ctfshowweb终极考核
发表于：2021-10-12 |
字数统计: 1.8k | 阅读时长: 10分钟 | 阅读量：

web640

就在界面上

web641

在信息的包头中

image-20210912110714630

web642

使用awvs进行扫描以后发现网站敏感目录/sytem36d/

访问system36d/得到flag，这里借助bp工具，flag转瞬即逝

image-20210912165307621

web643

在网站的login窗口中，有一个命令测试

image-20210912170101101

我怕么么进行抓包后修改为ls后放包，image-20210912170254101

发现secret.txt，url解码

image-20210912170357988

web644

扫描到的网站目录中有login.php，直接登录，然后进行js跟踪，密码在js文件中暴露了“0x36D”，登陆后拿到flag，当然flag在ks文件中也直接暴露了

image-20210912165827875

web645

进去之后提示flag是密码，但是隐藏了，然后进行数据库备份即可，文件中有flag

image-20210912165651710

web646

接着在远程更新抓包，发现了一个文件包含漏洞，一个个文件的包含，可以看到init.php中有646

image-20210912170831254

image-20210912170738962

1
2
3
4
5
//checklogin.php
$_GET['s'];
setcookie('uid',intval($s));
$_SESSION['user_id']=intval($s);
header('location:main.php');
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
//user.php
session_start();r
include 'init.php';r
r
$a=$_GET['action'];r
r
r
$data = file_get_contents(DB_PATH);r
$ret = '';r
switch ($a) {r
	case 'list':r
		$ret = getUsers($data,intval($_GET['page']),intval($_GET['limit']));r
		break;r
	case 'add':r
		$ret = addUser($data,$_GET['username'],$_GET['password']);r
		break;r
	case 'del':r
		$ret = delUser($data,$_GET['username']);r
		break;r
	case 'update':r
		$ret = updateUser($data,$_GET['username'],$_GET['password']);r
		break;r
	case 'backup':r
		backupUsers();r
		break;r
	case 'upload':r
		$ret = recoveryUsers();r
		break;r
	case 'phpInfo':r
		$ret = phpInfoTest();r
		break;r
	case 'netTest':r
		$ret = netTest($_GET['cmd']);r
		break;r
	case 'remoteUpdate':r
		$ret = remoteUpdate($_GET['auth'],$_GET['update_address']);r
		break;r
	case 'authKeyValidate':r
		$ret = authKeyValidate($_GET['auth']);r
		break;r
	case 'evilString':r
		evilString($_GET['m']);r
		break;r
	case 'evilNumber':r
		evilNumber($_GET['m'],$_GET['key']);r
		break;r
	case 'evilFunction':r
		evilFunction($_GET['m'],$_GET['key']);r
		break;r
	case 'evilArray':r
		evilArray($_GET['m'],$_GET['key']);r
		break;r
	case 'evilClass':r
		evilClass($_GET['m'],$_GET['key']);r
		break;r
	default:r
		$ret = json_encode(array(r
		'code'=>0,r
		'message'=>'\u6570\u636e\u83b7\u53d6\u5931\u8d25',r
		));r
		break;r
}r
r
echo $ret;r
r
r
r
function getUsers($data,$page=1,$limit=10){r
	$ret = array(r
		'code'=>0,r
		'message'=>'\u6570\u636e\u83b7\u53d6\u6210\u529f',r
		'data'=>array()r
	);r
r
	r
	$isadmin = '\u5426';r
	$pass = '';r
	$content='\u65e0';r
r
	$users = explode('|', $data);r
	array_pop($users);r
	$index = 1;r
r
	foreach ($users as $u) {r
		if(explode('@', $u)[0]=='admin'){r
			$isadmin = '\u662f';r
			$pass = 'flag\u5c31\u662f\u7ba1\u7406\u5458\u7684\u5bc6\u7801\uff0c\u4e0d\u8fc7\u6211\u9690\u85cf\u4e86';r
			$content = '\u5220\u9664\u6b64\u6761\u8bb0\u5f55\u540eflag\u5c31\u4f1a\u6d88\u5931';r
		}else{r
			$pass = explode('@', $u)[1];r
		}r
		array_push($ret['data'], array(r
			'id'=>$index,r
			'username'=>explode('@', $u)[0],r
			'password'=>$pass,r
			'isAdmin'=>$isadmin,r
			'content'=>$contentr
