【ctfshow】web篇-终极考核 wp

| | | | 1.5k

前言

记录web的题目wp，慢慢变强，铸剑。

终极考核

web640

进去就可以直接拿

web641

头文件泄露

image-20210828190118537

web642

查看源码，访问敏感路径，在返回包中

1
/system36d/static/css/start.css

访问/system36d/得到flag

image-20210828190517170

web643

在得到645之后会说

web644

通过登录页面的源码，找到敏感信息中包含flag

1
/system36d/login.php

在源码中发现了，其中有flag，和登录密码

1
/system36d/static/js/lock/index.js

image-20210828190718909

web645

在数据库备份中

image-20210828190924891接着可以看到命令执行的窗口抓包，执行ls，可以看到secret.txt访问就得到，url解码

image-20210828212750616

web646

接着在远程更新抓包，发现了一个文件包含漏洞，一个个文件的包含，可以看到init.php中有646

image-20210828215410374

接着查看checklogin.php得到

1
2
3
4
$_GET['s'];
setcookie('uid',intval($s));
$_SESSION['user_id']=intval($s);
header('location:main.php');

接着查看users.php得到源码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
session_start();r
include 'init.php';r
r
$a=$_GET['action'];r
r
r
$data = file_get_contents(DB_PATH);r
$ret = '';r
switch ($a) {r
	case 'list':r
		$ret = getUsers($data,intval($_GET['page']),intval($_GET['limit']));r
		break;r
	case 'add':r
		$ret = addUser($data,$_GET['username'],$_GET['password']);r
		break;r
	case 'del':r
		$ret = delUser($data,$_GET['username']);r
		break;r
	case 'update':r
		$ret = updateUser($data,$_GET['username'],$_GET['password']);r
		break;r
	case 'backup':r
		backupUsers();r
		break;r
	case 'upload':r
		$ret = recoveryUsers();r
		break;r
	case 'phpInfo':r
		$ret = phpInfoTest();r
		break;r
	case 'netTest':r
		$ret = netTest($_GET['cmd']);r
		break;r
	case 'remoteUpdate':r
		$ret = remoteUpdate($_GET['auth'],$_GET['update_address']);r
		break;r
	case 'authKeyValidate':r
		$ret = authKeyValidate($_GET['auth']);r
		break;r
	case 'evilString':r
		evilString($_GET['m']);r
		break;r
	case 'evilNumber':r
		evilNumber($_GET['m'],$_GET['key']);r
		break;r
	case 'evilFunction':r
		evilFunction($_GET['m'],$_GET['key']);r
		break;r
	case 'evilArray':r
		evilArray($_GET['m'],$_GET['key']);r
		break;r
	case 'evilClass':r
		evilClass($_GET['m'],$_GET['key']);r
		break;r
	default:r
		$ret = json_encode(array(r
		'code'=>0,r
		'message'=>'\u6570\u636e\u83b7\u53d6\u5931\u8d25',r
		));r
		break;r
}r
r
echo $ret;r
r
r
r
function getUsers($data,$page=1,$limit=10){r
	$ret = array(r
		'code'=>0,r
		'message'=>'\u6570\u636e\u83b7\u53d6\u6210\u529f',r
		'data'=>array()r
	);r
r
	r
	$isadmin = '\u5426';r
	$pass = '';r
	$content='\u65e0';r
r
	$users = explode('|', $data);r
	array_pop($users);r
	$index = 1;r
r
	foreach ($users as $u) {r
		if(explode('@', $u)[0]=='admin'){r
			$isadmin = '\u662f';r
			$pass = 'flag\u5c31\u662f\u7ba1\u7406\u5458\u7684\u5bc6\u7801\uff0c\u4e0d\u8fc7\u6211\u9690\u85cf\u4e86';r
			$content = '\u5220\u9664\u6b64\u6761\u8bb0\u5f55\u540eflag\u5c31\u4f1a\u6d88\u5931';r
		}else{r
			$pass = explode('@', $u)[1];r
		}r
		array_push($ret['data'], array(r
			'id'=>$index,r
			'username'=>explode('@', $u)[0],r
			'password'=>$pass,r
			'isAdmin'=>$isadmin,r
			'content'=>$contentr
		));r
		$index +=1;r
	}r
	$ret['count']=$index;r
