 Re-Wrote the class completely (see note below)
 21 |  ** - 2002/07/12 Add strtolower to checkExtension() (as submitted by jv63305533@gmx.netNOSPAM)
 22 |  **
 23 |  ** @author Pierre-Yves Lemaire (pylem_2000@yahoo.ca)
 24 |  ** @version 1.0 (August 2001)
 25 |  ** @version 2.0 (July 2002) (!not compatible with 1.0)
 26 |  ** 
 27 |  **
 28 |  ** NOTE:
 29 |  ** I decide to write the class entirely. It is now based on new function
 30 |  ** ONLY AVAILABLE on PHP 4 >= 4.0.3.
 31 |  **
 32 |  ** TO DO:
 33 |  ** - Program a sub class that will handle multiple uploads.
 34 |  ** - Test and adapt to other platform.
 35 |  ** - Program setter and getter fct for better OO style.
 36 |  ** - Analyze the script to improve the security.
 37 |  **
 38 |  ** DISCLAIMER:
 39 |  ** Distributed "as is", fell free to modify any part of this code.
 40 |  ** You can use this for any projects you want, commercial or not.
 41 |  ** It would be very kind to email me any suggestions you have or bugs you might find :)
 42 |  **
 43 |  **/
 44 | 
 45 | class MyUpload{    
 46 | 
 47 |   var $cls_upload_dir = "";         // Directory to upload to.
 48 | 	var $cls_filename = "";           // Name of the upload file.
 49 | 	var $cls_tmp_filename = "";       // TMP file Name (tmp name by php).
 50 |   var $cls_max_filesize = 33554432; // Max file size.
 51 |   var $cls_filesize ="";            // Actual file size.
 52 |   var $cls_arr_ext_accepted = array(
 53 |       ".doc", ".xls", ".txt", ".pdf", ".gif", ".jpg", ".zip", ".rar", ".7z",".ppt",
 54 |       ".html", ".xml", ".tiff", ".jpeg", ".png" );
 55 |   var $cls_file_exists = 0;         // Set to 1 to check if file exist before upload.
 56 |   var $cls_rename_file = 1;         // Set to 1 to rename file after upload.
 57 |   var $cls_file_rename_to = '';     // New name for the file after upload.
 58 |   var $cls_verbal = 0;              // Set to 1 to return an a string instead of an error code.
 59 | 
 60 |   /** constructor()
 61 |    **
 62 |    ** @para String File name
 63 |    ** @para String Temp file name
 64 |    ** @para Int File size
 65 |    ** @para String file rename to
 66 |   **/
 67 |   function MyUpload( $file_name, $tmp_file_name, $file_size, $file_rename_to = '' ){
 68 |   
 69 |     $this->cls_filename = $file_name;
 70 |     $this->cls_tmp_filename = $tmp_file_name;
 71 |     $this->cls_filesize = $file_size;
 72 |     $this->cls_file_rename_to = $file_rename_to;
 73 |   }
 74 | 
 75 |   /** isUploadedFile()
 76 |    **
 77 |    ** Method to wrap php 4.0.3 is_uploaded_file fct
 78 |    ** It will return an error code if the file has not been upload to /tmp on the web server
 79 |    ** (look with phpinfo() fct where php store tmp uploaded file)
 80 |    ** @returns string
 81 |   **/
 82 |   function isUploadedFile(){
 83 |     
 84 |     if( is_uploaded_file( $this->cls_tmp_filename ) != true ){
 85 |       return "IS_UPLOADED_FILE_FAILURE";
 86 |     } else {
 87 |       return 1;
 88 |     }
 89 |   }
 90 | 
 91 |   /** setDir()
 92 |    **
 93 |    ** Method to set the directory we will upload to. 
 94 |    ** It will return an error code if the dir is not writable.
 95 |    ** @para String name of directory we upload to
 96 |    ** @returns string
 97 |   **/
 98 |   function setDir( $dir ){
 99 |     
100 |     if( !is_writable( $dir ) ){
101 |       return "DIRECTORY_FAILURE";
102 |     } else { 
103 |       $this->cls_upload_dir = $dir;
104 |       return 1;
105 |     }
106 |   }
107 | 
108 |   /** checkExtension()
109 |    **
110 |    ** Method to check if we accept the file extension.
111 |    ** @returns string
112 |   **/
113 |   function checkExtension(){
114 |     
115 |     // Check if the extension is valid
116 | 
117 |     if( !in_array( strtolower( strrchr( $this->cls_filename, "." )), $this->cls_arr_ext_accepted )){
118 |       return "EXTENSION_FAILURE";
119 |     } else {
120 |       return 1;
121 |     }
122 |   }
123 | 
124 |   /** checkSize()
125 |    **
126 |    ** Method to check if the file is not to big.
127 |    ** @returns string
128 |   **/
129 |   function checkSize(){
130 | 
131 |     if( $this->cls_filesize > $this->cls_max_filesize ){
132 |       return "FILE_SIZE_FAILURE";
133 |     } else {
134 |       return 1;
135 |     }
136 |   }
137 | 
138 |   /** move()
139 |    **
140 |    ** Method to wrap php 4.0.3 fct move_uploaded_file()
141 |    ** @returns string
142 |   **/
143 |   function move(){
144 |     
145 |     if( move_uploaded_file( $this->cls_tmp_filename, $this->cls_upload_dir . $this->cls_filename ) == false ){
146 |       return "MOVE_UPLOADED_FILE_FAILURE";
147 |     } else {
148 |       return 1;
149 |     }
150 | 
151 |   }
152 | 
153 |   /** checkFileExists()
154 |    **
155 |    ** Method to check if a file with the same name exists in
156 |    ** destination folder.
157 |    ** @returns string
158 |   **/
159 |   function checkFileExists(){
160 |     
161 |     if( file_exists( $this->cls_upload_dir . $this->cls_filename ) ){
162 |       return "FILE_EXISTS_FAILURE";
163 |     } else {
164 |       return 1;
165 |     }
166 |   }
167 | 
168 |   /** renameFile()
169 |    **
170 |    ** Method to rename the uploaded file.
171 |    ** If no name was provided with the constructor, we use
172 |    ** a random name.
173 |    ** @returns string
174 |   **/
175 | 
176 |   function renameFile(){
177 | 
178 |     // if no new name was provided, we use
179 | 
180 |     if( $this->cls_file_rename_to == '' ){
181 | 
182 |       $allchar = "abcdefghijklnmopqrstuvwxyz" ; 
183 |       $this->cls_file_rename_to = "" ; 
184 |       mt_srand (( double) microtime() * 1000000 ); 
185 |       for ( $i = 0; $i<8 ; $i++ ){
186 |         $this->cls_file_rename_to .= substr( $allchar, mt_rand (0,25), 1 ) ; 
187 |       }
188 |     }    
189 |     
190 |     // Remove the extension and put it back on the new file name
191 | 		
192 |     $extension = strrchr( $this->cls_filename, "." );
193 |     $this->cls_file_rename_to .= $extension;
194 |     
195 |     if( !rename( $this->cls_upload_dir . $this->cls_filename, $this->cls_upload_dir . $this->cls_file_rename_to )){
196 |       return "RENAME_FAILURE";
197 |     } else {
198 |       return 1;
199 |     }
200 |   }
201 |   
202 |   /** upload()
203 |    **
204 |    ** Method to upload the file.
205 |    ** This is the only method to call outside the class.
206 |    ** @para String name of directory we upload to
207 |    ** @returns void
208 |   **/
209 |   function upload( $dir ){
210 |     
211 |     $ret = $this->isUploadedFile();
212 |     
213 |     if( $ret != 1 ){
214 |       return $this->resultUpload( $ret );
215 |     }
216 | 
217 |     $ret = $this->setDir( $dir );
218 |     if( $ret != 1 ){
219 |       return $this->resultUpload( $ret );
220 |     }
221 | 
222 |     $ret = $this->checkExtension();
223 |     if( $ret != 1 ){
224 |       return $this->resultUpload( $ret );
225 |     }
226 | 
227 |     $ret = $this->checkSize();
228 |     if( $ret != 1 ){
229 |       return $this->resultUpload( $ret );    
230 |     }
231 |     
232 |     // if flag to check if the file exists is set to 1
233 |     
234 |     if( $this->cls_file_exists == 1 ){
235 |       
236 |       $ret = $this->checkFileExists();
237 |       if( $ret != 1 ){
238 |         return $this->resultUpload( $ret );    
239 |       }
240 |     }
241 | 
242 |     // if we are here, we are ready to move the file to destination
243 | 
244 |     $ret = $this->move();
245 |     if( $ret != 1 ){
246 |       return $this->resultUpload( $ret );    
247 |     }
248 | 
249 |     // check if we need to rename the file
250 | 
251 |     if( $this->cls_rename_file == 1 ){
252 |       $ret = $this->renameFile();
253 |       if( $ret != 1 ){
254 |         return $this->resultUpload( $ret );    
255 |       }
256 |     }
257 |     
258 |     // if we are here, everything worked as planned :)
259 | 
260 |     return $this->resultUpload( "SUCCESS" );
261 |   
262 |   }
263 | 
264 |   /** resultUpload()
265 |    **
266 |    ** Method that returns the status of the upload
267 |    ** (You should put cls_verbal to 1 during debugging...)
268 |    ** @para String Status of the upload
269 |    ** @returns mixed (int or string)
270 |   **/
271 |   function resultUpload( $flag ){
272 | 
273 |     switch( $flag ){
274 |       case "IS_UPLOADED_FILE_FAILURE" : if( $this->cls_verbal == 0 ) return -1; else return "The file could not be uploaded to the tmp directory of the web server.";
275 |         break;
276 |       case "DIRECTORY_FAILURE"        : if( $this->cls_verbal == 0 ) return -2; else return "The file could not be uploaded, the directory is not writable.";
277 |         break;
278 |       case "EXTENSION_FAILURE"        : if( $this->cls_verbal == 0 ) return -3; else return "The file could not be uploaded, this type of file is not accepted.";
279 |         break;
280 |       case "FILE_SIZE_FAILURE"        : if( $this->cls_verbal == 0 ) return -4; else return "The file could not be uploaded, this file is too big.";
281 |         break;
282 |       case "FILE_EXISTS_FAILURE"      : if( $this->cls_verbal == 0 ) return -5; else return "The file could not be uploaded, a file with the same name already exists.";
283 |         break;
284 |       case "MOVE_UPLOADED_FILE_FAILURE" : if( $this->cls_verbal == 0 ) return -6; else return "The file could not be uploaded, the file could not be copied to destination directory.";
285 |         break;
286 |       case "RENAME_FAILURE"           : if( $this->cls_verbal == 0 ) return 2; else return "The file was uploaded but could not be renamed.";
287 |         break;
288 |       case "SUCCESS"                  : if( $this->cls_verbal == 0 ) return 1; else return "Upload was successful!";
289 |         break;
290 |       default : echo "OUPS!! We do not know what happen, you should fire the programmer ;)";
291 |         break;
292 |     }
293 |   }
294 | 
295 | }; // end class
296 | 
297 | // exemple
298 | /*
299 | 
300 | if( $_POST['submit'] != '' ){
301 | 
302 |   $u = new MyUpload( $_FILES['image']['name'], $_FILES['image']['tmp_name'], $_FILES['image']['size'], "thisname" );
303 |   $result = $u->upload( "../image/upload/" );
304 |   print $result;
305 | 
306 | }
307 | 
308 | print "<br><br>\n";
309 | print "<form enctype='multipart/form-data' method='post' action='". $PHP_SELF ."'>\n";
310 | print "<input type='hidden' name='MAX_FILE_SIZE' value='200000'>\n";
311 | print "<input type='file' name='image'>\n";
312 | print "<input type='submit' value='Upload' name='submit'>\n";
313 | print "</form>\n";
314 | */
315 | ?>