		));r
		$index +=1;r
	}r
	$ret['count']=$index;r
	$start = ($page-1)*$limit;r
	$ret['data']=array_slice($ret['data'], $start,$limit,true);r
r
	return json_encode($ret);r
r
}r
r
function addUser($data,$username,$password){r
	$ret = array(r
		'code'=>0,r
		'message'=>'\u6dfb\u52a0\u6210\u529f'r
	);r
	if(existsUser($data,$username)==0){r
		$s = $data.$username.'@'.$password.'|';r
		file_put_contents(DB_PATH, $s);r
r
	}else{r
		$ret['code']=-1;r
		$ret['message']='\u7528\u6237\u5df2\u5b58\u5728';r
	}r
r
	return json_encode($ret);r
}r
r
function updateUser($data,$username,$password){r
	$ret = array(r
		'code'=>0,r
		'message'=>'\u66f4\u65b0\u6210\u529f'r
	);r
	if(existsUser($data,$username)>0 && $username!='admin'){r
		$s = preg_replace('\/'.$username.'@[0-9a-zA-Z]+\\|\/', $username.'@'.$password.'|', $data);r
		file_put_contents(DB_PATH, $s);r
r
	}else{r
		$ret['code']=-1;r
		$ret['message']='\u7528\u6237\u4e0d\u5b58\u5728\u6216\u65e0\u6743\u66f4\u65b0';r
	}r
r
	return json_encode($ret);r
}r
r
function delUser($data,$username){r
	$ret = array(r
		'code'=>0,r
		'message'=>'\u5220\u9664\u6210\u529f'r
	);r
	if(existsUser($data,$username)>0 && $username!='admin'){r
		$s = preg_replace('\/'.$username.'@[0-9a-zA-Z]+\\|\/', '', $data);r
		file_put_contents(DB_PATH, $s);r
r
	}else{r
		$ret['code']=-1;r
		$ret['message']='\u7528\u6237\u4e0d\u5b58\u5728\u6216\u65e0\u6743\u5220\u9664';r
	}r
r
	return json_encode($ret);r
r
}r
r
function existsUser($data,$username){r
	return preg_match('\/'.$username.'@[0-9a-zA-Z]+\\|\/', $data);r
}r
r
function backupUsers(){r
	$file_name = DB_PATH;r
	if (! file_exists ($file_name )) {    r
	    header('HTTP\/1.1 404 NOT FOUND');  r
	} else {    r
	    $file = fopen ($file_name, \"rb\" ); r
	    Header ( \"Content-type: application\/octet-stream\" ); r
	    Header ( \"Accept-Ranges: bytes\" );  r
	    Header ( \"Accept-Length: \" . filesize ($file_name));  r
	    Header ( \"Content-Disposition: attachment; filename=backup.dat\");     r
	    echo str_replace(FLAG645, 'flag\u5c31\u5728\u8fd9\u91cc\uff0c\u53ef\u60dc\u4e0d\u80fd\u7ed9\u4f60', fread ( $file, filesize ($file_name)));    r
	    fclose ( $file );    r
	    exit ();    r
	}r
}r
r
function getArray($total, $times, $min, $max)r
    {r
        $data = array();r
        if ($min * $times > $total) {r
            return array();r
        }r
        if ($max * $times < $total) {r
            return array();r
        }r
        while ($times >= 1) {r
            $times--;r
            $kmix = max($min, $total - $times * $max);r
            $kmax = min($max, $total - $times * $min);r
            $kAvg = $total \/ ($times + 1);r
            $kDis = min($kAvg - $kmix, $kmax - $kAvg);r
            $r = ((float)(rand(1, 10000) \/ 10000) - 0.5) * $kDis * 2;r
            $k = round($kAvg + $r);r
            $total -= $k;r
            $data[] = $k;r
        }r
        return $data;r
 }r
r
r
function recoveryUsers(){r
	$ret = array(r
		'code'=>0,r