	$start = ($page-1)*$limit;r
	$ret['data']=array_slice($ret['data'], $start,$limit,true);r
r
	return json_encode($ret);r
r
}r
r
function addUser($data,$username,$password){r
	$ret = array(r
		'code'=>0,r
		'message'=>'\u6dfb\u52a0\u6210\u529f'r
	);r
	if(existsUser($data,$username)==0){r
		$s = $data.$username.'@'.$password.'|';r
		file_put_contents(DB_PATH, $s);r
r
	}else{r
		$ret['code']=-1;r
		$ret['message']='\u7528\u6237\u5df2\u5b58\u5728';r
	}r
r
	return json_encode($ret);r
}r
r
function updateUser($data,$username,$password){r
	$ret = array(r
		'code'=>0,r
		'message'=>'\u66f4\u65b0\u6210\u529f'r
	);r
	if(existsUser($data,$username)>0 && $username!='admin'){r
		$s = preg_replace('\/'.$username.'@[0-9a-zA-Z]+\\|\/', $username.'@'.$password.'|', $data);r
		file_put_contents(DB_PATH, $s);r
r
	}else{r
		$ret['code']=-1;r
		$ret['message']='\u7528\u6237\u4e0d\u5b58\u5728\u6216\u65e0\u6743\u66f4\u65b0';r
	}r
r
	return json_encode($ret);r
}r
r
function delUser($data,$username){r
	$ret = array(r
		'code'=>0,r
		'message'=>'\u5220\u9664\u6210\u529f'r
	);r
	if(existsUser($data,$username)>0 && $username!='admin'){r
		$s = preg_replace('\/'.$username.'@[0-9a-zA-Z]+\\|\/', '', $data);r
		file_put_contents(DB_PATH, $s);r
r
	}else{r
		$ret['code']=-1;r
		$ret['message']='\u7528\u6237\u4e0d\u5b58\u5728\u6216\u65e0\u6743\u5220\u9664';r
	}r
r
	return json_encode($ret);r
r
}r
r
function existsUser($data,$username){r
	return preg_match('\/'.$username.'@[0-9a-zA-Z]+\\|\/', $data);r
}r
r
function backupUsers(){r
	$file_name = DB_PATH;r
	if (! file_exists ($file_name )) {    r
	    header('HTTP\/1.1 404 NOT FOUND');  r
	} else {    r
	    $file = fopen ($file_name, \"rb\" ); r
	    Header ( \"Content-type: application\/octet-stream\" ); r
	    Header ( \"Accept-Ranges: bytes\" );  r
	    Header ( \"Accept-Length: \" . filesize ($file_name));  r
	    Header ( \"Content-Disposition: attachment; filename=backup.dat\");     r
	    echo str_replace(FLAG645, 'flag\u5c31\u5728\u8fd9\u91cc\uff0c\u53ef\u60dc\u4e0d\u80fd\u7ed9\u4f60', fread ( $file, filesize ($file_name)));    r
	    fclose ( $file );    r
	    exit ();    r
	}r
}r
r
function getArray($total, $times, $min, $max)r
    {r
        $data = array();r
        if ($min * $times > $total) {r
            return array();r
        }r
        if ($max * $times < $total) {r
            return array();r
        }r
        while ($times >= 1) {r
            $times--;r
            $kmix = max($min, $total - $times * $max);r
            $kmax = min($max, $total - $times * $min);r
            $kAvg = $total \/ ($times + 1);r
            $kDis = min($kAvg - $kmix, $kmax - $kAvg);r
            $r = ((float)(rand(1, 10000) \/ 10000) - 0.5) * $kDis * 2;r
            $k = round($kAvg + $r);r
            $total -= $k;r
            $data[] = $k;r
        }r
        return $data;r
 }r
r
r
function recoveryUsers(){r
	$ret = array(r
		'code'=>0,r
		'message'=>'\u6062\u590d\u6210\u529f'r
	);r