--------------------------------------------------------------------------------
/Pass-19/show_code.php:
--------------------------------------------------------------------------------
  1 | <li id="show_code">
  2 |     <h3>index.php代码</h3>
  3 | <pre>
  4 | <code class="line-numbers language-php">//index.php
  5 | $is_upload = false;
  6 | $msg = null;
  7 | if (isset($_POST['submit']))
  8 | {
  9 |     require_once("./myupload.php");
 10 |     $imgFileName =time();
 11 |     $u = new MyUpload($_FILES['upload_file']['name'], $_FILES['upload_file']['tmp_name'], $_FILES['upload_file']['size'],$imgFileName);
 12 |     $status_code = $u->upload(UPLOAD_PATH);
 13 |     switch ($status_code) {
 14 |         case 1:
 15 |             $is_upload = true;
 16 |             $img_path = $u->cls_upload_dir . $u->cls_file_rename_to;
 17 |             break;
 18 |         case 2:
 19 |             $msg = '文件已经被上传，但没有重命名。';
 20 |             break; 
 21 |         case -1:
 22 |             $msg = '这个文件不能上传到服务器的临时文件存储目录。';
 23 |             break; 
 24 |         case -2:
 25 |             $msg = '上传失败，上传目录不可写。';
 26 |             break; 
 27 |         case -3:
 28 |             $msg = '上传失败，无法上传该类型文件。';
 29 |             break; 
 30 |         case -4:
 31 |             $msg = '上传失败，上传的文件过大。';
 32 |             break; 
 33 |         case -5:
 34 |             $msg = '上传失败，服务器已经存在相同名称文件。';
 35 |             break; 
 36 |         case -6:
 37 |             $msg = '文件无法上传，文件不能复制到目标目录。';
 38 |             break;      
 39 |         default:
 40 |             $msg = '未知错误！';
 41 |             break;
 42 |     }
 43 | }
 44 | 
 45 | //myupload.php
 46 | class MyUpload{
 47 | ......
 48 | ......
 49 | ...... 
 50 |   var $cls_arr_ext_accepted = array(
 51 |       ".doc", ".xls", ".txt", ".pdf", ".gif", ".jpg", ".zip", ".rar", ".7z",".ppt",
 52 |       ".html", ".xml", ".tiff", ".jpeg", ".png" );
 53 | 
 54 | ......
 55 | ......
 56 | ......  
 57 |   /** upload()
 58 |    **
 59 |    ** Method to upload the file.
 60 |    ** This is the only method to call outside the class.
 61 |    ** @para String name of directory we upload to
 62 |    ** @returns void
 63 |   **/
 64 |   function upload( $dir ){
 65 |     
 66 |     $ret = $this->isUploadedFile();
 67 |     
 68 |     if( $ret != 1 ){
 69 |       return $this->resultUpload( $ret );
 70 |     }
 71 | 
 72 |     $ret = $this->setDir( $dir );
 73 |     if( $ret != 1 ){
 74 |       return $this->resultUpload( $ret );
 75 |     }
 76 | 
 77 |     $ret = $this->checkExtension();
 78 |     if( $ret != 1 ){
 79 |       return $this->resultUpload( $ret );
 80 |     }
 81 | 
 82 |     $ret = $this->checkSize();
 83 |     if( $ret != 1 ){
 84 |       return $this->resultUpload( $ret );    
 85 |     }
 86 |     
 87 |     // if flag to check if the file exists is set to 1
 88 |     
 89 |     if( $this->cls_file_exists == 1 ){
 90 |       
 91 |       $ret = $this->checkFileExists();
 92 |       if( $ret != 1 ){
 93 |         return $this->resultUpload( $ret );    
 94 |       }
 95 |     }
 96 | 
 97 |     // if we are here, we are ready to move the file to destination
 98 | 
 99 |     $ret = $this->move();
100 |     if( $ret != 1 ){
101 |       return $this->resultUpload( $ret );    
102 |     }
103 | 
104 |     // check if we need to rename the file
105 | 
106 |     if( $this->cls_rename_file == 1 ){
107 |       $ret = $this->renameFile();
108 |       if( $ret != 1 ){
109 |         return $this->resultUpload( $ret );    
110 |       }
111 |     }
112 |     
113 |     // if we are here, everything worked as planned :)
114 | 
115 |     return $this->resultUpload( "SUCCESS" );
116 |   
117 |   }
118 | ......
119 | ......
120 | ...... 
121 | };
122 | </code>
123 | </pre>
124 | </li>


--------------------------------------------------------------------------------
/Pass-20/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo '本pass的取文件名通过$_POST来获取。';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-20/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../common.php';
 4 | include '../head.php';
 5 | include '../menu.php';
 6 | 
 7 | $is_upload = false;
 8 | $msg = null;
 9 | if (isset($_POST['submit'])) {
10 |     if (file_exists(UPLOAD_PATH)) {
11 |         $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");
12 | 
13 |         /*
14 |         $file_name = trim($_POST['save_name']);
15 |         $file_name = deldot($file_name);//删除文件名末尾的点
16 |         $file_ext = pathinfo($file_name,PATHINFO_EXTENSION);
17 |         $file_ext = strtolower($file_ext); //转换为小写
18 |         $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
19 |         $file_ext = trim($file_ext); //首尾去空
20 |         */
21 | 
22 |         $file_name = $_POST['save_name'];
23 |         $file_ext = pathinfo($file_name,PATHINFO_EXTENSION);
24 | 
25 |         if(!in_array($file_ext,$deny_ext)) {
26 |             $temp_file = $_FILES['upload_file']['tmp_name'];
27 |             $img_path = UPLOAD_PATH . '/' .$file_name;
28 |             if (move_uploaded_file($temp_file, $img_path)) { 
29 |                 $is_upload = true;
30 |             }else{
31 |                 $msg = '上传出错！';
32 |             }
33 |         }else{
34 |             $msg = '禁止保存为该类型文件！';
35 |         }
36 | 
37 |     } else {
38 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
39 |     }
40 | }
41 | ?>
42 | 
43 | <div id="upload_panel">
44 |     <ol>
45 |         <li>
46 |             <h3>任务</h3>
47 |             <p>上传一个<code>webshell</code>到服务器。</p>
48 |         </li>
49 |         <li>
50 |             <h3>上传区</h3>
51 |             <form enctype="multipart/form-data" method="post">
52 |                 <p>请选择要上传的图片：<p>
53 |                 <input class="input_file" type="file" name="upload_file"/>
54 |                 <p>保存名称:<p>
55 |                 <input class="input_text" type="text" name="save_name" value="upload-19.jpg" /><br/>
56 |                 <input class="button" type="submit" name="submit" value="上传"/>
57 |             </form>
58 |             <div id="msg">
59 |                 <?php 
60 |                     if($msg != null){
61 |                         echo "提示：".$msg;
62 |                     }
63 |                 ?>
64 |             </div>
65 |             <div id="img">
66 |                 <?php
67 |                     if($is_upload){
68 |                         echo '<img src="'.$img_path.'" width="250px" />';
69 |                     }
70 |                 ?>
71 |             </div>
72 |         </li>
73 |         <?php 
74 |             if($_GET['action'] == "show_code"){
75 |                 include 'show_code.php';
76 |             }
77 |         ?>
78 |     </ol>
79 | </div>
80 | 
81 | <?php
82 | include '../footer.php';
83 | ?>


--------------------------------------------------------------------------------
/Pass-20/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">$is_upload = false;
 5 | $msg = null;
 6 | if (isset($_POST['submit'])) {
 7 |     if (file_exists(UPLOAD_PATH)) {
 8 |         $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");
 9 | 
10 |         $file_name = $_POST['save_name'];
11 |         $file_ext = pathinfo($file_name,PATHINFO_EXTENSION);
12 | 
13 |         if(!in_array($file_ext,$deny_ext)) {
14 |             $temp_file = $_FILES['upload_file']['tmp_name'];
15 |             $img_path = UPLOAD_PATH . '/' .$file_name;
16 |             if (move_uploaded_file($temp_file, $img_path)) { 
17 |                 $is_upload = true;
18 |             }else{
19 |                 $msg = '上传出错！';
20 |             }
21 |         }else{
22 |             $msg = '禁止保存为该类型文件！';
23 |         }
24 | 
25 |     } else {
26 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
27 |     }
28 | }
29 | </code>
30 | </pre>
31 | </li>


--------------------------------------------------------------------------------
/Pass-21/helper.php:
--------------------------------------------------------------------------------
1 | <?php
2 | if($_GET['action'] == 'get_prompt'){
3 |     echo 'Pass-20来源于CTF，请审计代码！';
4 | }
5 | ?>


--------------------------------------------------------------------------------
/Pass-21/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include '../config.php';
 3 | include '../common.php';
 4 | include '../head.php';
 5 | include '../menu.php';
 6 | 
 7 | 
 8 | if (isset($_POST['submit'])) {
 9 |     if (file_exists(UPLOAD_PATH)) {
10 | 
11 |         $is_upload = false;
12 |         $msg = null;
13 |         if(!empty($_FILES['upload_file'])){
14 |             //mime check
15 |             $allow_type = array('image/jpeg','image/png','image/gif');
16 |             if(!in_array($_FILES['upload_file']['type'],$allow_type)){
17 |                 $msg = "禁止上传该类型文件!";
18 |             }else{
19 |                 //check filename
20 |                 $file = empty($_POST['save_name']) ? $_FILES['upload_file']['name'] : $_POST['save_name'];
21 |                 if (!is_array($file)) {
22 |                     $file = explode('.', strtolower($file));
23 |                 }
24 | 
25 |                 $ext = end($file);
26 |                 $allow_suffix = array('jpg','png','gif');
27 |                 if (!in_array($ext, $allow_suffix)) {
28 |                     $msg = "禁止上传该后缀文件!";
29 |                 }else{
30 |                     $file_name = reset($file) . '.' . $file[count($file) - 1];
31 |                     $temp_file = $_FILES['upload_file']['tmp_name'];
32 |                     $img_path = UPLOAD_PATH . '/' .$file_name;
33 |                     if (move_uploaded_file($temp_file, $img_path)) {
34 |                         $msg = "文件上传成功！";
35 |                         $is_upload = true;
36 |                     } else {
37 |                         $msg = "文件上传失败！";
38 |                     }
39 |                 }
40 |             }
41 |         }else{
42 |             $msg = "请选择要上传的文件！";
43 |         }
44 |         
45 |     } else {
46 |         $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
47 |     }
48 | }
49 | 
50 | 
51 | 
52 | ?>
53 | 
54 | <div id="upload_panel">
55 |     <ol>
56 |         <li>
57 |             <h3>任务</h3>
58 |             <p>上传一个<code>webshell</code>到服务器。</p>
59 |         </li>
60 |         <li>
61 |             <h3>上传区</h3>
62 |             <form enctype="multipart/form-data" method="post">
63 |                 <p>请选择要上传的图片：<p>
64 |                 <input class="input_file" type="file" name="upload_file"/>
65 |                 <p>保存名称:<p>
66 |                 <input class="input_text" type="text" name="save_name" value="upload-20.jpg" /><br/>
67 |                 <input class="button" type="submit" name="submit" value="上传"/>
68 |             </form>
69 |             <div id="msg">
70 |                 <?php 
71 |                     if($msg != null){
72 |                         echo "提示：".$msg;
73 |                     }
74 |                 ?>
75 |             </div>
76 |             <div id="img">
77 |                 <?php
78 |                     if($is_upload){
79 |                         echo '<img src="'.$img_path.'" width="250px" />';
80 |                     }
81 |                 ?>
82 |             </div>
83 |         </li>
84 |         <?php 
85 |             if($_GET['action'] == "show_code"){
86 |                 include 'show_code.php';
87 |             }
88 |         ?>
89 |     </ol>
90 | </div>
91 | 
92 | <?php
93 | include '../footer.php';
94 | ?>


