2021-08-06网鼎杯ssrfme的绕过地址waf运用ssrf-redis-主从复制写shell题解

平台：buuoj.cn

直接给出源码

<?php
function check_inner_ip($url)
{
    $match_result=preg_match('/^(http|https|gopher|dict)?:\/\/.*(\/)?.*$/',$url);
    if (!$match_result)
    {
        die('url fomat error');
    }
    try
    {
        $url_parse=parse_url($url);
    }
    catch(Exception $e)
    {
        die('url fomat error');
        return false;
    }
    $hostname=$url_parse['host'];
    $ip=gethostbyname($hostname);
    $int_ip=ip2long($ip);
    return ip2long('127.0.0.0')>>24 == $int_ip>>24 || ip2long('10.0.0.0')>>24 == $int_ip>>24 || ip2long('172.16.0.0')>>20 == $int_ip>>20 || ip2long('192.168.0.0')>>16 == $int_ip>>16;
}

function safe_request_url($url)
{

<span class="token keyword">if</span> <span class="token punctuation">(</span><span class="token function">check_inner_ip</span><span class="token punctuation">(</span><span class="token variable">$url</span><span class="token punctuation">)</span><span class="token punctuation">)</span>
<span class="token punctuation">{<!-- --></span>
    <span class="token keyword">echo</span> <span class="token variable">$url</span><span class="token punctuation">.</span><span class="token single-quoted-string string">' is inner ip'</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span>
<span class="token keyword">else</span>
<span class="token punctuation">{<!-- --></span>
    <span class="token variable">$ch</span> <span class="token operator">=</span> <span class="token function">curl_init</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token function">curl_setopt</span><span class="token punctuation">(</span><span class="token variable">$ch</span><span class="token punctuation">,</span> <span class="token constant">CURLOPT_URL</span><span class="token punctuation">,</span> <span class="token variable">$url</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token function">curl_setopt</span><span class="token punctuation">(</span><span class="token variable">$ch</span><span class="token punctuation">,</span> <span class="token constant">CURLOPT_RETURNTRANSFER</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token function">curl_setopt</span><span class="token punctuation">(</span><span class="token variable">$ch</span><span class="token punctuation">,</span> <span class="token constant">CURLOPT_HEADER</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token variable">$output</span> <span class="token operator">=</span> <span class="token function">curl_exec</span><span class="token punctuation">(</span><span class="token variable">$ch</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token variable">$result_info</span> <span class="token operator">=</span> <span class="token function">curl_getinfo</span><span class="token punctuation">(</span><span class="token variable">$ch</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token keyword">if</span> <span class="token punctuation">(</span><span class="token variable">$result_info</span><span class="token punctuation">[</span><span class="token single-quoted-string string">'redirect_url'</span><span class="token punctuation">]</span><span class="token punctuation">)</span>
    <span class="token punctuation">{<!-- --></span>
        <span class="token function">safe_request_url</span><span class="token punctuation">(</span><span class="token variable">$result_info</span><span class="token punctuation">[</span><span class="token single-quoted-string string">'redirect_url'</span><span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token punctuation">}</span>
    <span class="token function">curl_close</span><span class="token punctuation">(</span><span class="token variable">$ch</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token function">var_dump</span><span class="token punctuation">(</span><span class="token variable">$output</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span>

}
if(isset(KaTeX parse error: Expected '}', got 'EOF' at end of input: …oken variable">url = ${}_{G}ET</span><spanclass="tokenpunctuation">[</span><spanclass="tokensingle-quoted-stringstring"{>}^{\prime }ur{l}^{\prime }</span><spanclass="tokenpunctuation">]</span><spanclass="tokenpunctuation">;</span><spanclass="tokenkeyword">if</span><spanclass="tokenpunctuation">(</span><spanclass="tokenoperator">!</span><spanclass="tokenfunction">empty</span><spanclass="tokenpunctuation">(</span><spanclass="tokenvariable">$url)){
safe_request_url($url);
}
}
else{
highlight_file(FILE);
}
// Please visit hint.php locally.
?>

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41
• 42
• 43
• 44
• 45
• 46
• 47
• 48
• 49
• 50
• 51
• 52
• 53
• 54
• 55
• 56
• 57
• 58

首先对传入的url进行check_inner_ip检查是否为内网ip地址，这一部分限制了协议的使用，使用parse_url解析url，并使用gethostname、ip2long函数获取ip地址以及将ip地址转化为整数，不允许内网ip发送请求。
通过检查则返回safe_request_url使用curl处理。
注释提示我们应当以本地访问hint.php，我们构造如下url传入

?url=http://0.0.0.0/hint.php

 
 

 
 
1

0.0.0.0的IP地址表示整个网络，代表所有主机的ipv4地址，传入绕过

得知redis的密码是root，考点是redis主从复制rce。
下载以下脚本到同一目录下
https://github.com/n0b0dyCN/redis-rogue-server
https://github.com/xmsec/redis-ssrf

修改python文件



生成payload

启动redis rogue server, 接受redis的连接

把payload传入，这里注意还要url编码一次


得到flag