	if(isset($_FILES['file']) && $_FILES['file']['size']<1024*1024){r
		$file_name= $_FILES['file']['tmp_name'];r
		$result = move_uploaded_file($file_name, DB_PATH);r
		if($result===false){r
			$ret['message']='\u6570\u636e\u6062\u590d\u5931\u8d25 file_name'.$file_name.' DB_PATH='.DB_PATH;r
		}r
r
	}else{r
		$ret['message']='\u6570\u636e\u6062\u590d\u5931\u8d25';r
	}r
r
	return json_encode($ret);r
}r
r
function phpInfoTest(){r
	return phpinfo();r
r
}r
r
function authKeyValidate($auth){r
	$ret = array(r
		'code'=>0,r
		'message'=>$auth==substr(FLAG645, 8)?'\u9a8c\u8bc1\u6210\u529f':'\u9a8c\u8bc1\u5931\u8d25',r
		'status'=>$auth==substr(FLAG645, 8)?'0':'-1'r
	);r
	return json_encode($ret);r
}r
r
function remoteUpdate($auth,$address){r
	$ret = array(r
		'code'=>0,r
		'message'=>'\u66f4\u65b0\u5931\u8d25'r
	);r
r
	if($auth!==substr(FLAG645, 8)){r
		$ret['message']='\u6743\u9650key\u9a8c\u8bc1\u5931\u8d25';r
		return json_encode($ret);r
	}else{r
		$content = file_get_contents($address);r
		$ret['message']=($content!==false?$content:'\u5730\u5740\u4e0d\u53ef\u8fbe');r
	}r
r
	return json_encode($ret);r
r
r
}r
r
function evilString($m){r
	$key = '372619038';r
	$content = call_user_func($m);r
	if(stripos($content, $key)!==FALSE){r
		echo shell_exec('cat \/FLAG\/FLAG647');r
	}else{r
		echo 'you are not 372619038?';r
	}r
r
}r
r
function evilClass($m,$k){r
	class ctfshow{r
		public $m;r
		public function construct($m){r
			$this->$m=$m;r
		}r
	}r
r
	$ctfshow=new ctfshow($m);r
	$ctfshow->$m=$m;r
	if($ctfshow->$m==$m && $k==shell_exec('cat \/FLAG\/FLAG647')){r
		echo shell_exec('cat \/FLAG\/FLAG648');r
	}else{r
		echo 'mmmmm?';r
	}r
r
}r
r
function evilNumber($m,$k){r
	$number = getArray(1000,20,10,999);r
	if($number[$m]==$m && $k==shell_exec('cat \/FLAG\/FLAG648')){r
		echo shell_exec('cat \/FLAG\/FLAG649');r
	}else{r
		echo 'number is right?';r
	}r
}r
r
function evilFunction($m,$k){r
	$key = 'ffffffff';r
	$content = call_user_func($m);r
	if(stripos($content, $key)!==FALSE && $k==shell_exec('cat \/FLAG\/FLAG649')){r
		echo shell_exec('cat \/FLAG\/FLAG650');r
	}else{r
		echo 'you are not ffffffff?';r
	}r
}r
r
function evilArray($m,$k){r
	$arrays=unserialize($m);r
	if($arrays!==false){r
		if(array_key_exists('username', $arrays) && in_array('ctfshow', get_object_vars($arrays)) &&  $k==shell_exec('cat \/FLAG\/FLAG650')){r
			echo shell_exec('cat \/FLAG\/FLAG651');r
		}else{r
			echo 'array?';r
		}r
	}r
}r
r
function netTest($cmd){r
	$ret = array(r
		'code'=>0,r
		'message'=>'\u547d\u4ee4\u6267\u884c\u5931\u8d25'r
	);r
r
	if(preg_match('\/^[A-Za-z]+$\/', $cmd)){r
		$res = shell_exec($cmd);r
		stripos(PHP_OS,'WIN')!==FALSE?$ret['message']=iconv(\"GBK\", \"UTF-8\", $res):$ret['message']=$res;r
	}r
	r
	return json_encode($ret);r
}r
"}

本文标题:【ctfshow】web篇-终极考核 wp

文章作者:孤桜懶契

发布时间:2020年07月07日 - 22:00:00

最后更新:2022年05月20日 - 11:47:45

原始链接:https://gylq.gitee.io/posts/117.html

许可协议: 署名-非商业性使用-禁止演绎 4.0 国际 转载请保留原文链接及作者。

-------------------本文结束 感谢您的阅读-------------------
欢迎光临
❤️
孤桜懶契
请多关照
❤️
❤️