--------------------------------------------------------------------------------
/Pass-21/show_code.php:
--------------------------------------------------------------------------------
 1 | <li id="show_code">
 2 |     <h3>代码</h3>
 3 | <pre>
 4 | <code class="line-numbers language-php">$is_upload = false;
 5 | $msg = null;
 6 | if(!empty($_FILES['upload_file'])){
 7 |     //检查MIME
 8 |     $allow_type = array('image/jpeg','image/png','image/gif');
 9 |     if(!in_array($_FILES['upload_file']['type'],$allow_type)){
10 |         $msg = "禁止上传该类型文件!";
11 |     }else{
12 |         //检查文件名
13 |         $file = empty($_POST['save_name']) ? $_FILES['upload_file']['name'] : $_POST['save_name'];
14 |         if (!is_array($file)) {
15 |             $file = explode('.', strtolower($file));
16 |         }
17 | 
18 |         $ext = end($file);
19 |         $allow_suffix = array('jpg','png','gif');
20 |         if (!in_array($ext, $allow_suffix)) {
21 |             $msg = "禁止上传该后缀文件!";
22 |         }else{
23 |             $file_name = reset($file) . '.' . $file[count($file) - 1];
24 |             $temp_file = $_FILES['upload_file']['tmp_name'];
25 |             $img_path = UPLOAD_PATH . '/' .$file_name;
26 |             if (move_uploaded_file($temp_file, $img_path)) {
27 |                 $msg = "文件上传成功！";
28 |                 $is_upload = true;
29 |             } else {
30 |                 $msg = "文件上传失败！";
31 |             }
32 |         }
33 |     }
34 | }else{
35 |     $msg = "请选择要上传的文件！";
36 | }
37 | </code>
38 | </pre>
39 | </li>


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | <p align="center">
 2 |   <img title="portainer" src='img/logo.png' />
 3 | </p>
 4 | 
 5 | <p align="center">
 6 |   <img title="portainer" src='https://img.shields.io/badge/version-0.1-brightgreen.svg' />
 7 |   <img title="portainer" src='https://img.shields.io/badge/php-5.*-yellow.svg' />
 8 |   <img title="portainer" src='https://img.shields.io/badge/license-MIT-red.svg' />
 9 | </p>
10 | 
11 | ---
12 | 
13 | **upload-labs是一个使用php语言编写的，专门收集渗透测试和CTF中遇到的各种上传漏洞的靶场。旨在帮助大家对上传漏洞有一个全面的了解。目前一共20关，每一关都包含着不同上传方式。**
14 | 
15 | ## 0x01 Screenshot
16 | 
17 | #### 1.1 主界面
18 | 
19 | ![主界面](doc/index.jpg)
20 | 
21 | #### 1.2 每一关
22 | 
23 | ![每一关](doc/pass.jpg)
24 | 
25 | #### 1.3 查看代码
26 | 
27 | ![代码](doc/code.jpg)
28 | 
29 | ## 0x02 Install
30 | 
31 | #### 2.1 环境要求
32 | 
33 | 若要自己亲自搭建环境，请按照以下配置环境，方可正常运行每个Pass。
34 | 
35 | |配置项|配置|描述|
36 | |:---|:---|:---|
37 | |操作系统|Window or Linux|推荐使用Windows，除了Pass-19必须在linux下，其余Pass都可以在Windows上运行|
38 | |PHP版本|推荐5.2.17|其他版本可能会导致部分Pass无法突破|
39 | |PHP组件|php_gd2,php_exif|部分Pass依赖这两个组件|
40 | |中间件|设置Apache以moudel方式连接||
41 | 
42 | #### 2.2 Windows快速搭建
43 | 
44 | 项目提供了一个Windows下,按照以上配置要求配置好的集成环境
45 | 
46 | 下载地址：https://github.com/c0ny1/upload-labs/releases
47 | 
48 | 集成环境绿色免安装，解压即可使用。
49 | 
50 | #### 2.3 Linux快速搭建
51 | 
52 | 创建镜像
53 | 
54 | ```
55 | $ cd upload-labs/docker
56 | $ docker build -t upload-labs .
57 | ```
58 | 
59 | 或
60 | 
61 | ```
62 | $ docker pull c0ny1/upload-labs
63 | ```
64 | 
65 | 创建容器
66 | 
67 | ```
68 | $  docker run -d -p 80:80 upload-labs:latest
69 | ```
70 | 
71 | ## 0x03 Summary
72 | 
73 | #### 3.1 靶机包含漏洞类型分类
74 | 
75 | ![上传漏洞分类](doc/mind-map.png)
76 | 
77 | #### 3.2 如何判断上传漏洞类型?
78 | 
79 | ![判断上传漏洞类型](doc/sum_up.png)
80 | 
81 | ## 0x04 Thanks
82 | 
83 | * 感谢[小小黄](https://github.com/xiaoxiaoki)做的logo
84 | 


--------------------------------------------------------------------------------
/common.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | function deldot($s){
 3 | 	for($i = strlen($s)-1;$i>0;$i--){
 4 | 		$c = substr($s,$i,1);
 5 | 		if($i == strlen($s)-1 and $c != '.'){
 6 | 			return $s;
 7 | 		}
 8 | 
 9 | 		if($c != '.'){
10 | 			return substr($s,0,$i+1);
11 | 		}
12 | 	}
13 | }
14 | ?>


--------------------------------------------------------------------------------
/config.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | header("Content-type: text/html;charset=utf-8");
 3 | error_reporting(0);
 4 | 
 5 | define("WWW_ROOT",$_SERVER['DOCUMENT_ROOT']);
 6 | define("APP_ROOT",str_replace('\\','/',dirname(__FILE__)));
 7 | define("APP_URL_ROOT",str_replace(WWW_ROOT,"",APP_ROOT));
 8 | //文件包含漏洞页面
 9 | define("INC_VUL_PATH",APP_URL_ROOT . "/include.php");
10 | //设置上传目录
11 | define("UPLOAD_PATH", "../upload");
12 | ?>


--------------------------------------------------------------------------------
/css/index.css:
--------------------------------------------------------------------------------
  1 | /**
  2 | * author: c0ny1
  3 | * date: 2018-6-13
  4 | * project: https://github.com/c0ny1/upload-labs
  5 | */
  6 | 
  7 | body{
  8 | 	margin: 0 0 0 0;
  9 | 	min-width: 1340px;/*防止窗口变小导致页面变形*/
 10 | 	background: #333333;
 11 | 	font-family: Lato, "Helvetica Neue", Helvetica, Arial, "Microsoft Yahei", 微软雅黑, sans-serif;
 12 | }
 13 | 
 14 | #head{
 15 | 	width: 100%;
 16 | 	margin: 0px auto;
 17 | 	margin-bottom: 10px;
 18 | 	min-width: 1050px;
 19 | }
 20 | 
 21 | #head_menu a{
 22 | 	background: #FFCC00;
 23 | 	margin: 10px 10px 10px 10px;
 24 | 	padding: 8px;
 25 | 	-webkit-border-radius:5px;
 26 | 	font-family:  黑体;
 27 | 	color: #333333;
 28 | 	text-decoration: none;
 29 | 	font-size: 13px;
 30 | 	font-weight: bold;
 31 | }
 32 | 
 33 | #head img{
 34 | 	margin-top: 10px;
 35 | 	height: 45px;
 36 | }
 37 | 
 38 | #head_menu{
 39 | 	min-width: 250px;
 40 | 	margin: 20px 40px 10px 10px;
 41 | 	float: right;
 42 | }
 43 | 
 44 | ol{
 45 | 	list-style:none;
 46 | }
 47 | 
 48 | ol li h3{
 49 | 	font-family:"Arista2",helvetica,sans-serif;
 50 | 	color: #E05D04;
 51 | 	font-size: 18px;
 52 | }
 53 | 
 54 | p{
 55 | 	color:#fff;
 56 | 	margin: 15px 0px;
 57 | 	letter-spacing: 5px;
 58 | 	font-size: 14px;
 59 | }
 60 | 
 61 | p code {
 62 |     background: #323232;
 63 |     font-size: .8em;
 64 |     padding: 4px;
 65 |     margin-right: 5px;
 66 |     color: #fff55c;
 67 |     -webkit-border-radius:5px;
 68 |     letter-spacing: 0px;
 69 | }
 70 | 
 71 | #img{
 72 | 	margin-top:20px;
 73 | 	margin-left: 20px;
 74 | }
 75 | 
 76 | #main{
 77 | 	border: 1px #ddd;
 78 | 	width: 100%;
 79 | 	float: left;
 80 | 	border: 1px solid #000;
 81 | 	padding-top: 20px;
 82 | 	padding-bottom: 20px;	
 83 | }
 84 | 
 85 | #menu{
 86 | 	float: left;
 87 | 	width: 10%;
 88 | 	padding: 10 10 10 10;
 89 | 	min-width: 100px;
 90 | 	margin-left: 40px;
 91 | 	
 92 | }
 93 | 
 94 | #menu ul{
 95 | 	margin: 0 0 0 0;
 96 | 	padding:  0 0 0 0;
 97 | }
 98 | 
 99 | #menu ul li{
100 | 	list-style-type:none;
101 | 	text-align: center;
102 | 	margin-bottom: 5px;
103 | }
104 | 
105 | #menu ul li a{
106 | 	color: #FDA162;
107 | 	text-decoration: none;
108 | 	font-size: 16px;
109 | 	padding: 5 30 5 30;
110 | }
111 | 
112 | #menu ul li a:hover{
113 | 	color: #E05D04;
114 | 	background: #252525;
115 | 	-webkit-border-radius:5px;
116 | }
117 | 
118 | .a_is_selected{
119 | 	color: #E05D04;
120 | 	background: #252525;
121 | 	-webkit-border-radius:5px;
122 | 	padding: 5 30 5 30;
123 | }
124 | 
125 | #upload_panel{
126 | 	float: right;
127 | 	width: 78%;
128 | 	min-width: 500px;
129 | 	padding: 10 10 10 10;
130 | 	margin-right: 80px;
131 | 	background: #444444;
132 | 	-webkit-border-radius:5px;
133 | }
134 | 
135 | #upload_panel ol{
136 | 	padding-right: 40px;
137 | }
138 | 
139 | #upload_panel a{
140 | 	text-decoration: none;
141 | 	padding: 0px 0px 1px 0px;
142 | 	color: #fff55c;
143 | }
144 | 
145 | #upload_panel a:hover {
146 | 	border-bottom:2px solid #FDA162;
147 | }
148 | 
149 | .input_file{
150 | 	-webkit-border-radius: 5px;
151 | 	background: #323232;
152 | 	border: 0px;
153 | }
154 | 
155 | .input_text{
156 | 	padding: 5px;
157 | 	width: 240px;
158 | 	height: 22px;
159 | 	line-height: 22px;
160 | 	border: 0px;
161 | 	-webkit-border-radius: 5px;
162 | 	color: #888888;
163 | 	background: #323232;
164 | }
165 | 
166 | .button{
167 | 	background: #FFCC00;
168 | 	margin: 10px;
169 | 	padding: 4px;
170 | 	-webkit-border-radius:5px;
171 | 	font-family:黑体;
172 | 	border:0px;
173 | }
174 | #msg{
175 | 	color:red;
176 | }
177 | 
178 | #img img{
179 | 	border:1px solid #000;
180 | }
181 | #footer{
182 | 	color: #C1C1C1;
183 | 	float: left;
184 | 	background: #222222;
185 | 	width: 100%;
186 | 	line-height: 50px;
187 | }
188 | 
189 | #footer a{
190 | 	text-decoration: none;
191 | 	color: #A5041D;
192 | }
193 | 
194 | .mask {
195 | 	width:100%; 
196 | 	height:100%; 
197 | 	background:rgba(0,0,0,0.6); 
198 | 	display:none; 
199 | 	position:fixed; 
200 | 	_position:absolute; 
201 | 	top:0; left:0; 
202 | 	z-index:99;
203 | }
204 | 
205 | .dialog {
206 | 	min-height:120px;
207 | 	background:#393D48;
208 | 	color:#fff;display:none;
209 | 	position:fixed; top:20%;
210 | 	left:50%; 
211 | 	z-index:100; 
212 | 	box-shadow:3px 3px 5px #000;
213 | 	-webkit-border-radius: 5px;
214 | }
215 | 
216 | .dialog-title {
217 | 	background:#91440F;
218 | 	width:100%;
219 | 	height: 30px;
220 | 	line-height: 30px;
221 | 	text-align: center;
222 | 	-webkit-border-radius: 5px 5px 0px 0px;
223 | }
224 | 
225 | .dialog a.close { 
226 | 	display:block; 
227 | 	width:22px; 
228 | 	height:22px; 
229 | 	background:url(../img/close.png) center no-repeat #91440F; 
230 | 	text-indent:-9999em;
231 | 	margin-right: 10px;
232 | 	margin-top: 5px;
233 | }
234 | 
235 | .dialog a.close { 
236 | 	position:absolute; top:0; 
237 | 	right:0; 
238 | 	z-index:101;
239 | }
240 | 
241 | .dialog.loading { 
242 | 	background:url(../img/loading.gif) center no-repeat #393D48;
243 | }
244 | 
245 | .dialog-content {
246 | 	line-height: 20px;
247 | 	padding:22px 10px 10px 10px;
248 | 	border-top: 1px solid #000;
249 | 	-webkit-border-radius: 0px 0px 5px 5px;
250 | 	/*过长文本自动换行*/
251 | 	word-break: break-all;
252 | 	word-wrap: break-word;
253 | }


