CTFshow baby杯wp

baby_captcha
ctfshowcms
应该不难
baby_php
完美的缺点

baby_captcha

点击无脑，会给一个字典。爆破
admin fire

ctfshowcms

index.php里有个包含
/install/index.php里是个重新安装的操作，但是有锁。这里可以用存在include的界面将这个页面包含进来。再进行重新安装。这段代码有个连接数据库的操作，我们可以用这点来构造一个恶意的mysql客户端来进行任意文件读取。

原理看这：https://www.modb.pro/db/51823
主要这个：

恶意脚本：https://github.com/MorouU/rogue_mysql_server/blob/main/rogue_mysql_server.py
读取文件位置与端口号：

payload:

flag:

应该不难

https://www.dz-x.net/t/1017/1/1.html
表前缀可以写shell

baby_php

<?php/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2021-05-31 13:40:37
# @Last Modified by:   h1xa
# @Last Modified time: 2021-05-31 16:36:27
# @email: h1xa@ctfer.com
# @link: https://ctfer.com*/error_reporting(0);class fileUtil{private $name;private $content;public function __construct($name,$content=''){$this->name = $name;$this->content = $content;ini_set('open_basedir', '/var/www/html');}public function file_upload(){if($this->waf($this->name) && $this->waf($this->content)){return file_put_contents($this->name, $this->content);}else{return 0;}}private function waf($input){return !preg_match('/php/i', $input);}public function file_download(){if(file_exists($this->name)){header('Content-Type: application/octet-stream');header('Content-Disposition: attachment; filename="'.$this->name.'"');header('Content-Transfer-Encoding: binary');echo file_get_contents($this->name);}else{return False;}}public function __destruct(){}}$action = $_GET['a']?$_GET['a']:highlight_file(__FILE__);if($action==='upload'){die('Permission denied');
}switch ($action) {case 'upload':$name = $_POST['name'];$content = $_POST['content'];$ft = new fileUtil($name,$content);if($ft->file_upload()){echo $name.' upload success!';}break;case 'download':$name = $_POST['name'];$ft = new fileUtil($name,$content);if($ft->file_download()===False){echo $name.' download failed';}break;default:echo 'baby come on';break;
}

弱比较，并且upload的位置靠前。
代码又waf了php，内容可以用<?=绕，文件名可以用.user.ini绕过

完美的缺点

<?php/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2021-05-31 21:42:40
# @Last Modified by:   h1xa
# @Last Modified time: 2021-06-01 00:08:12
# @email: h1xa@ctfer.com
# @link: https://ctfer.com*/highlight_file(__FILE__);
error_reporting(0);
ini_set('open_basedir', '/var/www/html/');$file_name = substr($_GET['file_name'], 0,16);
$file_content=substr($_GET['file_content'], 0,32);file_put_contents('/c/t/f/s/h/o/w/'.$file_name, $file_content);if(file_get_contents('php://input')==='ctfshow'){include($file_name);
}

写shell应该是不可能了，看见可以进行文件包含。
羽师傅的payload:file_name=data:,<?=`ls`;’
当时没想到这么来用data，一直卡在

$file_name = substr($_GET['file_name'], 0,16);

传像这种没有赋值的post数据时，用burp (hackbar老bug了)