		'message'=>'\u6062\u590d\u6210\u529f'r
	);r
	if(isset($_FILES['file']) && $_FILES['file']['size']<1024*1024){r
		$file_name= $_FILES['file']['tmp_name'];r
		$result = move_uploaded_file($file_name, DB_PATH);r
		if($result===false){r
			$ret['message']='\u6570\u636e\u6062\u590d\u5931\u8d25 file_name'.$file_name.' DB_PATH='.DB_PATH;r
		}r
r
	}else{r
		$ret['message']='\u6570\u636e\u6062\u590d\u5931\u8d25';r
	}r
r
	return json_encode($ret);r
}r
r
function phpInfoTest(){r
	return phpinfo();r
r
}r
r
function authKeyValidate($auth){r
	$ret = array(r
		'code'=>0,r
		'message'=>$auth==substr(FLAG645, 8)?'\u9a8c\u8bc1\u6210\u529f':'\u9a8c\u8bc1\u5931\u8d25',r
		'status'=>$auth==substr(FLAG645, 8)?'0':'-1'r
	);r
	return json_encode($ret);r
}r
r
function remoteUpdate($auth,$address){r
	$ret = array(r
		'code'=>0,r
		'message'=>'\u66f4\u65b0\u5931\u8d25'r
	);r
r
	if($auth!==substr(FLAG645, 8)){r
		$ret['message']='\u6743\u9650key\u9a8c\u8bc1\u5931\u8d25';r
		return json_encode($ret);r
	}else{r
		$content = file_get_contents($address);r
		$ret['message']=($content!==false?$content:'\u5730\u5740\u4e0d\u53ef\u8fbe');r
	}r
r
	return json_encode($ret);r
r
r
}r
r
function evilString($m){r
	$key = '372619038';r
	$content = call_user_func($m);r
	if(stripos($content, $key)!==FALSE){r
		echo shell_exec('cat \/FLAG\/FLAG647');r
	}else{r
		echo 'you are not 372619038?';r
	}r
r
}r
r
function evilClass($m,$k){r
	class ctfshow{r
		public $m;r
		public function construct($m){r
			$this->$m=$m;r
		}r
	}r
r
	$ctfshow=new ctfshow($m);r
	$ctfshow->$m=$m;r
	if($ctfshow->$m==$m && $k==shell_exec('cat \/FLAG\/FLAG647')){r
		echo shell_exec('cat \/FLAG\/FLAG648');r
	}else{r
		echo 'mmmmm?';r
	}r
r
}r
r
function evilNumber($m,$k){r
	$number = getArray(1000,20,10,999);r
	if($number[$m]==$m && $k==shell_exec('cat \/FLAG\/FLAG648')){r
		echo shell_exec('cat \/FLAG\/FLAG649');r
	}else{r
		echo 'number is right?';r
	}r
}r
r
function evilFunction($m,$k){r
	$key = 'ffffffff';r
	$content = call_user_func($m);r
	if(stripos($content, $key)!==FALSE && $k==shell_exec('cat \/FLAG\/FLAG649')){r
		echo shell_exec('cat \/FLAG\/FLAG650');r
	}else{r
		echo 'you are not ffffffff?';r
	}r
}r
r
function evilArray($m,$k){r
	$arrays=unserialize($m);r
	if($arrays!==false){r
		if(array_key_exists('username', $arrays) && in_array('ctfshow', get_object_vars($arrays)) &&  $k==shell_exec('cat \/FLAG\/FLAG650')){r
			echo shell_exec('cat \/FLAG\/FLAG651');r
		}else{r
			echo 'array?';r
		}r
	}r
}r
r
function netTest($cmd){r
	$ret = array(r
		'code'=>0,r
		'message'=>'\u547d\u4ee4\u6267\u884c\u5931\u8d25'r
	);r
r
	if(preg_match('\/^[A-Za-z]+$\/', $cmd)){r
		$res = shell_exec($cmd);r
		stripos(PHP_OS,'WIN')!==FALSE?$ret['message']=iconv(\"GBK\", \"UTF-8\", $res):$ret['message']=$res;r
	}r
	r
	return json_encode($ret);r
}r
"}

web652

在page界面sqlmap一把梭即可

ctfshow
上一篇:
c语言linux网络编程
下一篇:
连接centos数据库（mysql）
本文目录
本文目录
    •

    Copyright © 2019 - yangyang-linux | Powered by Hexo | Theme Bamboo

    本站总访问量： 次 |

    本博客已萌萌哒地运行