--------------------------------------------------------------------------------
/css/prism.css:
--------------------------------------------------------------------------------
  1 | /* PrismJS 1.14.0
  2 | http://prismjs.com/download.html#themes=prism-twilight&languages=markup+clike+javascript+markup-templating+php+php-extras&plugins=line-numbers */
  3 | /**
  4 |  * prism.js Twilight theme
  5 |  * Based (more or less) on the Twilight theme originally of Textmate fame.
  6 |  * @author Remy Bach
  7 |  */
  8 | code[class*="language-"],
  9 | pre[class*="language-"] {
 10 | 	color: white;
 11 | 	background: none;
 12 | 	font-family: Consolas, Monaco, 'Andale Mono', 'Ubuntu Mono', monospace;
 13 | 	text-align: left;
 14 | 	text-shadow: 0 -.1em .2em black;
 15 | 	white-space: pre;
 16 | 	word-spacing: normal;
 17 | 	word-break: normal;
 18 | 	word-wrap: normal;
 19 | 	line-height: 1.5;
 20 | 
 21 | 	-moz-tab-size: 4;
 22 | 	-o-tab-size: 4;
 23 | 	tab-size: 4;
 24 | 
 25 | 	-webkit-hyphens: none;
 26 | 	-moz-hyphens: none;
 27 | 	-ms-hyphens: none;
 28 | 	hyphens: none;
 29 | }
 30 | 
 31 | pre[class*="language-"],
 32 | :not(pre) > code[class*="language-"] {
 33 | 	background: hsl(0, 0%, 8%); /* #141414 */
 34 | }
 35 | 
 36 | /* Code blocks */
 37 | pre[class*="language-"] {
 38 | 	border-radius: .5em;
 39 | 	border: .3em solid hsl(0, 0%, 33%); /* #282A2B */
 40 | 	box-shadow: 1px 1px .5em black inset;
 41 | 	margin: .5em 0;
 42 | 	overflow: auto;
 43 | 	padding: 1em;
 44 | }
 45 | 
 46 | pre[class*="language-"]::-moz-selection {
 47 | 	/* Firefox */
 48 | 	background: hsl(200, 4%, 16%); /* #282A2B */
 49 | }
 50 | 
 51 | pre[class*="language-"]::selection {
 52 | 	/* Safari */
 53 | 	background: hsl(200, 4%, 16%); /* #282A2B */
 54 | }
 55 | 
 56 | /* Text Selection colour */
 57 | pre[class*="language-"]::-moz-selection, pre[class*="language-"] ::-moz-selection,
 58 | code[class*="language-"]::-moz-selection, code[class*="language-"] ::-moz-selection {
 59 | 	text-shadow: none;
 60 | 	background: hsla(0, 0%, 93%, 0.15); /* #EDEDED */
 61 | }
 62 | 
 63 | pre[class*="language-"]::selection, pre[class*="language-"] ::selection,
 64 | code[class*="language-"]::selection, code[class*="language-"] ::selection {
 65 | 	text-shadow: none;
 66 | 	background: hsla(0, 0%, 93%, 0.15); /* #EDEDED */
 67 | }
 68 | 
 69 | /* Inline code */
 70 | :not(pre) > code[class*="language-"] {
 71 | 	border-radius: .3em;
 72 | 	border: .13em solid hsl(0, 0%, 33%); /* #545454 */
 73 | 	box-shadow: 1px 1px .3em -.1em black inset;
 74 | 	padding: .15em .2em .05em;
 75 | 	white-space: normal;
 76 | }
 77 | 
 78 | .token.comment,
 79 | .token.prolog,
 80 | .token.doctype,
 81 | .token.cdata {
 82 | 	color: hsl(0, 0%, 47%); /* #777777 */
 83 | }
 84 | 
 85 | .token.punctuation {
 86 | 	opacity: .7;
 87 | }
 88 | 
 89 | .namespace {
 90 | 	opacity: .7;
 91 | }
 92 | 
 93 | .token.tag,
 94 | .token.boolean,
 95 | .token.number,
 96 | .token.deleted {
 97 | 	color: hsl(14, 58%, 55%); /* #CF6A4C */
 98 | }
 99 | 
100 | .token.keyword,
101 | .token.property,
102 | .token.selector,
103 | .token.constant,
104 | .token.symbol,
105 | .token.builtin {
106 | 	color: hsl(53, 89%, 79%); /* #F9EE98 */
107 | }
108 | 
109 | .token.attr-name,
110 | .token.attr-value,
111 | .token.string,
112 | .token.char,
113 | .token.operator,
114 | .token.entity,
115 | .token.url,
116 | .language-css .token.string,
117 | .style .token.string,
118 | .token.variable,
119 | .token.inserted {
120 | 	color: hsl(76, 21%, 52%); /* #8F9D6A */
121 | }
122 | 
123 | .token.atrule {
124 | 	color: hsl(218, 22%, 55%); /* #7587A6 */
125 | }
126 | 
127 | .token.regex,
128 | .token.important {
129 | 	color: hsl(42, 75%, 65%); /* #E9C062 */
130 | }
131 | 
132 | .token.important,
133 | .token.bold {
134 | 	font-weight: bold;
135 | }
136 | .token.italic {
137 | 	font-style: italic;
138 | }
139 | 
140 | .token.entity {
141 | 	cursor: help;
142 | }
143 | 
144 | pre[data-line] {
145 | 	padding: 1em 0 1em 3em;
146 | 	position: relative;
147 | }
148 | 
149 | /* Markup */
150 | .language-markup .token.tag,
151 | .language-markup .token.attr-name,
152 | .language-markup .token.punctuation {
153 | 	color: hsl(33, 33%, 52%); /* #AC885B */
154 | }
155 | 
156 | /* Make the tokens sit above the line highlight so the colours don't look faded. */
157 | .token {
158 | 	position: relative;
159 | 	z-index: 1;
160 | }
161 | 
162 | .line-highlight {
163 | 	background: hsla(0, 0%, 33%, 0.25); /* #545454 */
164 | 	background: linear-gradient(to right, hsla(0, 0%, 33%, .1) 70%, hsla(0, 0%, 33%, 0)); /* #545454 */
165 | 	border-bottom: 1px dashed hsl(0, 0%, 33%); /* #545454 */
166 | 	border-top: 1px dashed hsl(0, 0%, 33%); /* #545454 */
167 | 	left: 0;
168 | 	line-height: inherit;
169 | 	margin-top: 0.75em; /* Same as .prism’s padding-top */
170 | 	padding: inherit 0;
171 | 	pointer-events: none;
172 | 	position: absolute;
173 | 	right: 0;
174 | 	white-space: pre;
175 | 	z-index: 0;
176 | }
177 | 
178 | .line-highlight:before,
179 | .line-highlight[data-end]:after {
180 | 	background-color: hsl(215, 15%, 59%); /* #8794A6 */
181 | 	border-radius: 999px;
182 | 	box-shadow: 0 1px white;
183 | 	color: hsl(24, 20%, 95%); /* #F5F2F0 */
184 | 	content: attr(data-start);
185 | 	font: bold 65%/1.5 sans-serif;
186 | 	left: .6em;
187 | 	min-width: 1em;
188 | 	padding: 0 .5em;
189 | 	position: absolute;
190 | 	text-align: center;
191 | 	text-shadow: none;
192 | 	top: .4em;
193 | 	vertical-align: .3em;
194 | }
195 | 
196 | .line-highlight[data-end]:after {
197 | 	bottom: .4em;
198 | 	content: attr(data-end);
199 | 	top: auto;
200 | }
201 | 
202 | pre.line-numbers {
203 | 	position: relative;
204 | 	padding-left: 3.8em;
205 | 	counter-reset: linenumber;
206 | }
207 | 
208 | pre.line-numbers > code {
209 | 	position: relative;
210 |     white-space: inherit;
211 | }
212 | 
213 | .line-numbers .line-numbers-rows {
214 | 	position: absolute;
215 | 	pointer-events: none;
216 | 	top: 0;
217 | 	font-size: 100%;
218 | 	left: -3.8em;
219 | 	width: 3em; /* works for line-numbers below 1000 lines */
220 | 	letter-spacing: -1px;
221 | 	border-right: 1px solid #999;
222 | 
223 | 	-webkit-user-select: none;
224 | 	-moz-user-select: none;
225 | 	-ms-user-select: none;
226 | 	user-select: none;
227 | 
228 | }
229 | 
230 | 	.line-numbers-rows > span {
231 | 		pointer-events: none;
232 | 		display: block;
233 | 		counter-increment: linenumber;
234 | 	}
235 | 
236 | 		.line-numbers-rows > span:before {
237 | 			content: counter(linenumber);
238 | 			color: #999;
239 | 			display: block;
240 | 			padding-right: 0.8em;
241 | 			text-align: right;
242 | 		}
243 | 


--------------------------------------------------------------------------------
/doc/code.jpg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/c0ny1/upload-labs/3a0ff865d41d93ea7d57a91e837f084d9d2318e5/doc/code.jpg


--------------------------------------------------------------------------------
/doc/index.jpg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/c0ny1/upload-labs/3a0ff865d41d93ea7d57a91e837f084d9d2318e5/doc/index.jpg


--------------------------------------------------------------------------------
/doc/mind-map.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/c0ny1/upload-labs/3a0ff865d41d93ea7d57a91e837f084d9d2318e5/doc/mind-map.png


--------------------------------------------------------------------------------
/doc/pass.jpg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/c0ny1/upload-labs/3a0ff865d41d93ea7d57a91e837f084d9d2318e5/doc/pass.jpg


--------------------------------------------------------------------------------
/doc/sum_up.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/c0ny1/upload-labs/3a0ff865d41d93ea7d57a91e837f084d9d2318e5/doc/sum_up.png


