-
-
[原创] KCTF 第四题 飞蛾扑火
-
发表于: 2022-5-17 10:49 4301
-
第一步:
下意识查了一下图片,防止藏东西,存在隐写。经过查证图片格式正常,无明显隐写迹象。F12后发现phpinfo.php。
第二步:
发现doku中间件,进行上传文件进行尝试。后主办方更改IP,禁用该中间件。思路回归phpinfo.php
第三步:
通过phpinfo发现存在利用file://localhost 来读取本地文件的问题。但是flag设计了过滤,首先通过postman获取源码。
Get请求:
6ffK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5J5x3g2)9J5k6e0x3$3i4K6u0W2x3e0b7#2i4K6u0W2x3e0f1%4i4K6y4m8z5o6l9@1y4q4)9J5c8Y4g2J5L8q4)9J5k6i4m8Z5M7q4)9K6c8Y4g2J5L8q4)9K6c8r3k6A6L8r3g2Q4x3@1q4Q4x3V1k6Q4x3V1k6D9L8$3y4S2L8r3S2G2M7%4c8Q4x3V1k6$3j5i4u0Q4x3V1k6%4N6%4N6Q4x3V1k6Z5N6r3#2D9i4K6u0r3N6i4u0D9i4K6u0W2M7r3S2H3
源码如下:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 | <?php function curl_request($url, $data = null, $method = 'get' , $header = array( "content-type: application/json" ), $https = true, $timeout = 5 ){ $method = strtoupper($method); $ch = curl_init(); / / 初始化 curl_setopt($ch, CURLOPT_URL, $url); / / 访问的URL curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); / / 只获取页面内容,但不输出 if ($https){ curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); / / https请求 不验证证书 curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); / / https请求 不验证HOST } if ($method ! = "GET" ) { if ($method = = 'POST' ){ curl_setopt($ch, CURLOPT_POST, true); / / 请求方式为post请求 } if ($method = = 'PUT' || strtoupper($method) = = 'DELETE' ) { curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method); / / 设置请求方式 } curl_setopt($ch, CURLOPT_POSTFIELDS, $data); / / 请求数据 } curl_setopt($ch, CURLOPT_TIMEOUT, $timeout); curl_setopt($ch, CURLOPT_HTTPHEADER, $header); / / 模拟的header头 / / curl_setopt($ch, CURLOPT_HEADER, false); / / 设置不需要头信息 $result = curl_exec($ch); / / 执行请求 curl_close($ch); / / 关闭curl,释放资源 return $result; } $url = $_GET[ "url" ]; $uu = parse_url($url); $host = isset($uu[ "host" ])?$uu[ "host" ]:""; $scheme = isset($uu[ "scheme" ])?$uu[ "scheme" ]:""; if (emptyempty($host)){ die( "host is null" ); } if (emptyempty($scheme)){ die( "scheme is null" ); } / / https: / / ctf.pediy.com / upload / team / 762 / team236762.png? if ($host = = "ctf.pediy.com" ||$host = = "127.0.0.1" ||$host = = "localhost" ){ / / echo curl_request( "2cfK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5J5x3#2)9J5k6e0f1%4i4K6u0W2x3U0f1@1i4K6u0W2y4o6u0Q4x3V1k6X3L8r3q4Y4i4K6u0W2M7r3S2H3" , "get" ,[],true, 5 ); / / get flag echo curl_request($url,'', "get" ,[],true, 5 ); } else { die( "host not allow" ); } ?> |
第四步:
根据源代码进行绕过设计URL如下
c0bK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5J5x3g2)9J5k6e0x3$3i4K6u0W2x3e0b7#2i4K6u0W2x3e0f1%4i4K6y4m8z5o6l9@1y4q4)9J5c8Y4g2J5L8q4)9J5k6i4m8Z5M7q4)9K6c8Y4g2J5L8q4)9K6c8o6p5J5x3#2)9J5k6e0f1%4i4K6u0W2x3U0f1@1i4K6u0W2y4o6u0Q4x3@1q4Q4x3V1k6Q4x3V1j5I4x3U0N6Q4x3X3f1H3i4K6u0W2x3q4)9J5k6e0q4Q4x3V1k6Q4x3X3g2Q4x3X3g2Q4x3V1k6X3L8r3q4Y4i4K6u0W2M7r3S2H3
获取Flag:flag{xxx_999()xx*@eeEEE}
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
赞赏
- [原创]KCTF 2024 签到题 537
- [原创]KCTF 第一题 — 失控的AI 3306
- [原创]KCTF 第0题——签到题 1624
- [原创]第十一题 虫洞末日 11163
- [原创] KCTF 第四题 飞蛾扑火 4302