网络安全2023 SHCTF-校外赛道 WEB WP - Powered by Discuz! Archiver

勿忘初心做自己 发表于 2023-11-26 11:17:06

2023 SHCTF-校外赛道 WEB WP

WEEK1

babyRCE

<?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}

一道较为基础的反序列化链子
文章推荐:php <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}反序列化总结
登录就给flag

点击登录，等待3秒，跳转到登录页面，尝试弱口令admin和password，登录成功

https://img2023.cnblogs.com/blog/3167109/202310/3167109-20231030195707409-1980091191.png
飞机大战

查看源代码找到
https://img2023.cnblogs.com/blog/3167109/202310/3167109-20231030195915060-1866378878.png
进去找到一串编码
https://img2023.cnblogs.com/blog/3167109/202310/3167109-20231030200000266-1173510787.png
执行一下得到base64编码
?rce=uniq${IFS}/f???flag{82c3aa08-6f04-48ab-abf3-99b9aaa1cd22} 解码即可
https://img2023.cnblogs.com/blog/3167109/202310/3167109-20231030200211858-244855188.png
ezphp

<?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}it <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}is <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}begin

第一个过滤接收字符在判断之后，可以直接忽视
https://img2023.cnblogs.com/blog/3167109/202310/3167109-20231030200838536-283390723.png
随后就是漏洞利用，这里是\e的命令执行
参考：深入研究preg_replace与代码执行
?code=${ <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}phpinfo() <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}} <?php
highlight_file(__FILE__);

class A{
public $var_1;

public function __invoke(){
include($this->var_1);
}
}

class B{
public $q;
public function __wakeup()
{
if(preg_match("/gopher|http|file|ftp|https|dict|\.\./i", $this->q)) {
         echo "hacker";
   }
}

}
class C{
public $var;
public $z;
public function __toString(){
   return $this->z->var;
}
}

class D{
public $p;
public function __get($key){
   $function = $this->p;
   return $function();
}
}

if(isset($_GET['payload']))
{
unserialize($_GET['payload']);
}
?>生成你的邀请函吧~

API：url/print("\u005a\u006d\u0078\u0068\u005a\u0033\u0074\u006d\u0059\u007a\u004a\u0068\u004e\u006d\u0045\u0031\u005a\u0053\u0030\u0030\u004d\u0044\u0064\u0069\u004c\u0054\u0051\u0035\u0059\u0054\u0055\u0074\u004f\u0044\u0051\u0035\u004e\u0053\u0030\u0077\u0059\u007a\u0041\u0033\u004d\u007a\u005a\u006c\u004e\u0032\u0045\u007a\u005a\u006d\u0052\u0039\u000a") <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
} <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}Request：POST <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}application/json <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
} <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}Body：{ <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
} <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
} <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
} <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
} <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
} <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}"name": <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}"Yourname", <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
} <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
} <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
} <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
} <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
} <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}"imgurl": <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}"http://q.qlogo.cn/headimg_dl?dst_uin=QQnumb&spec=640&img_type=jpg" <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
} <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}} <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
} <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}

使用POST <?php

$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;||\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
   system($rce);
}else {
         echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}json请求来生成你的邀请函吧~flag就在里面哦~
postman向
print("\u005a\u006d\u0078\u0068\u005a\u0033\u0074\u006d\u0059\u007a\u004a\u0068\u004e\u006d\u0045\u0031\u005a\u0053\u0030\u0030\u004d\u0044\u0064\u0069\u004c\u0054\u0051\u0035\u0059\u0054\u0055\u0074\u004f\u0044\u0051\u0035\u004e\u0053\u0030\u0077\u0059\u007a\u0041\u0033\u004d\u007a\u005a\u006c\u004e\u0032\u0045\u007a\u005a\u006d\u0052\u0039\u000a")发包即可
https://img2023.cnblogs.com/blog/3167109/202310/3167109-20231030201821988-1588239623.png
WEEK2

no_wake_up

页: [1]

ToB企服应用市场:ToB评测及商务社交产业平台's Archiver

2023 SHCTF-校外赛道 WEB WP