--------------------------------------------------------------------------------
/docker/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM php:5.5-apache
 2 | 
 3 | MAINTAINER c0ny1 <root@gv7.me>
 4 | ENV LC_ALL C.UTF-8
 5 | ENV TZ=Asia/Shanghai
 6 | 
 7 | COPY . /tmp/
 8 | 
 9 | # config apache && php
10 | RUN cp /tmp/docker-php.conf /etc/apache2/conf-available/docker-php.conf &&\
11 |     cp /tmp/php.ini /usr/local/etc/php/ &&\
12 |     cp /tmp/php.ini /usr/local/etc/php/conf.d/
13 | 
14 | # install git && php ext
15 | RUN apt-get update && \
16 |     apt-get install -y libgd-dev &&\
17 |     apt-get install -y git &&\
18 |     docker-php-ext-install gd &&\
19 |     docker-php-ext-enable gd &&\
20 |     docker-php-ext-install exif &&\
21 |     docker-php-ext-enable exif &&\
22 |     rm -rf /var/lib/apt/lists/*
23 | 
24 | # install upload-labs
25 | RUN cd /tmp/ &&\
26 |     git clone https://github.com/c0ny1/upload-labs.git &&\
27 |     rm -rf /var/wwww/html/* &&\
28 |     mv /tmp/upload-labs/* /var/www/html/ &&\
29 |     chown www-data:www-data -R /var/www/html/ && \
30 |     rm -rf /tmp/*
31 | 
32 | EXPOSE 80
33 | 


--------------------------------------------------------------------------------
/docker/docker-php.conf:
--------------------------------------------------------------------------------
 1 | # <FilesMatch \.php$>
 2 | # 	SetHandler application/x-httpd-php
 3 | # </FilesMatch>
 4 | 
 5 | AddHandler application/x-httpd-php .php .php3 .phtml
 6 | 
 7 | DirectoryIndex disabled
 8 | DirectoryIndex index.php index.html
 9 | 
10 | <Directory /var/www/>
11 | 	Options -Indexes
12 | 	AllowOverride All
13 | </Directory>
14 | 


--------------------------------------------------------------------------------
/docker/php.ini:
--------------------------------------------------------------------------------
  1 | [PHP]
  2 | engine = On
  3 | short_open_tag = Off
  4 | asp_tags = Off
  5 | precision = 14
  6 | output_buffering = 4096
  7 | zlib.output_compression = Off
  8 | implicit_flush = Off
  9 | unserialize_callback_func =
 10 | serialize_precision = 17
 11 | disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,
 12 | disable_classes =
 13 | zend.enable_gc = On
 14 | magic_quotes_gpc = Off
 15 | expose_php = Off
 16 | max_execution_time = 30
 17 | max_input_time = 60
 18 | memory_limit = 128M
 19 | error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
 20 | display_errors = Off
 21 | display_startup_errors = Off
 22 | log_errors = On
 23 | log_errors_max_len = 1024
 24 | ignore_repeated_errors = Off
 25 | ignore_repeated_source = Off
 26 | report_memleaks = On
 27 | track_errors = Off
 28 | html_errors = On
 29 | variables_order = "GPCS"
 30 | request_order = "GP"
 31 | register_argc_argv = Off
 32 | auto_globals_jit = On
 33 | post_max_size = 8M
 34 | auto_prepend_file =
 35 | auto_append_file =
 36 | default_mimetype = "text/html"
 37 | default_charset = "UTF-8"
 38 | doc_root =
 39 | user_dir =
 40 | enable_dl = Off
 41 | file_uploads = On
 42 | upload_max_filesize = 8M
 43 | max_file_uploads = 20
 44 | allow_url_fopen = On
 45 | allow_url_include = On
 46 | default_socket_timeout = 60
 47 | [CLI Server]
 48 | cli_server.color = On
 49 | [Date]
 50 | [filter]
 51 | [iconv]
 52 | [intl]
 53 | [sqlite3]
 54 | [Pcre]
 55 | [Pdo]
 56 | [Pdo_mysql]
 57 | pdo_mysql.cache_size = 2000
 58 | pdo_mysql.default_socket=
 59 | [Phar]
 60 | [mail function]
 61 | SMTP = localhost
 62 | smtp_port = 25
 63 | mail.add_x_header = On
 64 | [SQL]
 65 | sql.safe_mode = Off
 66 | [ODBC]
 67 | odbc.allow_persistent = On
 68 | odbc.check_persistent = On
 69 | odbc.max_persistent = -1
 70 | odbc.max_links = -1
 71 | odbc.defaultlrl = 4096
 72 | odbc.defaultbinmode = 1
 73 | [Interbase]
 74 | ibase.allow_persistent = 1
 75 | ibase.max_persistent = -1
 76 | ibase.max_links = -1
 77 | ibase.timestampformat = "%Y-%m-%d %H:%M:%S"
 78 | ibase.dateformat = "%Y-%m-%d"
 79 | ibase.timeformat = "%H:%M:%S"
 80 | [MySQL]
 81 | mysql.allow_local_infile = On
 82 | mysql.allow_persistent = On
 83 | mysql.cache_size = 2000
 84 | mysql.max_persistent = -1
 85 | mysql.max_links = -1
 86 | mysql.default_port =
 87 | mysql.default_socket =
 88 | mysql.default_host =
 89 | mysql.default_user =
 90 | mysql.default_password =
 91 | mysql.connect_timeout = 60
 92 | mysql.trace_mode = Off
 93 | [MySQLi]
 94 | mysqli.max_persistent = -1
 95 | mysqli.allow_persistent = On
 96 | mysqli.max_links = -1
 97 | mysqli.cache_size = 2000
 98 | mysqli.default_port = 3306
 99 | mysqli.default_socket =
100 | mysqli.default_host =
101 | mysqli.default_user =
102 | mysqli.default_pw =
103 | mysqli.reconnect = Off
104 | [mysqlnd]
105 | mysqlnd.collect_statistics = On
106 | mysqlnd.collect_memory_statistics = Off
107 | [OCI8]
108 | [PostgreSQL]
109 | pgsql.allow_persistent = On
110 | pgsql.auto_reset_persistent = Off
111 | pgsql.max_persistent = -1
112 | pgsql.max_links = -1
113 | pgsql.ignore_notice = 0
114 | pgsql.log_notice = 0
115 | [Sybase-CT]
116 | sybct.allow_persistent = On
117 | sybct.max_persistent = -1
118 | sybct.max_links = -1
119 | sybct.min_server_severity = 10
120 | sybct.min_client_severity = 10
121 | [bcmath]
122 | bcmath.scale = 0
123 | [browscap]
124 | [Session]
125 | session.save_handler = files
126 | session.use_strict_mode = 0
127 | session.use_cookies = 1
128 | session.use_only_cookies = 1
129 | session.name = PHPSESSID
130 | session.auto_start = 0
131 | session.cookie_lifetime = 0
132 | session.cookie_path = /
133 | session.cookie_domain =
134 | session.cookie_httponly =
135 | session.serialize_handler = php
136 | session.gc_probability = 0
137 | session.gc_divisor = 1000
138 | session.gc_maxlifetime = 1440
139 | session.referer_check =
140 | session.cache_limiter = nocache
141 | session.cache_expire = 180
142 | session.use_trans_sid = 0
143 | session.hash_function = 0
144 | session.hash_bits_per_character = 5
145 | url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry"
146 | [MSSQL]
147 | mssql.allow_persistent = On
148 | mssql.max_persistent = -1
149 | mssql.max_links = -1
150 | mssql.min_error_severity = 10
151 | mssql.min_message_severity = 10
152 | mssql.compatibility_mode = Off
153 | mssql.secure_connection = Off
154 | [Assertion]
155 | [COM]
156 | [mbstring]
157 | [gd]
158 | [exif]
159 | 
160 | [Tidy]
161 | tidy.clean_output = Off
162 | [soap]
163 | soap.wsdl_cache_enabled=1
164 | soap.wsdl_cache_dir="/tmp"
165 | soap.wsdl_cache_ttl=86400
166 | soap.wsdl_cache_limit = 5
167 | [sysvshm]
168 | [ldap]
169 | ldap.max_links = -1
170 | [mcrypt]
171 | [dba]
172 | [opcache]
173 | [curl]
174 | [openssl]
175 | 


--------------------------------------------------------------------------------
/footer.php:
--------------------------------------------------------------------------------
 1 | </div>
 2 | 		<div id="footer">
 3 | 			<center>Copyright&nbsp;@&nbsp;<span id="copyright_time"></span>&nbsp;by&nbsp;<a href="http://gv7.me" target="_bank">c0ny1</a></center>
 4 | 		</div>
 5 | 		<div class="mask"></div>
 6 | 		<div class="dialog">
 7 | 		    <div class="dialog-title">提&nbsp;示<a href="javascript:void(0)" class="close" title="关闭">关闭</a></div>
 8 | 		    <div class="dialog-content"></div>
 9 | 		</div>		
10 | </body>
11 | <script type="text/javascript" src="<?php echo APP_URL_ROOT;?>/js/jquery.min.js"></script>
12 | <script type="text/javascript" src="<?php echo APP_URL_ROOT;?>/js/prism.js"></script>
13 | <script type="text/javascript" src="<?php echo APP_URL_ROOT;?>/js/prism-line-numbers.min.js"></script>
14 | <script type="text/javascript" src="<?php echo APP_URL_ROOT;?>/js/prism-php.min.js"></script>
15 | <script type="text/javascript" src="<?php echo APP_URL_ROOT;?>/js/index.js"></script>
16 | </html>
17 | 


--------------------------------------------------------------------------------
/head.php:
--------------------------------------------------------------------------------
 1 | <html>
 2 | <head>
 3 | 	<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
 4 | 	<link rel="icon" type="image/x-icon" href="<?php echo APP_URL_ROOT;?>/img/favicon.png" />  
 5 | 	<title>upload-labs</title>
 6 | </head>
 7 | <link rel="stylesheet" type="text/css" href="<?php echo APP_URL_ROOT;?>/css/index.css">
 8 | <link rel="stylesheet" type="text/css" href="<?php echo APP_URL_ROOT;?>/css/prism.css">
 9 | <body>
10 | 	<div id="head">
11 | 		<a href="<?php echo APP_URL_ROOT;?>/"><img src="<?php echo APP_URL_ROOT;?>/img/logo.png"/></a>
12 | 		<div id="head_menu">
13 | 			<a id="handle_code" href="javascript:show_code()">显示源码</a>
14 | 			<a href="javascript:get_prompt()">查看提示</a>
15 | 			<a href="javascript:clean_upload_file()">清空上传文件</a>
16 | 		</div>
17 | 	</div>
18 | 	<div id="main">


--------------------------------------------------------------------------------
/img/close.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/c0ny1/upload-labs/3a0ff865d41d93ea7d57a91e837f084d9d2318e5/img/close.png


--------------------------------------------------------------------------------
/img/favicon.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/c0ny1/upload-labs/3a0ff865d41d93ea7d57a91e837f084d9d2318e5/img/favicon.png


--------------------------------------------------------------------------------
/img/loading.gif:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/c0ny1/upload-labs/3a0ff865d41d93ea7d57a91e837f084d9d2318e5/img/loading.gif


--------------------------------------------------------------------------------
/img/logo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/c0ny1/upload-labs/3a0ff865d41d93ea7d57a91e837f084d9d2318e5/img/logo.png


--------------------------------------------------------------------------------
/include.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /*
 3 | 本页面存在文件包含漏洞，用于测试图片马是否能正常运行！
 4 | */
 5 | header("Content-Type:text/html;charset=utf-8");
 6 | $file = $_GET['file'];
 7 | if(isset($file)){
 8 |     include $file;
 9 | }else{
10 |     show_source(__file__);
11 | }
12 | ?>


