python文件上传工具实现

0x00

之前验收waf模块webshell效果，组网pc--waf--webserver，收集网络上的webshell样本，进行上传测试。由于数量较多8000+个样本，

只好写了个工具进行验收。

webshell下载地址https://github.com/tennc/webshell.git

0x01

客户端实现

使用python的requests_toolbelt 库进文件上传，这里有个坑，不能用requests库，requests上传文件只post一个数据包，在文件较大情况下，上传文件不全。

# -*- coding: utf-8 -*-
#@Time      :2018/7/14 9:39
#@Author    :cui0x01
#@file      :webshell_send.py


from requests_toolbelt import MultipartEncoder
import requests
import time
import os
import sys
import getopt

global logdate
logdate = time.strftime(\'%Y%m%d%H%M%S\',time.localtime())
def w_log(data):
    \'\'\'

    :return:
    \'\'\'
    if not os.path.exists(\'log\'):
        os.mkdir(\'log\')
    log_name=os.path.join(\'log\',logdate)
    with open(log_name,\'a+\') as f:
        f.write(data)

def send_url(url,folder):
    \'\'\'

    :return:
    \'\'\'
    abs_path = os.path.abspath(os.path.dirname(__file__))
    folder_path=os.path.join(abs_path,folder)
    try:
        file_list= os.listdir(folder_path)
    except BaseException as re:
        print(\'\'\'
        %s is not exist, please check your folder.
        \'\'\'%folder)
        os._exit(0)
    for filename in file_list:
        #print(filename)
        #print(url)
        m = MultipartEncoder(
            fields={\'uploaded\': (filename, open(os.path.join(folder_path,filename), \'rb\'), \'text/plain\')}
        )
        \'\'\'
        Content-Disposition: form-data; name="uploaded"; filename="aa.php"
        这里的files里uploaded   就是multipart协议name字段里面的uploaded
        服务端也是根据isset( $_FILES[ \'uploaded\' ]，multipart协议name字段里面的uploaded接收文件。
        如果修改，要保持一致。
        \'\'\'
        #print(len(files))
        time.sleep(1)
        #file=os.path.join(folder_path,filename)
        #new_url=url+filename
        try:
            r = requests.post(url, data=m,headers={\'Content-Type\': m.content_type})
        except BaseException as re:
            print(\'waf reject: filename %s\'%filename)
            data=\'waf reject: filename %s \n\'%filename
            w_log(data)

        else:
            print("waf allow: filename: %s"%filename)
            data="waf allow: filename: %s \n"%filename
            w_log(data)



if __name__ == "__main__":

    try:
        opts,args=getopt.getopt(sys.argv[1:],\'u:f:\')
        u=opts[0][1]
        f=opts[1][1]
        #print(u,f)
    except Exception as e:
        print(\'\'\'
        ******************************************************************
        ex:python3 xx.py -u http://33.33.35.20/upload/upload.php -f white
        -u: target url                                                   
        -f: local folder                                                 
        ******************************************************************
        \'\'\')
        os._exit(0)
    send_url(u,f)

 0x02

服务端实现

用php接收，环境xp+phpstudy

<?php

if( isset( $_FILES[ \'uploaded\' ] ) ) {
	
	$target_path  = "uploads/".basename( $_FILES[ \'uploaded\' ][ \'name\' ] );

    if( !move_uploaded_file( $_FILES[ \'uploaded\' ][ \'tmp_name\' ], $target_path ) ) {

        echo \'<pre>Your image was not uploaded.</pre>\';
    }
    else {

        echo "<pre>{$target_path} succesfully uploaded!</pre>";
    }
}

?> 

 0x03

效果演示

服务端

客户端

抓包查看

 

文件上传成功

 

下载地址：https://github.com/cui0x01/python_daily/tree/master/upload_fuzz_tool