CTFshow baby杯wp

baby_captcha
ctfshowcms
应该不难
baby_php
完美的缺点

baby_captcha

点击无脑，会给一个字典。爆破
admin fire

ctfshowcms

index.php里有个包含
/install/index.php里是个重新安装的操作，但是有锁。这里可以用存在include的界面将这个页面包含进来。再进行重新安装。这段代码有个连接数据库的操作，我们可以用这点来构造一个恶意的mysql客户端来进行任意文件读取。

原理看这：https://www.modb.pro/db/51823
主要这个：

恶意脚本：https://github.com/MorouU/rogue_mysql_server/blob/main/rogue_mysql_server.py
读取文件位置与端口号：

payload:

flag:

应该不难

https://www.dz-x.net/t/1017/1/1.html
表前缀可以写shell

baby_php

<?php

/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2021-05-31 13:40:37
# @Last Modified by:   h1xa
# @Last Modified time: 2021-05-31 16:36:27
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

*/


error_reporting(0);

class fileUtil{

    private $name;
    private $content;


    public function __construct($name,$content=''){
        $this->name = $name;
        $this->content = $content;
        ini_set('open_basedir', '/var/www/html');
    }

    public function file_upload(){
        if($this->waf($this->name) && $this->waf($this->content)){
            return file_put_contents($this->name, $this->content);
        }else{
            return 0;
        }
    }

    private function waf($input){
        return !preg_match('/php/i', $input);
    }

    public function file_download(){
        if(file_exists($this->name)){
            header('Content-Type: application/octet-stream');
            header('Content-Disposition: attachment; filename="'.$this->name.'"');
            header('Content-Transfer-Encoding: binary');
            echo file_get_contents($this->name);
        }else{
            return False;
        }
    }

    public function __destruct(){

    }

}

$action = $_GET['a']?$_GET['a']:highlight_file(__FILE__);

if($action==='upload'){
    die('Permission denied');
}

switch ($action) {
    case 'upload':
        $name = $_POST['name'];
        $content = $_POST['content'];
        $ft = new fileUtil($name,$content);
        if($ft->file_upload()){
            echo $name.' upload success!';
        }
        break;
    case 'download':
        $name = $_POST['name'];
        $ft = new fileUtil($name,$content);
        if($ft->file_download()===False){
            echo $name.' download failed';
        }
        break;
    default:
        echo 'baby come on';
        break;
}

弱比较，并且upload的位置靠前。
代码又waf了php，内容可以用<?=绕，文件名可以用.user.ini绕过

完美的缺点

<?php

/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2021-05-31 21:42:40
# @Last Modified by:   h1xa
# @Last Modified time: 2021-06-01 00:08:12
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

*/


highlight_file(__FILE__);
error_reporting(0);
ini_set('open_basedir', '/var/www/html/');

$file_name = substr($_GET['file_name'], 0,16);
$file_content=substr($_GET['file_content'], 0,32);

file_put_contents('/c/t/f/s/h/o/w/'.$file_name, $file_content);

if(file_get_contents('php://input')==='ctfshow'){
    include($file_name);
}

写shell应该是不可能了，看见可以进行文件包含。
羽师傅的payload:file_name=data:,<?=`ls`;’
当时没想到这么来用data，一直卡在

$file_name = substr($_GET['file_name'], 0,16);

传像这种没有赋值的post数据时，用burp (hackbar老bug了)