--------------------------------------------------------------------------------
/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | include 'config.php';
 3 | include 'head.php';
 4 | include 'menu.php';
 5 | ?>
 6 | <style type="text/css">
 7 | #head_menu a{
 8 | 	display: none;
 9 | }
10 | </style>
11 | 
12 | <div id="upload_panel">
13 |     <ol>
14 |         <li>
15 |             <h3>简介</h3>
16 |             <p><code>upload-labs</code>是一个使用<code>php</code>语言编写的，专门收集渗透测试和CTF中遇到的各种上传漏洞的靶场。旨在帮助大家对上传漏洞有一个全面的了解。目前一共21关，每一关都包含着不同上传方式。</p>
17 |         </li>
18 |         <li>
19 |             <h3>注意</h3>
20 |             <p>1.每一关没有固定的通关方法，大家不要自限思维！</p>
21 |             <p>2.本项目提供的<code>writeup</code>只是起一个参考作用，希望大家可以分享出自己的通关思路。</p>
22 |             <p>3.实在没有思路时，可以点击<code>查看提示</code>。</p>
23 |             <p>4.如果黑盒情况下，实在做不出，可以点击<code>查看源码</code>。</p>
24 |         </li>
25 |         <li>
26 |             <h3>后续</h3>
27 |             <p>如在渗透测试实战中遇到新的上传漏洞类型，会更新到<code>upload-labs</code>中。当然如果你也希望参加到这个工作当中，欢迎<code>pull requests</code>给我!</p>
28 |             <p>项目地址：<code>https://github.com/c0ny1/upload-labs</code></p>
29 |         </li>
30 | 	</ol>
31 | </div>
32 | 
33 | 
34 | <?php
35 | include 'footer.php'
36 | ?>
37 | 


--------------------------------------------------------------------------------
/js/index.js:
--------------------------------------------------------------------------------
  1 | /**
  2 | * author: c0ny1
  3 | * date: 2018-6-13
  4 | * project: https://github.com/c0ny1/upload-labs
  5 | */
  6 | 
  7 | function show_code(){
  8 | 	var url = window.location.href;
  9 | 	if(url.indexOf("?") != -1){
 10 | 		url = url.split("?")[0];
 11 | 	}	
 12 | 	
 13 | 	var e = document.getElementById("show_code");
 14 | 	if(e == null){
 15 | 		window.location.href=url+"?action=show_code";
 16 | 	}else{
 17 | 		window.location.href=url;
 18 | 	}
 19 | }
 20 | 
 21 | function modify_showcode_name(){
 22 | 	var url = window.location.href;
 23 | 	var btn_showcode = document.getElementById("handle_code");
 24 | 	if(url.indexOf('show_code') >= 0){
 25 | 		btn_showcode.innerHTML = "隐藏源码";
 26 | 	}else{
 27 | 		btn_showcode.innerHTML = "显示源码";
 28 | 	}
 29 | }
 30 | 
 31 | function get_prompt(){
 32 | 	$.ajax({  
 33 | 		type: 'get',  
 34 | 		url: "helper.php?action=get_prompt", 
 35 | 	}).success(function(data) {
 36 | 		Dialog.open(400,200,data);
 37 | 	}).error(function() {  
 38 | 		Dialog.open(400,150,"获取提示失败！");
 39 | 	});
 40 | }
 41 | 
 42 | function clean_upload_file(){
 43 | 	$.ajax({  
 44 | 		type: 'get',  
 45 | 		url: "../rmdir.php?action=clean_upload_file",	
 46 | 	}).success(function(data) {
 47 | 		Dialog.open(400,200,data);
 48 | 	}).error(function() {
 49 | 		Dialog.open(400,150,"删除失败！");
 50 | 	}); 
 51 | }
 52 | 
 53 | function update_copyright_time(){
 54 | 	var mydate = new Date();
 55 | 	var now_time = '2018 ~ ' + mydate.getFullYear();
 56 | 	var copyright_time = document.getElementById("copyright_time");
 57 | 	copyright_time.innerHTML = now_time;
 58 | }
 59 | 
 60 | function setFooter(){
 61 | 	var min_height = window.innerHeight - 175;
 62 | 	var obj = document.getElementById("main");
 63 | 	obj.style.minHeight= min_height;
 64 | }
 65 | 
 66 | var Dialog = {
 67 |     mask: $('.mask'),
 68 |     dialog: $('.dialog'),
 69 |     content: $('.dialog-content'),
 70 |     open: function (width, height, appendHtml) {
 71 |         Dialog.mask.fadeIn(500);
 72 |         Dialog.dialog.css({ width: width, height: (height + 22), marginLeft: -(parseInt(width) / 2) }).addClass('loading').fadeIn(500, function () {
 73 |             Dialog.dialog.removeClass('loading');
 74 |             Dialog.content.append(appendHtml);
 75 |         });
 76 |     },
 77 |     close: function () {
 78 |         Dialog.mask.fadeOut(500);
 79 |         Dialog.dialog.fadeOut(500, function () {
 80 |             Dialog.content.empty();
 81 |         });
 82 |     }
 83 | }
 84 | 
 85 | $(function(){
 86 | 	//修改显示源码按钮名称
 87 | 	modify_showcode_name();
 88 | 	//更新版权时间
 89 | 	update_copyright_time();
 90 | 	//设置footer用于在底部
 91 | 	setFooter();
 92 | 	window.onresize = function(){
 93 | 		setFooter();
 94 | 	}
 95 | 
 96 | 	//设置当前所在栏目的菜单按钮按下效果
 97 | 	var path = window.location.pathname;
 98 | 	var pass_id = path.match(/Pass-\d{2}/i);
 99 | 	$("#"+pass_id).addClass('a_is_selected');
100 | 
101 | 	//给弹出框绑定关闭事件
102 | 	$('.dialog').find('a.close').bind("click", function () {
103 |         Dialog.close();
104 |     });
105 | });
106 | 


--------------------------------------------------------------------------------
/js/prism-line-numbers.min.js:
--------------------------------------------------------------------------------
1 | !function(){if("undefined"!=typeof self&&self.Prism&&self.document){var e="line-numbers",t=/\n(?!$)/g,n=function(e){var n=r(e),s=n["white-space"];if("pre-wrap"===s||"pre-line"===s){var l=e.querySelector("code"),i=e.querySelector(".line-numbers-rows"),a=e.querySelector(".line-numbers-sizer"),o=l.textContent.split(t);a||(a=document.createElement("span"),a.className="line-numbers-sizer",l.appendChild(a)),a.style.display="block",o.forEach(function(e,t){a.textContent=e||"\n";var n=a.getBoundingClientRect().height;i.children[t].style.height=n+"px"}),a.textContent="",a.style.display="none"}},r=function(e){return e?window.getComputedStyle?getComputedStyle(e):e.currentStyle||null:null};window.addEventListener("resize",function(){Array.prototype.forEach.call(document.querySelectorAll("pre."+e),n)}),Prism.hooks.add("complete",function(e){if(e.code){var r=e.element.parentNode,s=/\s*\bline-numbers\b\s*/;if(r&&/pre/i.test(r.nodeName)&&(s.test(r.className)||s.test(e.element.className))&&!e.element.querySelector(".line-numbers-rows")){s.test(e.element.className)&&(e.element.className=e.element.className.replace(s," ")),s.test(r.className)||(r.className+=" line-numbers");var l,i=e.code.match(t),a=i?i.length+1:1,o=new Array(a+1);o=o.join("<span></span>"),l=document.createElement("span"),l.setAttribute("aria-hidden","true"),l.className="line-numbers-rows",l.innerHTML=o,r.hasAttribute("data-start")&&(r.style.counterReset="linenumber "+(parseInt(r.getAttribute("data-start"),10)-1)),e.element.appendChild(l),n(r),Prism.hooks.run("line-numbers",e)}}}),Prism.hooks.add("line-numbers",function(e){e.plugins=e.plugins||{},e.plugins.lineNumbers=!0}),Prism.plugins.lineNumbers={getLine:function(t,n){if("PRE"===t.tagName&&t.classList.contains(e)){var r=t.querySelector(".line-numbers-rows"),s=parseInt(t.getAttribute("data-start"),10)||1,l=s+(r.children.length-1);s>n&&(n=s),n>l&&(n=l);var i=n-s;return r.children[i]}}}}}();


--------------------------------------------------------------------------------
/js/prism-php.min.js:
--------------------------------------------------------------------------------
1 | !function(e){e.languages.php=e.languages.extend("clike",{keyword:/\b(?:and|or|xor|array|as|break|case|cfunction|class|const|continue|declare|default|die|do|else|elseif|enddeclare|endfor|endforeach|endif|endswitch|endwhile|extends|for|foreach|function|include|include_once|global|if|new|return|static|switch|use|require|require_once|var|while|abstract|interface|public|implements|private|protected|parent|throw|null|echo|print|trait|namespace|final|yield|goto|instanceof|finally|try|catch)\b/i,constant:/\b[A-Z0-9_]{2,}\b/,comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|\/\/.*)/,lookbehind:!0}}),e.languages.insertBefore("php","string",{"shell-comment":{pattern:/(^|[^\\])#.*/,lookbehind:!0,alias:"comment"}}),e.languages.insertBefore("php","keyword",{delimiter:{pattern:/\?>|<\?(?:php|=)?/i,alias:"important"},variable:/\$+(?:\w+\b|(?={))/i,"package":{pattern:/(\\|namespace\s+|use\s+)[\w\\]+/,lookbehind:!0,inside:{punctuation:/\\/}}}),e.languages.insertBefore("php","operator",{property:{pattern:/(->)[\w]+/,lookbehind:!0}}),e.languages.insertBefore("php","string",{"nowdoc-string":{pattern:/<<<'([^']+)'(?:\r\n?|\n)(?:.*(?:\r\n?|\n))*?\1;/,greedy:!0,alias:"string",inside:{delimiter:{pattern:/^<<<'[^']+'|[a-z_]\w*;$/i,alias:"symbol",inside:{punctuation:/^<<<'?|[';]$/}}}},"heredoc-string":{pattern:/<<<(?:"([^"]+)"(?:\r\n?|\n)(?:.*(?:\r\n?|\n))*?\1;|([a-z_]\w*)(?:\r\n?|\n)(?:.*(?:\r\n?|\n))*?\2;)/i,greedy:!0,alias:"string",inside:{delimiter:{pattern:/^<<<(?:"[^"]+"|[a-z_]\w*)|[a-z_]\w*;$/i,alias:"symbol",inside:{punctuation:/^<<<"?|[";]$/}},interpolation:null}},"single-quoted-string":{pattern:/'(?:\\[\s\S]|[^\\'])*'/,greedy:!0,alias:"string"},"double-quoted-string":{pattern:/"(?:\\[\s\S]|[^\\"])*"/,greedy:!0,alias:"string",inside:{interpolation:null}}}),delete e.languages.php.string;var n={pattern:/{\$(?:{(?:{[^{}]+}|[^{}]+)}|[^{}])+}|(^|[^\\{])\$+(?:\w+(?:\[.+?]|->\w+)*)/,lookbehind:!0,inside:{rest:e.languages.php}};e.languages.php["heredoc-string"].inside.interpolation=n,e.languages.php["double-quoted-string"].inside.interpolation=n,e.hooks.add("before-tokenize",function(n){if(/(?:<\?php|<\?)/gi.test(n.code)){var i=/(?:<\?php|<\?)[\s\S]*?(?:\?>|$)/gi;e.languages["markup-templating"].buildPlaceholders(n,"php",i)}}),e.hooks.add("after-tokenize",function(n){e.languages["markup-templating"].tokenizePlaceholders(n,"php")})}(Prism);


