第一届“百度杯”信息安全攻防总决赛 web Upload

亦凉 2022-02-01 02:17 134阅读 0赞

进入题目后 先查看页面源代码：

![20190513085301664.png][]

就是说post发送ichunqiu=你发现的东西

抓包发送到repeater

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70][]

base64解密

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 1][]

猜测 大概能再解码一次

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 2][]

得到一串数字

post方式发送ichunqiu=这串数字

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 3][]

页面反显fast，说明我们得用脚本跑

![20190513090243572.png][]

import base64,requests
    
    def main():
        a = requests.session()
        b = a.get("http://be27796e9fab4928b78d609e894a64f02db126a3d76e4996.changame.ichunqiu.com/")
        key1 = b.headers["flag"]
        c = base64.b64decode(key1)
        d = str(c).split(":")
        key = base64.b64decode(d[1])
        body = {"ichunqiu": key}
        f = a.post("http://be27796e9fab4928b78d609e894a64f02db126a3d76e4996.changame.ichunqiu.com/", data=body)
        print f.text
    
    if __name__ == '__main__':
        main()

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 4][]

访问后进入新的页面

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 5][]

这里对这个网页进行源码泄露扫描发现这个

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 6][]

访问这个页面，得到：

![20190513092234954.png][]

解密得：8638d5263ab0d3face193725c23ce095

然后破解下验证码

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 7][]

substr(md5(captcha), 0, 6)=02ac0d 根据这个提示符写下脚本

for($a; $a<100000000; $a++){
    	if(substr(md5($a),0,6) == '02ac0d'){
    		echo $a;
    		exit();
    	}
    }

得到4682256，登陆

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 8][]

访问后进入新的页面

![20190513093611914.png][]

选择一个图片上传, 改后缀为pht即可获得 flag, Content-Type: 务必为 image/jpeg

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 9][]

> **为何可以直接上传后缀为 pht 或 phtml 绕过黑名单呢？**
> 
> php的conf文件中是有一个正则的后缀名限制的，只要符合都可以被当做php文件执行。
> 
> 符合的后缀包括 php、php3、php4、php5、phtml、pht 等。
> 
>  
> 
> **什么环境下可以解析 phtml 和 pht 呢？**
> 
> 1，phpstudy和wamp以及centos用yum方式 安装的lamp环境不能解析phtml和pht
> 
> 2，ubuntu和debian利用apt-get方式安装的lamp环境 就能解析phtml和pht
> 
>  
> 
> **利用这些环境特性和黑名单就能绕过限制，达到上传webshell的目的。**

[20190513085301664.png]: /images/20220201/3b29a81cd37241e0a481b265105718f7.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70]: /images/20220201/6f75875cc39c4bbfabada3be1d2ad072.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 1]: /images/20220201/df5cdc35ee084449b4ac45c68c7b754f.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 2]: /images/20220201/d882432623734b249001ea6608929abc.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 3]: /images/20220201/2e642209e29a4b8db022b31438772106.png
[20190513090243572.png]: /images/20220201/5fd241bef5834bd1934cb560a3b5c308.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 4]: /images/20220201/1f421c095b6c421e91a663500072a193.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 5]: /images/20220201/e94b9f42cdac493eb3d8f2afc12c83d4.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 6]: /images/20220201/c51ffc7934f2449fa2a332ada045fcee.png
[20190513092234954.png]: /images/20220201/3499b4fe70254f26b3bac80fd0fc653e.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 7]: /images/20220201/e6551d92d37e4b3384d2ab19e1dc1411.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 8]: /images/20220201/8c39d279503048a4befd64df7a010f7f.png
[20190513093611914.png]: /images/20220201/c0953c4c78134e6cb04a8d1eddf4521e.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 9]: /images/20220201/3a15d02b78c64c78b7616532bc153987.png