图片上传漏洞之ASP木马最终防御解决方案

华夏久久

最近发现我辛辛苦苦做好的行业网站老有人喜欢入上面上传些小马.心里很是恼火.想了很久终于想出了一条封杀所有ASP木马的方案出来.

分析图片上传代码:
HTML页面
<!--#include file="upload.inc"-->
<style>
td{font-size:9pt;line-height:120%;color:#353535}
body{font-size:9pt;line-height:120%}

a:link { color: #000000; text-decoration: none }
a:visited { color: #000000; text-decoration: none }
a:active { color: #000000; text-decoration: none }
a:hover { color: #336699; text-decoration: none; position: relative; right: 0px; top: 1px }
</style>
<%
set upload=new upload_file
if upload.form("act")="uploadfile" then
filepath=trim(upload.form("filepath"))
filelx=trim(upload.form("filelx"))

i=0
for each formName in upload.File
set file=upload.File(formName)

fileExt=lcase(file.FileExt) '得到的文件扩展名不含有.
if file.filesize<250 then
response.write "<span style=""font-family: 宋体; font-size: 9pt"">请先选择你要上传的文件！　[ <a href=# onclick=history.go(-1)>重新上传</a> ]</span>"
response.end
end if
if (filelx<>"swf") and (filelx<>"jpg") then
response.write "<span style=""font-family: 宋体; font-size: 9pt"">该文件类型不能上传！　[ <a href=# onclick=history.go(-1)>重新上传</a> ]</span>"
response.end
end if
if filelx="swf" then
if fileext<>"swf" then
response.write "<span style=""font-family: 宋体; font-size: 9pt"">只能上传swf格式的Flash文件！　[ <a href=# onclick=history.go(-1)>重新上传</a> ]</span>"
response.end
end if
end if
if filelx="jpg" then
if fileext<>"gif" and fileext<>"jpg" and fileext<>"bmp" then
response.write "<span style=""font-family: 宋体; font-size: 9pt"">只能上传jpg、gif、bmp格式的图片！　[ <a href=# onclick=history.go(-1)>重新上传</a> ]</span>"
response.end
end if
end if
if filelx="swf" then
if file.filesize>(3000*1024) then
response.write "<span style=""font-family: 宋体; font-size: 9pt"">最大只能上传 3M 的Flash文件！　[ <a href=# onclick=history.go(-1)>重新上传</a> ]</span>"
response.end
end if
end if
if filelx="jpg" then
if file.filesize>(250*1024) then
response.write "<span style=""font-family: 宋体; font-size: 9pt"">最大只能上传 250K 的图片文件！　[ <a href=# onclick=history.go(-1)>重新上传</a> ]</span>"
response.end
end if
end if

randomize
ranNum=int(90000*rnd)+10000
filename=filepath&session("useradmin")&"_"&year(now)&month(now)&day(now)&hour(now)&minute(now)&second(now)&ranNum&"."&fileExt
%>
<%
if file.FileSize>0 then ''如果 FileSize > 0 说明有文件数据
'file.SaveAs Server.mappath(filename) ''保存文件
file.SaveToFile Server.mappath(FileName)
'response.write file.FileName&"　　上传成功!　　<br>"
'response.write "新文件名："&FileName&"<br>"
'response.write "新文件名已复制到所需的位置，可关闭窗口！"
if filelx="swf" then
response.write "<script>window.opener.document."&upload.form("FormName")&".size.value='"&int(file.FileSize/1024)&" K'</script> "
end if
response.write "<script>window.opener.document."&upload.form("FormName")&"."&upload.form("EditName")&".value='"&FileName&"'</script> "
%>
<%
end if
set file=nothing
next
set upload=nothing
end if
%>
<script language="javascript">
window.alert("文件上传成功!请不要修改生成的链接地址！");
window.close();
</script>

华夏久久

发现我们的这份代码非常的不安全,通过\0漏洞很快就可以轻松上传自己想要的木马.现在我们在以上代码中附加上传后的文件的验证代码.判断是否该文件存在危险操作及恶意代码.于是我们在源代码中加入以下验证代码:

-VBScript
sFile=server.mappath(FileName)
set MyFile=server.CreateObject("Scripting.FileSystemObject")
set MyText=MyFile.OpenTextFile(sFile, 1) '读取文本文件
sTextAll=lcase(MyText.ReadAll)
MyText.close
'判断用户文件中的危险操作
sStr="script <% .getfolder .createfolder .deletefolder .createdirectory .deletedirectory .saveas wscript.shell script.encode"
sNoString=split(sStr," ")
for i=0 to ubound(sNoString)
if instr(sTextAll,sNoString(i)) then
set filedel=server.CreateObject ("Scripting.FileSystemObject")
filedel.deletefile server.mappath(FileName)
response.write "你的ip和时间已被纪录，由于你曾多次使用该方法对系统进行非法攻击，我们将会把你的数据向广东省公安部及网警报告!"&"攻击IP:"&request.servervariables("remote_addr")&",攻击时间:"&date()&" "&time()
set MyFiletemp=server.CreateObject("Scripting.FileSystemObject")
set wfile=myfiletemp.opentextfile(server.mappath("gjrz.txt"),8)
wfile.writeline date()&" "&time()&" "&request.servervariables("remote_addr")
Response.end
end if
next

华夏久久

即全文代码:

<!--#include file="upload.inc"-->
<style>
td{font-size:9pt;line-height:120%;color:#353535}
body{font-size:9pt;line-height:120%}

a:link { color: #000000; text-decoration: none }
a:visited { color: #000000; text-decoration: none }
a:active { color: #000000; text-decoration: none }
a:hover { color: #336699; text-decoration: none; position: relative; right: 0px; top: 1px }
</style>
<%
set upload=new upload_file
if upload.form("act")="uploadfile" then
filepath=trim(upload.form("filepath"))
filelx=trim(upload.form("filelx"))

i=0
for each formName in upload.File
set file=upload.File(formName)

fileExt=lcase(file.FileExt) '得到的文件扩展名不含有.
if file.filesize<250 then
response.write "<span style=""font-family: 宋体; font-size: 9pt"">请先选择你要上传的文件！　[ <a href=# onclick=history.go(-1)>重新上传</a> ]</span>"
response.end
end if
if (filelx<>"swf") and (filelx<>"jpg") then
response.write "<span style=""font-family: 宋体; font-size: 9pt"">该文件类型不能上传！　[ <a href=# onclick=history.go(-1)>重新上传</a> ]</span>"
response.end
end if
if filelx="swf" then
if fileext<>"swf" then
response.write "<span style=""font-family: 宋体; font-size: 9pt"">只能上传swf格式的Flash文件！　[ <a href=# onclick=history.go(-1)>重新上传</a> ]</span>"
response.end
end if
end if
if filelx="jpg" then
if fileext<>"gif" and fileext<>"jpg" and fileext<>"bmp" then
response.write "<span style=""font-family: 宋体; font-size: 9pt"">只能上传jpg、gif、bmp格式的图片！　[ <a href=# onclick=history.go(-1)>重新上传</a> ]</span>"
response.end
end if
end if
if filelx="swf" then
if file.filesize>(3000*1024) then
response.write "<span style=""font-family: 宋体; font-size: 9pt"">最大只能上传 3M 的Flash文件！　[ <a href=# onclick=history.go(-1)>重新上传</a> ]</span>"
response.end
end if
end if
if filelx="jpg" then
if file.filesize>(250*1024) then
response.write "<span style=""font-family: 宋体; font-size: 9pt"">最大只能上传 250K 的图片文件！　[ <a href=# onclick=history.go(-1)>重新上传</a> ]</span>"
response.end
end if
end if

randomize
ranNum=int(90000*rnd)+10000
filename=filepath&session("useradmin")&"_"&year(now)&month(now)&day(now)&hour(now)&minute(now)&second(now)&ranNum&"."&fileExt
%>

华夏久久

1. <%
   
2. if file.FileSize>0 then ''如果 FileSize > 0 说明有文件数据
   
3. 'file.SaveAs Server.mappath(filename) ''保存文件
   
4. file.SaveToFile Server.mappath(FileName)
   
5. sFile=server.mappath(FileName)
   
6. set MyFile=server.CreateObject("Scripting.FileSystemObject")
   
7. set MyText=MyFile.OpenTextFile(sFile, 1) '读取文本文件
   
8. sTextAll=lcase(MyText.ReadAll)
   
9. MyText.close
   
10. '判断用户文件中的危险操作
    
11. sStr="script <% .getfolder .createfolder .deletefolder .createdirectory .deletedirectory .saveas wscript.shell script.encode"
    
12. sNoString=split(sStr," ")
    
13. for i=0 to ubound(sNoString)
    
14. if instr(sTextAll,sNoString(i)) then
    
15. set filedel=server.CreateObject ("Scripting.FileSystemObject")
    
16. filedel.deletefile server.mappath(FileName)
    
17. response.write "你的ip和时间已被纪录，由于你曾多次使用该方法对系统进行非法攻击，我们将会把你的数据向广东省公安部及网警报告!"&"攻击IP:"&request.servervariables("remote_addr")&",攻击时间:"&date()&" "&time()
    
18. set MyFiletemp=server.CreateObject("Scripting.FileSystemObject")
    
19. set wfile=myfiletemp.opentextfile(server.mappath("gjrz.txt"),8)
    
20. wfile.writeline date()&" "&time()&" "&request.servervariables("remote_addr")
    
21. Response.end
    
22. end if
    
23. next
    
24. 
    
25. 'response.write file.FileName&"　　上传成功!　　<br>"
    
26. 'response.write "新文件名："&FileName&"<br>"
    
27. 'response.write "新文件名已复制到所需的位置，可关闭窗口！"
    
28. if filelx="swf" then
    
29. response.write "<script>window.opener.document."&upload.form("FormName")&".size.value='"&int(file.FileSize/1024)&" K'</script> "
    
30. end if
    
31. response.write "<script>window.opener.document."&upload.form("FormName")&"."&upload.form("EditName")&".value='"&FileName&"'</script> "
    
32. %>
    
33. <%
    
34. end if
    
35. set file=nothing
    
36. next
    
37. set upload=nothing
    
38. end if
    
39. %>
    
40. <script language="javascript">
    
41. window.alert("文件上传成功!请不要修改生成的链接地址！");
    
42. window.close();
    
43. </script>
    
44. 因此只要他上传的文件中含有:<%,script ,encode等等脚本代码或者ASP代码,通通删除上传的文件.并作出警告.即使他把ASP木马加密也难逃被杀的命运.
    

复制代码