bugku web21 never never never give up

最新推荐文章于 2024-05-21 21:44:07 发布

彼岸花苏陌

最新推荐文章于 2024-05-21 21:44:07 发布

阅读量247

点赞数

分类专栏： ctf 文章标签： ctf web php代码审计伪协议

本文链接：https://blog.csdn.net/qq_42263820/article/details/114030243

版权

ctf 专栏收录该内容

39 篇文章 4 订阅

订阅专栏

Bugku CTF web菜鸡刷题

web21

web21

http://114.67.246.176:19678/hello.php?id=1

id=1 尝试注入，无果
F12提示1p.html
输入试试
？？？直接跳到bugku主界面
用burpsuite看看

Host: www.bugku.com
Referer: http://114.67.246.176:19678/1p.html

感觉是重定向
再提交一次
结果在F12-网络-响应载荷发现了异样

<HTML>
<HEAD>
<SCRIPT LANGUAGE="Javascript">
<!--


var Words ="%3Cscript%3Ewindow.location.href%3D'http%3A%2F%2Fwww.bugku.com'%3B%3C%2Fscript%3E%20%0A%3C!--JTIyJTNCaWYoISUyNF9HRVQlNUInaWQnJTVEKSUwQSU3QiUwQSUwOWhlYWRlcignTG9jYXRpb24lM0ElMjBoZWxsby5waHAlM0ZpZCUzRDEnKSUzQiUwQSUwOWV4aXQoKSUzQiUwQSU3RCUwQSUyNGlkJTNEJTI0X0dFVCU1QidpZCclNUQlM0IlMEElMjRhJTNEJTI0X0dFVCU1QidhJyU1RCUzQiUwQSUyNGIlM0QlMjRfR0VUJTVCJ2InJTVEJTNCJTBBaWYoc3RyaXBvcyglMjRhJTJDJy4nKSklMEElN0IlMEElMDllY2hvJTIwJ25vJTIwbm8lMjBubyUyMG5vJTIwbm8lMjBubyUyMG5vJyUzQiUwQSUwOXJldHVybiUyMCUzQiUwQSU3RCUwQSUyNGRhdGElMjAlM0QlMjAlNDBmaWxlX2dldF9jb250ZW50cyglMjRhJTJDJ3InKSUzQiUwQWlmKCUyNGRhdGElM0QlM0QlMjJidWdrdSUyMGlzJTIwYSUyMG5pY2UlMjBwbGF0ZWZvcm0hJTIyJTIwYW5kJTIwJTI0aWQlM0QlM0QwJTIwYW5kJTIwc3RybGVuKCUyNGIpJTNFNSUyMGFuZCUyMGVyZWdpKCUyMjExMSUyMi5zdWJzdHIoJTI0YiUyQzAlMkMxKSUyQyUyMjExMTQlMjIpJTIwYW5kJTIwc3Vic3RyKCUyNGIlMkMwJTJDMSkhJTNENCklMEElN0IlMEElMDklMjRmbGFnJTIwJTNEJTIwJTIyZmxhZyU3QioqKioqKioqKioqJTdEJTIyJTBBJTdEJTBBZWxzZSUwQSU3QiUwQSUwOXByaW50JTIwJTIybmV2ZXIlMjBuZXZlciUyMG5ldmVyJTIwZ2l2ZSUyMHVwJTIwISEhJTIyJTNCJTBBJTdEJTBBJTBBJTBBJTNGJTNF--%3E" 
function OutWord()
{
var NewWords;
NewWords = unescape(Words);
document.write(NewWords);
} 
OutWord();
// -->
</SCRIPT>
</HEAD>
<BODY>
</BODY>
</HTML>