--------------------------------------------------------------------------------
/js/prism.js:
--------------------------------------------------------------------------------
1 | /* PrismJS 1.15.0
2 | https://prismjs.com/download.html#themes=prism&languages=markup+clike+javascript+markup-templating+php */
3 | var _self="undefined"!=typeof window?window:"undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?self:{},Prism=function(){var e=/\blang(?:uage)?-([\w-]+)\b/i,t=0,n=_self.Prism={manual:_self.Prism&&_self.Prism.manual,disableWorkerMessageHandler:_self.Prism&&_self.Prism.disableWorkerMessageHandler,util:{encode:function(e){return e instanceof r?new r(e.type,n.util.encode(e.content),e.alias):"Array"===n.util.type(e)?e.map(n.util.encode):e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/\u00a0/g," ")},type:function(e){return Object.prototype.toString.call(e).match(/\[object (\w+)\]/)[1]},objId:function(e){return e.__id||Object.defineProperty(e,"__id",{value:++t}),e.__id},clone:function(e,t){var r=n.util.type(e);switch(t=t||{},r){case"Object":if(t[n.util.objId(e)])return t[n.util.objId(e)];var a={};t[n.util.objId(e)]=a;for(var l in e)e.hasOwnProperty(l)&&(a[l]=n.util.clone(e[l],t));return a;case"Array":if(t[n.util.objId(e)])return t[n.util.objId(e)];var a=[];return t[n.util.objId(e)]=a,e.forEach(function(e,r){a[r]=n.util.clone(e,t)}),a}return e}},languages:{extend:function(e,t){var r=n.util.clone(n.languages[e]);for(var a in t)r[a]=t[a];return r},insertBefore:function(e,t,r,a){a=a||n.languages;var l=a[e];if(2==arguments.length){r=arguments[1];for(var i in r)r.hasOwnProperty(i)&&(l[i]=r[i]);return l}var o={};for(var s in l)if(l.hasOwnProperty(s)){if(s==t)for(var i in r)r.hasOwnProperty(i)&&(o[i]=r[i]);o[s]=l[s]}return n.languages.DFS(n.languages,function(t,n){n===a[e]&&t!=e&&(this[t]=o)}),a[e]=o},DFS:function(e,t,r,a){a=a||{};for(var l in e)e.hasOwnProperty(l)&&(t.call(e,l,e[l],r||l),"Object"!==n.util.type(e[l])||a[n.util.objId(e[l])]?"Array"!==n.util.type(e[l])||a[n.util.objId(e[l])]||(a[n.util.objId(e[l])]=!0,n.languages.DFS(e[l],t,l,a)):(a[n.util.objId(e[l])]=!0,n.languages.DFS(e[l],t,null,a)))}},plugins:{},highlightAll:function(e,t){n.highlightAllUnder(document,e,t)},highlightAllUnder:function(e,t,r){var a={callback:r,selector:'code[class*="language-"], [class*="language-"] code, code[class*="lang-"], [class*="lang-"] code'};n.hooks.run("before-highlightall",a);for(var l,i=a.elements||e.querySelectorAll(a.selector),o=0;l=i[o++];)n.highlightElement(l,t===!0,a.callback)},highlightElement:function(t,r,a){for(var l,i,o=t;o&&!e.test(o.className);)o=o.parentNode;o&&(l=(o.className.match(e)||[,""])[1].toLowerCase(),i=n.languages[l]),t.className=t.className.replace(e,"").replace(/\s+/g," ")+" language-"+l,t.parentNode&&(o=t.parentNode,/pre/i.test(o.nodeName)&&(o.className=o.className.replace(e,"").replace(/\s+/g," ")+" language-"+l));var s=t.textContent,u={element:t,language:l,grammar:i,code:s};if(n.hooks.run("before-sanity-check",u),!u.code||!u.grammar)return u.code&&(n.hooks.run("before-highlight",u),u.element.textContent=u.code,n.hooks.run("after-highlight",u)),n.hooks.run("complete",u),void 0;if(n.hooks.run("before-highlight",u),r&&_self.Worker){var g=new Worker(n.filename);g.onmessage=function(e){u.highlightedCode=e.data,n.hooks.run("before-insert",u),u.element.innerHTML=u.highlightedCode,a&&a.call(u.element),n.hooks.run("after-highlight",u),n.hooks.run("complete",u)},g.postMessage(JSON.stringify({language:u.language,code:u.code,immediateClose:!0}))}else u.highlightedCode=n.highlight(u.code,u.grammar,u.language),n.hooks.run("before-insert",u),u.element.innerHTML=u.highlightedCode,a&&a.call(t),n.hooks.run("after-highlight",u),n.hooks.run("complete",u)},highlight:function(e,t,a){var l={code:e,grammar:t,language:a};return n.hooks.run("before-tokenize",l),l.tokens=n.tokenize(l.code,l.grammar),n.hooks.run("after-tokenize",l),r.stringify(n.util.encode(l.tokens),l.language)},matchGrammar:function(e,t,r,a,l,i,o){var s=n.Token;for(var u in r)if(r.hasOwnProperty(u)&&r[u]){if(u==o)return;var g=r[u];g="Array"===n.util.type(g)?g:[g];for(var c=0;c<g.length;++c){var h=g[c],f=h.inside,d=!!h.lookbehind,m=!!h.greedy,p=0,y=h.alias;if(m&&!h.pattern.global){var v=h.pattern.toString().match(/[imuy]*$/)[0];h.pattern=RegExp(h.pattern.source,v+"g")}h=h.pattern||h;for(var b=a,k=l;b<t.length;k+=t[b].length,++b){var w=t[b];if(t.length>e.length)return;if(!(w instanceof s)){if(m&&b!=t.length-1){h.lastIndex=k;var _=h.exec(e);if(!_)break;for(var j=_.index+(d?_[1].length:0),P=_.index+_[0].length,A=b,x=k,O=t.length;O>A&&(P>x||!t[A].type&&!t[A-1].greedy);++A)x+=t[A].length,j>=x&&(++b,k=x);if(t[b]instanceof s)continue;I=A-b,w=e.slice(k,x),_.index-=k}else{h.lastIndex=0;var _=h.exec(w),I=1}if(_){d&&(p=_[1]?_[1].length:0);var j=_.index+p,_=_[0].slice(p),P=j+_.length,N=w.slice(0,j),S=w.slice(P),C=[b,I];N&&(++b,k+=N.length,C.push(N));var E=new s(u,f?n.tokenize(_,f):_,y,_,m);if(C.push(E),S&&C.push(S),Array.prototype.splice.apply(t,C),1!=I&&n.matchGrammar(e,t,r,b,k,!0,u),i)break}else if(i)break}}}}},tokenize:function(e,t){var r=[e],a=t.rest;if(a){for(var l in a)t[l]=a[l];delete t.rest}return n.matchGrammar(e,r,t,0,0,!1),r},hooks:{all:{},add:function(e,t){var r=n.hooks.all;r[e]=r[e]||[],r[e].push(t)},run:function(e,t){var r=n.hooks.all[e];if(r&&r.length)for(var a,l=0;a=r[l++];)a(t)}}},r=n.Token=function(e,t,n,r,a){this.type=e,this.content=t,this.alias=n,this.length=0|(r||"").length,this.greedy=!!a};if(r.stringify=function(e,t,a){if("string"==typeof e)return e;if("Array"===n.util.type(e))return e.map(function(n){return r.stringify(n,t,e)}).join("");var l={type:e.type,content:r.stringify(e.content,t,a),tag:"span",classes:["token",e.type],attributes:{},language:t,parent:a};if(e.alias){var i="Array"===n.util.type(e.alias)?e.alias:[e.alias];Array.prototype.push.apply(l.classes,i)}n.hooks.run("wrap",l);var o=Object.keys(l.attributes).map(function(e){return e+'="'+(l.attributes[e]||"").replace(/"/g,"&quot;")+'"'}).join(" ");return"<"+l.tag+' class="'+l.classes.join(" ")+'"'+(o?" "+o:"")+">"+l.content+"</"+l.tag+">"},!_self.document)return _self.addEventListener?(n.disableWorkerMessageHandler||_self.addEventListener("message",function(e){var t=JSON.parse(e.data),r=t.language,a=t.code,l=t.immediateClose;_self.postMessage(n.highlight(a,n.languages[r],r)),l&&_self.close()},!1),_self.Prism):_self.Prism;var a=document.currentScript||[].slice.call(document.getElementsByTagName("script")).pop();return a&&(n.filename=a.src,n.manual||a.hasAttribute("data-manual")||("loading"!==document.readyState?window.requestAnimationFrame?window.requestAnimationFrame(n.highlightAll):window.setTimeout(n.highlightAll,16):document.addEventListener("DOMContentLoaded",n.highlightAll))),_self.Prism}();"undefined"!=typeof module&&module.exports&&(module.exports=Prism),"undefined"!=typeof global&&(global.Prism=Prism);
4 | Prism.languages.markup={comment:/<!--[\s\S]*?-->/,prolog:/<\?[\s\S]+?\?>/,doctype:/<!DOCTYPE[\s\S]+?>/i,cdata:/<!\[CDATA\[[\s\S]*?]]>/i,tag:{pattern:/<\/?(?!\d)[^\s>\/=$<%]+(?:\s+[^\s>\/=]+(?:=(?:("|')(?:\\[\s\S]|(?!\1)[^\\])*\1|[^\s'">=]+))?)*\s*\/?>/i,greedy:!0,inside:{tag:{pattern:/^<\/?[^\s>\/]+/i,inside:{punctuation:/^<\/?/,namespace:/^[^\s>\/:]+:/}},"attr-value":{pattern:/=(?:("|')(?:\\[\s\S]|(?!\1)[^\\])*\1|[^\s'">=]+)/i,inside:{punctuation:[/^=/,{pattern:/(^|[^\\])["']/,lookbehind:!0}]}},punctuation:/\/?>/,"attr-name":{pattern:/[^\s>\/]+/,inside:{namespace:/^[^\s>\/:]+:/}}}},entity:/&#?[\da-z]{1,8};/i},Prism.languages.markup.tag.inside["attr-value"].inside.entity=Prism.languages.markup.entity,Prism.hooks.add("wrap",function(a){"entity"===a.type&&(a.attributes.title=a.content.replace(/&amp;/,"&"))}),Prism.languages.xml=Prism.languages.markup,Prism.languages.html=Prism.languages.markup,Prism.languages.mathml=Prism.languages.markup,Prism.languages.svg=Prism.languages.markup;
5 | Prism.languages.clike={comment:[{pattern:/(^|[^\\])\/\*[\s\S]*?(?:\*\/|$)/,lookbehind:!0},{pattern:/(^|[^\\:])\/\/.*/,lookbehind:!0,greedy:!0}],string:{pattern:/(["'])(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,greedy:!0},"class-name":{pattern:/((?:\b(?:class|interface|extends|implements|trait|instanceof|new)\s+)|(?:catch\s+\())[\w.\\]+/i,lookbehind:!0,inside:{punctuation:/[.\\]/}},keyword:/\b(?:if|else|while|do|for|return|in|instanceof|function|new|try|throw|catch|finally|null|break|continue)\b/,"boolean":/\b(?:true|false)\b/,"function":/[a-z0-9_]+(?=\()/i,number:/\b0x[\da-f]+\b|(?:\b\d+\.?\d*|\B\.\d+)(?:e[+-]?\d+)?/i,operator:/--?|\+\+?|!=?=?|<=?|>=?|==?=?|&&?|\|\|?|\?|\*|\/|~|\^|%/,punctuation:/[{}[\];(),.:]/};
6 | Prism.languages.javascript=Prism.languages.extend("clike",{keyword:/\b(?:as|async|await|break|case|catch|class|const|continue|debugger|default|delete|do|else|enum|export|extends|finally|for|from|function|get|if|implements|import|in|instanceof|interface|let|new|null|of|package|private|protected|public|return|set|static|super|switch|this|throw|try|typeof|var|void|while|with|yield)\b/,number:/\b(?:0[xX][\dA-Fa-f]+|0[bB][01]+|0[oO][0-7]+|NaN|Infinity)\b|(?:\b\d+\.?\d*|\B\.\d+)(?:[Ee][+-]?\d+)?/,"function":/[_$a-z\xA0-\uFFFF][$\w\xA0-\uFFFF]*(?=\s*\()/i,operator:/-[-=]?|\+[+=]?|!=?=?|<<?=?|>>?>?=?|=(?:==?|>)?|&[&=]?|\|[|=]?|\*\*?=?|\/=?|~|\^=?|%=?|\?|\.{3}/}),Prism.languages.insertBefore("javascript","keyword",{regex:{pattern:/((?:^|[^$\w\xA0-\uFFFF."'\])\s])\s*)\/(\[[^\]\r\n]+]|\\.|[^\/\\\[\r\n])+\/[gimyu]{0,5}(?=\s*($|[\r\n,.;})\]]))/,lookbehind:!0,greedy:!0},"function-variable":{pattern:/[_$a-z\xA0-\uFFFF][$\w\xA0-\uFFFF]*(?=\s*=\s*(?:function\b|(?:\([^()]*\)|[_$a-z\xA0-\uFFFF][$\w\xA0-\uFFFF]*)\s*=>))/i,alias:"function"},constant:/\b[A-Z][A-Z\d_]*\b/}),Prism.languages.insertBefore("javascript","string",{"template-string":{pattern:/`(?:\\[\s\S]|\${[^}]+}|[^\\`])*`/,greedy:!0,inside:{interpolation:{pattern:/\${[^}]+}/,inside:{"interpolation-punctuation":{pattern:/^\${|}$/,alias:"punctuation"},rest:null}},string:/[\s\S]+/}}}),Prism.languages.javascript["template-string"].inside.interpolation.inside.rest=Prism.languages.javascript,Prism.languages.markup&&Prism.languages.insertBefore("markup","tag",{script:{pattern:/(<script[\s\S]*?>)[\s\S]*?(?=<\/script>)/i,lookbehind:!0,inside:Prism.languages.javascript,alias:"language-javascript",greedy:!0}}),Prism.languages.js=Prism.languages.javascript;
7 | Prism.languages["markup-templating"]={},Object.defineProperties(Prism.languages["markup-templating"],{buildPlaceholders:{value:function(e,t,n,a){e.language===t&&(e.tokenStack=[],e.code=e.code.replace(n,function(n){if("function"==typeof a&&!a(n))return n;for(var r=e.tokenStack.length;-1!==e.code.indexOf("___"+t.toUpperCase()+r+"___");)++r;return e.tokenStack[r]=n,"___"+t.toUpperCase()+r+"___"}),e.grammar=Prism.languages.markup)}},tokenizePlaceholders:{value:function(e,t){if(e.language===t&&e.tokenStack){e.grammar=Prism.languages[t];var n=0,a=Object.keys(e.tokenStack),r=function(o){if(!(n>=a.length))for(var i=0;i<o.length;i++){var g=o[i];if("string"==typeof g||g.content&&"string"==typeof g.content){var c=a[n],s=e.tokenStack[c],l="string"==typeof g?g:g.content,p=l.indexOf("___"+t.toUpperCase()+c+"___");if(p>-1){++n;var f,u=l.substring(0,p),_=new Prism.Token(t,Prism.tokenize(s,e.grammar,t),"language-"+t,s),k=l.substring(p+("___"+t.toUpperCase()+c+"___").length);if(u||k?(f=[u,_,k].filter(function(e){return!!e}),r(f)):f=_,"string"==typeof g?Array.prototype.splice.apply(o,[i,1].concat(f)):g.content=f,n>=a.length)break}}else g.content&&"string"!=typeof g.content&&r(g.content)}};r(e.tokens)}}}});
8 | !function(e){e.languages.php=e.languages.extend("clike",{keyword:/\b(?:and|or|xor|array|as|break|case|cfunction|class|const|continue|declare|default|die|do|else|elseif|enddeclare|endfor|endforeach|endif|endswitch|endwhile|extends|for|foreach|function|include|include_once|global|if|new|return|static|switch|use|require|require_once|var|while|abstract|interface|public|implements|private|protected|parent|throw|null|echo|print|trait|namespace|final|yield|goto|instanceof|finally|try|catch)\b/i,constant:/\b[A-Z0-9_]{2,}\b/,comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|\/\/.*)/,lookbehind:!0}}),e.languages.insertBefore("php","string",{"shell-comment":{pattern:/(^|[^\\])#.*/,lookbehind:!0,alias:"comment"}}),e.languages.insertBefore("php","keyword",{delimiter:{pattern:/\?>|<\?(?:php|=)?/i,alias:"important"},variable:/\$+(?:\w+\b|(?={))/i,"package":{pattern:/(\\|namespace\s+|use\s+)[\w\\]+/,lookbehind:!0,inside:{punctuation:/\\/}}}),e.languages.insertBefore("php","operator",{property:{pattern:/(->)[\w]+/,lookbehind:!0}}),e.languages.insertBefore("php","string",{"nowdoc-string":{pattern:/<<<'([^']+)'(?:\r\n?|\n)(?:.*(?:\r\n?|\n))*?\1;/,greedy:!0,alias:"string",inside:{delimiter:{pattern:/^<<<'[^']+'|[a-z_]\w*;$/i,alias:"symbol",inside:{punctuation:/^<<<'?|[';]$/}}}},"heredoc-string":{pattern:/<<<(?:"([^"]+)"(?:\r\n?|\n)(?:.*(?:\r\n?|\n))*?\1;|([a-z_]\w*)(?:\r\n?|\n)(?:.*(?:\r\n?|\n))*?\2;)/i,greedy:!0,alias:"string",inside:{delimiter:{pattern:/^<<<(?:"[^"]+"|[a-z_]\w*)|[a-z_]\w*;$/i,alias:"symbol",inside:{punctuation:/^<<<"?|[";]$/}},interpolation:null}},"single-quoted-string":{pattern:/'(?:\\[\s\S]|[^\\'])*'/,greedy:!0,alias:"string"},"double-quoted-string":{pattern:/"(?:\\[\s\S]|[^\\"])*"/,greedy:!0,alias:"string",inside:{interpolation:null}}}),delete e.languages.php.string;var n={pattern:/{\$(?:{(?:{[^{}]+}|[^{}]+)}|[^{}])+}|(^|[^\\{])\$+(?:\w+(?:\[.+?]|->\w+)*)/,lookbehind:!0,inside:{rest:e.languages.php}};e.languages.php["heredoc-string"].inside.interpolation=n,e.languages.php["double-quoted-string"].inside.interpolation=n,e.hooks.add("before-tokenize",function(n){if(/(?:<\?php|<\?)/gi.test(n.code)){var i=/(?:<\?php|<\?)[\s\S]*?(?:\?>|$)/gi;e.languages["markup-templating"].buildPlaceholders(n,"php",i)}}),e.hooks.add("after-tokenize",function(n){e.languages["markup-templating"].tokenizePlaceholders(n,"php")})}(Prism);
9 | 


