一、码中对MIME进行过滤：
if( ( $uploaded_type == "image/jpeg" || $uploaded_type == "image/png" ) &&( $uploaded_size < 100000 ) ) {// Can we move the file to the upload folder?if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) )
二、因此上传图片木马，通过Burp抓包，将文件名称后缀改为.php，上传成功
三、通过蚁剑连接。