buuctf-Can you guess it?(代码审计)

最新推荐文章于 2024-04-22 16:59:45 发布

m0_62094846

最新推荐文章于 2024-04-22 16:59:45 发布

阅读量331

点赞数

文章标签： php 开发语言

本文链接：https://blog.csdn.net/m0_62094846/article/details/124783222

版权

random_bites:生成适合加密使用的任意长度的加密随机字节字符串

<?php
include 'config.php'; // FLAG is defined in config.php

if (preg_match('/config\.php\/*$/i', $_SERVER['PHP_SELF'])) {
  exit("I don't know what you are thinking, but I won't let you read it :)");
}

if (isset($_GET['source'])) {
  highlight_file(basename($_SERVER['PHP_SELF']));
  exit();
}

$secret = bin2hex(random_bytes(64));
if (isset($_POST['guess'])) {
  $guess = (string) $_POST['guess'];
  if (hash_equals($secret, $guess)) {
    $message = 'Congratulations! The flag is: ' . FLAG;
  } else {
    $message = 'Wrong.';
  }
}
?>
<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <title>Can you guess it?</title>
  </head>
  <body>
    <h1>Can you guess it?</h1>
    <p>If your guess is correct, I'll give you the flag.</p>
    <p><a href="?source">Source</a></p>
    <hr>
<?php if (isset($message)) { ?>
    <p><?= $message ?></p>
<?php } ?>
    <form action="index.php" method="POST">
      <input type="text" name="guess">
      <input type="submit">
    </form>
  </body>
</html>

关键信息应该是这一块

$secret = bin2hex(random_bytes(64));
if (isset($_POST['guess'])) {
  $guess = (string) $_POST['guess'];
  if (hash_equals($secret, $guess)) {
    $message = 'Congratulations! The flag is: ' . FLAG;
  } else {
    $message = 'Wrong.';
  }
}

但是64随机加密后也不知道会是什么，guess很难和它相等

这个思路就有问题了

if (preg_match('/config\.php\/*$/i', $_SERVER['PHP_SELF'])) {
  exit("I don't know what you are thinking, but I won't let you read it :)");
}
if (isset($_GET['source'])) {
  highlight_file(basename($_SERVER['PHP_SELF']));
  exit();
}

如果地址匹配到了config.php就会结束，而config.php中有flag

basename()返回最终的文件名，即如果最后是config.php，就会返回config.php，这样highlight_file就可以显示出config.php中的内容了，前提是要绕过正则判断

preg_match('/config\.php\/*$/i

$	匹配输入字符串的结束位置。如果设置了RegExp 对象的 Multiline 属性，$ 也匹配 '\n' 或 '\r' 之前的位置。

这个代码应该是匹配字符串到结尾，结尾的位置要是config.php

在这后面加东西应该就能绕过

basename()函数的一个问题，它会去掉文件名开头的非ASCII值

/index.php/config.php/%ff?source

%81 %89等不是ascii值的都可以

m0_62094846

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
buuctf-Can you guess it?(代码审计)

random_bites:生成适合加密使用的任意长度的加密随机字节字符串<?phpinclude 'config.php'; // FLAG is defined in config.phpif (preg_match('/config\.php\/*$/i', $_SERVER['PHP_SELF'])) { exit("I don't know what you are thinking, but I won't let you read it :)...
复制链接

扫一扫