--------------------------------------------------------------------------------
/menu.php:
--------------------------------------------------------------------------------
 1 | <div id="menu">     
 2 | 	<ul id="menulist">         
 3 | 		<li><a id="Pass-01" href="<?php echo APP_URL_ROOT;?>/Pass-01/index.php">Pass-01</a></li> 
 4 | 		<li><a id="Pass-02" href="<?php echo APP_URL_ROOT;?>/Pass-02/index.php">Pass-02</a></li> 
 5 | 		<li><a id="Pass-03" href="<?php echo APP_URL_ROOT;?>/Pass-03/index.php">Pass-03</a></li> 
 6 | 		<li><a id="Pass-04" href="<?php echo APP_URL_ROOT;?>/Pass-04/index.php">Pass-04</a></li> 
 7 | 		<li><a id="Pass-05" href="<?php echo APP_URL_ROOT;?>/Pass-05/index.php">Pass-05</a></li> 
 8 | 		<li><a id="Pass-06" href="<?php echo APP_URL_ROOT;?>/Pass-06/index.php">Pass-06</a></li> 
 9 | 		<li><a id="Pass-07" href="<?php echo APP_URL_ROOT;?>/Pass-07/index.php">Pass-07</a></li> 
10 | 		<li><a id="Pass-08" href="<?php echo APP_URL_ROOT;?>/Pass-08/index.php">Pass-08</a></li> 
11 | 		<li><a id="Pass-09" href="<?php echo APP_URL_ROOT;?>/Pass-09/index.php">Pass-09</a></li> 
12 | 		<li><a id="Pass-10" href="<?php echo APP_URL_ROOT;?>/Pass-10/index.php">Pass-10</a></li> 
13 | 		<li><a id="Pass-11" href="<?php echo APP_URL_ROOT;?>/Pass-11/index.php">Pass-11</a></li> 
14 | 		<li><a id="Pass-12" href="<?php echo APP_URL_ROOT;?>/Pass-12/index.php">Pass-12</a></li> 
15 | 		<li><a id="Pass-13" href="<?php echo APP_URL_ROOT;?>/Pass-13/index.php">Pass-13</a></li> 
16 | 		<li><a id="Pass-14" href="<?php echo APP_URL_ROOT;?>/Pass-14/index.php">Pass-14</a></li> 
17 | 		<li><a id="Pass-15" href="<?php echo APP_URL_ROOT;?>/Pass-15/index.php">Pass-15</a></li> 
18 | 		<li><a id="Pass-16" href="<?php echo APP_URL_ROOT;?>/Pass-16/index.php">Pass-16</a></li> 
19 | 		<li><a id="Pass-17" href="<?php echo APP_URL_ROOT;?>/Pass-17/index.php">Pass-17</a></li> 
20 | 		<li><a id="Pass-18" href="<?php echo APP_URL_ROOT;?>/Pass-18/index.php">Pass-18</a></li> 
21 | 		<li><a id="Pass-19" href="<?php echo APP_URL_ROOT;?>/Pass-19/index.php">Pass-19</a></li>
22 | 		<li><a id="Pass-20" href="<?php echo APP_URL_ROOT;?>/Pass-20/index.php">Pass-20</a></li>
23 |         <li><a id="Pass-21" href="<?php echo APP_URL_ROOT;?>/Pass-21/index.php">Pass-21</a></li>
24 | 	</ul> 
25 | </div>
26 | 


--------------------------------------------------------------------------------
/rmdir.php:
--------------------------------------------------------------------------------
 1 | 
 2 | <?php
 3 | //循环删除目录和文件函数
 4 | error_reporting(0);
 5 | header("Content-Type: text/html;charset=utf-8");
 6 | function del_dir($dir){
 7 | 	$n_success = 0;
 8 | 	$n_fail = 0;
 9 | 	if($handle = opendir("$dir")){
10 | 		while( false !== ($item = readdir($handle))){
11 | 			if($item != "." && $item != ".."){
12 | 				if (is_dir("$dir/$item")) {
13 | 					del_dir("$dir/$item");
14 | 				}else{
15 | 					if(unlink("$dir/$item")){
16 | 						$n_success++;
17 | 					}else{
18 | 						$n_fail++;
19 | 					}
20 | 				}
21 | 			}
22 | 		}
23 | 		closedir( $handle );
24 | 		if(rmdir($dir)){
25 | 			$n_success++;
26 | 		}else{
27 | 			$n_fail++;
28 | 		}
29 | 		return '删除成功：'.$n_success.'，删除失败：'.$n_fail.'！';
30 | 	}
31 | }
32 | 
33 | function touch_upload_readme(){
34 | 	$filepath = './upload/readme.php';
35 | 	file_put_contents($filepath,"<?php echo \"该目录是上传文件保存，该文件为系统说明文件，请勿删除！\";?>");
36 | }
37 | 
38 | if($_GET['action'] == 'clean_upload_file'){
39 | 	echo del_dir("upload");
40 | 	//重新创建upload目录和readme.php文件
41 | 	sleep(0.5);
42 | 	mkdir("upload");
43 | 	touch_upload_readme();
44 | }
45 | ?>


--------------------------------------------------------------------------------
/upload/readme.php:
--------------------------------------------------------------------------------
1 | <?php echo "该目录是上传文件保存，该文件为系统说明文件，请勿删除！";?>


--------------------------------------------------------------------------------