URL解码一次

<script>window.location.href='http://www.bugku.com';</script> 
<!--JTIyJTNCaWYoISUyNF9HRVQlNUInaWQnJTVEKSUwQSU3QiUwQSUwOWhlYWRlcignTG9jYXRpb24lM0ElMjBoZWxsby5waHAlM0ZpZCUzRDEnKSUzQiUwQSUwOWV4aXQoKSUzQiUwQSU3RCUwQSUyNGlkJTNEJTI0X0dFVCU1QidpZCclNUQlM0IlMEElMjRhJTNEJTI0X0dFVCU1QidhJyU1RCUzQiUwQSUyNGIlM0QlMjRfR0VUJTVCJ2InJTVEJTNCJTBBaWYoc3RyaXBvcyglMjRhJTJDJy4nKSklMEElN0IlMEElMDllY2hvJTIwJ25vJTIwbm8lMjBubyUyMG5vJTIwbm8lMjBubyUyMG5vJyUzQiUwQSUwOXJldHVybiUyMCUzQiUwQSU3RCUwQSUyNGRhdGElMjAlM0QlMjAlNDBmaWxlX2dldF9jb250ZW50cyglMjRhJTJDJ3InKSUzQiUwQWlmKCUyNGRhdGElM0QlM0QlMjJidWdrdSUyMGlzJTIwYSUyMG5pY2UlMjBwbGF0ZWZvcm0hJTIyJTIwYW5kJTIwJTI0aWQlM0QlM0QwJTIwYW5kJTIwc3RybGVuKCUyNGIpJTNFNSUyMGFuZCUyMGVyZWdpKCUyMjExMSUyMi5zdWJzdHIoJTI0YiUyQzAlMkMxKSUyQyUyMjExMTQlMjIpJTIwYW5kJTIwc3Vic3RyKCUyNGIlMkMwJTJDMSkhJTNENCklMEElN0IlMEElMDklMjRmbGFnJTIwJTNEJTIwJTIyZmxhZyU3QioqKioqKioqKioqJTdEJTIyJTBBJTdEJTBBZWxzZSUwQSU3QiUwQSUwOXByaW50JTIwJTIybmV2ZXIlMjBuZXZlciUyMG5ldmVyJTIwZ2l2ZSUyMHVwJTIwISEhJTIyJTNCJTBBJTdEJTBBJTBBJTBBJTNGJTNF-->

base64解密一次

";if(!$_GET['id'])
{
	header('Location: hello.php?id=1');
	exit();
}
$id=$_GET['id'];
$a=$_GET['a'];
$b=$_GET['b'];
if(stripos($a,'.'))
{
	echo 'no no no no no no no';
	return ;
}
$data = @file_get_contents($a,'r');
if($data=="bugku is a nice plateform!" and $id==0 and strlen($b)>5 and eregi("111".substr($b,0,1),"1114") and substr($b,0,1)!=4)
{
	$flag = "flag{***********}"
}
else
{
	print "never never never give up !!!";
}


?>

代码审计ing
1.判断是否GET了id参，没有就执行exit
2.a参数不能出现.(stripos函数查找出现位置)
3.把a参写到data参中
4.id弱等于0
5.eregi函数：一个参数里寻找另一个参数，没有返回false
6.substr($b,0,1) 玩过sql注入应该都知道，不多讲

substr($b,0,1)!=4
这个估计就是限制你b不能取4，得另谋他路
id不能为0否则跳入exit
但是id弱等于0
php中’‘0==php’'这个是成立的，所以写字母就行

目前看来
a=bugku is a nice plateform!
id=q
b未知

到这里没思路了，看了下大佬博客
发现
Strlen检测长度时遇到%00不会被截断，而eregi会被截断
那就截断漏洞呗？
则b=%00123456
发现不对
再看解析，发现file_get_contents也有问题

源码中变量 $data 是由 file_get_contents() 函数读取变量 $a 的值而得，所以 $a 的值必须为数据流。

所以取值的话传不到data变量，从而导致判断不成立。
所以大佬给出的方法是用伪协议php://input

最终答案
id=test&a=php://input&b=%0012345
post传个bugku is a nice plateform!即可

彼岸花苏陌

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
bugku web21 never never never give up

Bugku CTF web菜鸡刷题web22web22http://114.67.246.176:19678/hello.php?id=1id=1 尝试注入，无果F12提示1p.html输入试试？？？直接跳到bugku主界面用burpsuite看看Host: www.bugku.comReferer: http://114.67.246.176:19678/1p.html感觉是重定向再提交一次结果在F12-网络-响应载荷发现了异样<HTML><HEAD&gt
复制链接

扫一扫

专栏目录