baby_captcha
ctfshowcms
应该不难
baby_php
完美的缺点
baby_captcha
点击无脑,会给一个字典。爆破
admin fire
ctfshowcms
index.php里有个包含
/install/index.php里是个重新安装的操作,但是有锁。这里可以用存在include的界面将这个页面包含进来。再进行重新安装。这段代码有个连接数据库的操作,我们可以用这点来构造一个恶意的mysql客户端来进行任意文件读取。
原理看这:https://www.modb.pro/db/51823
主要这个:
恶意脚本:https://github.com/MorouU/rogue_mysql_server/blob/main/rogue_mysql_server.py
读取文件位置与端口号:
payload:
flag:
应该不难
https://www.dz-x.net/t/1017/1/1.html
表前缀可以写shell
baby_php
<?php
/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date: 2021-05-31 13:40:37
# @Last Modified by: h1xa
# @Last Modified time: 2021-05-31 16:36:27
# @email: h1xa@ctfer.com
# @link: https://ctfer.com
*/
error_reporting(0);
class fileUtil{
private $name;
private $content;
public function __construct($name,$content=''){
$this->name = $name;
$this->content = $content;
ini_set('open_basedir', '/var/www/html');
}
public function file_upload(){
if($this->waf($this->name) && $this->waf($this->content)){
return file_put_contents($this->name, $this->content);
}else{
return 0;
}
}
private function waf($input){
return !preg_match('/php/i', $input);
}
public function file_download(){
if(file_exists($this->name)){
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="'.$this->name.'"');
header('Content-Transfer-Encoding: binary');
echo file_get_contents($this->name);
}else{
return False;
}
}
public function __destruct(){
}
}
$action = $_GET['a']?$_GET['a']:highlight_file(__FILE__);
if($action==='upload'){
die('Permission denied');
}
switch ($action) {
case 'upload':
$name = $_POST['name'];
$content = $_POST['content'];
$ft = new fileUtil($name,$content);
if($ft->file_upload()){
echo $name.' upload success!';
}
break;
case 'download':
$name = $_POST['name'];
$ft = new fileUtil($name,$content);
if($ft->file_download()===False){
echo $name.' download failed';
}
break;
default:
echo 'baby come on';
break;
}
弱比较,并且upload的位置靠前。
代码又waf了php,内容可以用<?=绕,文件名可以用.user.ini绕过
完美的缺点
<?php
/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date: 2021-05-31 21:42:40
# @Last Modified by: h1xa
# @Last Modified time: 2021-06-01 00:08:12
# @email: h1xa@ctfer.com
# @link: https://ctfer.com
*/
highlight_file(__FILE__);
error_reporting(0);
ini_set('open_basedir', '/var/www/html/');
$file_name = substr($_GET['file_name'], 0,16);
$file_content=substr($_GET['file_content'], 0,32);
file_put_contents('/c/t/f/s/h/o/w/'.$file_name, $file_content);
if(file_get_contents('php://input')==='ctfshow'){
include($file_name);
}
写shell应该是不可能了,看见可以进行文件包含。
羽师傅的payload:file_name=data:,<?=`ls`;’
当时没想到这么来用data,一直卡在
$file_name = substr($_GET['file_name'], 0,16);
传像这种没有赋值的post数据时,用burp (hackbar老bug了)